Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
The following analytic detects the creation of a file named "test.txt" within the Windows system directory, indicative of Samsam ransomware propagation. It leverages file-system activity data from the Endpoint data model, specifically monitoring file paths within the Windows System32 directory. This activity is significant as it aligns with known Samsam ransomware behavior, which uses such files for propagation and execution. If confirmed malicious, this could lead to ransomware deployment, resulting in data encryption, system disruption, and potential data loss. Immediate investigation and remediation are crucial to prevent further damage.
The following analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin. It leverages the Endpoint.Filesystem and Endpoint.Processes data models in Splunk to identify any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This activity is significant because it may indicate an attacker attempting to hide their actions, potentially leading to data theft, ransomware, or other malicious outcomes. If confirmed malicious, this behavior could allow an attacker to persist in the environment and evade detection by security tools.
The analytic identifies the creation of a .crmlog file within the %windows%\Registration directory, typically with a format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog. This activity is significant as it is associated with the Snake malware, which uses this file for its operations. If confirmed malicious, this could indicate the presence of Snake malware, leading to potential data exfiltration, system compromise, and further malicious activities. Immediate investigation is required to mitigate the threat.
This analytic detects a sharp increase in the number of files written to a specific host. It leverages the Endpoint.Filesystem data model, focusing on 'created' actions and comparing current file write counts against historical averages and standard deviations. This activity is significant as a sudden spike in file writes can indicate malicious activities such as ransomware encryption or data exfiltration. If confirmed malicious, this behavior could lead to significant data loss, system compromise, or further propagation of malware within the network.
This analytic detects instances where the `rundll32.exe` process creates new executable (`.exe`) or dynamic link library (`.dll`) files. This behavior is identified by monitoring Sysmon EventCode 11 (FileCreate). `rundll32.exe` is a legitimate Windows utility, but it is frequently abused by adversaries to execute malicious code, establish persistence, or escalate privileges. Malware families like IcedID are known to leverage `rundll32.exe` to drop payloads in common user-writable directories such as `Temp`, `AppData`, or `ProgramData`. Detecting this activity can indicate the presence of malicious software attempting to deploy its components.
The analytic detects the `wermgr.exe` process creating an executable file. This behavior is unusual because `wermgr.exe` is typically associated with error reporting, not file creation. Such activity is significant as it may indicate TrickBot malware, which injects code into `wermgr.exe` to execute malicious actions like downloading additional payloads. If confirmed malicious, this could lead to further malware infections, data exfiltration, or system compromise.
Detects the dropping and potential execution of DarkGate loader components, specifically AutoIt scripts (.au3) or compiled AutoIt executables (autoit3.exe), within the C:\temp directory. This activity is indicative of DarkGate malware infection attempts, often leveraging vulnerabilities like CVE-2024-21412.
Detects the creation of files with scripting or executable extensions by the MySQL daemon process. This activity could indicate the abuse of MySQL User Defined Functions (UDFs) to download and execute malware, often as part of a broader compromise or to establish persistence.
This rule detects the creation or modification of anonymous links in OneDrive. Anonymous links can be used to export files from OneDrive, posing a risk of data leakage, especially in organizations that do not support their creation.
This rule detects the wmRAT backdoor by identifying specific byte patterns associated with its core functionalities. These functionalities include connecting to a command and control (C2) server, finding and exfiltrating files, receiving data and writing it to files, and gathering system information. The rule looks for a combination of these distinct byte patterns to minimize false positives.
Detects suspicious file creations within the Palo Alto Networks PAN-OS' parent telemetry folder, specifically looking for filenames containing patterns indicative of OS command injection attempts related to CVE-2024-3400. These files are processed by the 'dt_curl' script, which can lead to arbitrary command execution if device telemetry is enabled and filenames are crafted to bypass shell-subprocess restrictions.
Detects the creation of Python path configuration files (.pth) within Python library folders on Windows systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically targets files ending with '.pth' in paths matching '\(venv|python(.+)?)\lib\site-packages\', while filtering out known legitimate .pth files like 'pywin32.pth' and 'distutils-precedence.pth'.
Detects the creation of Python path configuration files (.pth) within Python library folders on macOS. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are explicitly imported by a script. The rule specifically looks for files ending with '.pth' in the '/lib/python3.([5-9]|[0-9]{2})/site-packages/' directory structure.
Detects the creation of Python path configuration files (.pth) within Python library folders on Linux systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically looks for files ending with '.pth' in typical Python site-packages directories.
Detects the creation of JavaScript files within the Windows DriverStore directory. This activity has been observed in attacks by the Forest Blizzard APT (also known as Star Blizzard) to exploit CVE-2022-38028 in the Windows Print Spooler service. The adversary modified a JavaScript constraints file and executed it with SYSTEM-level permissions to achieve privilege escalation and credential access.
Detects the creation of new files with the ".evtx" extension in non-common or non-standard locations. This could indicate tampering with default EVTX locations to evade security controls or exfiltration of event logs to search for sensitive information. Note that backup software and legitimate administrators might perform similar actions during troubleshooting.
This rule identifies when a single user copies a large number of files from Google Drive within a one-hour period. This behavior can be indicative of data exfiltration attempts, where an attacker or malicious insider is trying to move sensitive data out of the organization's control. The rule specifically looks for 'copy' or 'source_copy' events within Google Workspace Drive logs and triggers if more than 10 distinct documents are copied by the same user in an hour.
This rule detects the creation, modification, copying, or moving of Windows shortcut (.lnk) files into sensitive user directories such as Desktop, Documents, and Start Menu folders. Adversaries often use .lnk files for persistence, execution, or to deliver malicious payloads, especially when placed in locations that are frequently accessed or automatically executed by the system or user.
Detects the creation of files with suspicious extensions (e.g., .bat, .dll, .exe, .hta, .js, .ps1, .vbe, .vbs) within the Windows Public user folder. This activity can indicate an adversary staging malicious scripts or binaries in a location accessible to all users, potentially for execution or further distribution.
This rule detects the creation of specific configuration files (`.conf`) in the `AppData\Roaming` directory, which have been observed in the wild to be associated with Remote Access Trojans (RATs) such as VenomRAT, AsyncRAT, and Lumma Stealer. The rule looks for files ending with `datalogs.conf`, `hvnc.conf`, or `dcrat.conf` within subdirectories like `mydata`, `datalogs`, `hvnc`, or `dcrat` under `AppData\Roaming`.
Detects indicators of exploitation by threat actors during exploitation of the "SlashAndGrab" vulnerability related to ScreenConnect (ConnectWise) as reported by Team Huntress. This rule specifically looks for the creation of known malicious files and paths associated with post-exploitation activities after successful exploitation of CVE-2024-1709 and CVE-2024-1708.
Page 210 of 217