Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects creation and movement of .lnk files to specific folders
This rule detects the Helldown ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include finding files for encryption, the encryption process itself, dropping a ransom note, and attempting to kill virtual machines. The rule specifically targets ELF executables, indicating it's designed for Linux systems.
Detects the creation of a file named "wermgr.exe" in an uncommon directory, which could indicate exploitation of CVE-2023-36874. The rule specifically looks for 'wermgr.exe' being created outside of standard Windows system directories, aiming to catch malicious instances masquerading as the legitimate Windows Error Reporting Manager.
Detects exploitation indicators of CVE-2022-42475, a heap-based buffer overflow vulnerability in FortiOS SSL-VPN's sslvpnd daemon. The rule specifically looks for the creation of known malicious files or configuration backups in specific directories, which are artifacts of successful exploitation.
Detects the creation of Self Extraction Directive (.sed) files in suspicious locations. These files are used by the 'iexpress.exe' utility to create self-extracting packages. Adversaries have been observed abusing this utility to create PE files with embedded .sed entries, often as a defense evasion technique.
Detects the creation of a file with an ".rdp" extension by applications that are not typically expected to create such files, such as web browsers, email clients, and chat applications. This can indicate an attempt to deliver a malicious RDP file to a user, potentially leading to initial access or defense evasion.
This rule detects the creation of files with uncommon extensions within Microsoft Office application startup folders, specifically for Word and Excel. Adversaries often leverage these folders to establish persistence by placing malicious documents, templates, or add-ins that execute automatically when the respective Office application is launched. The rule filters out common and legitimate Office file extensions to reduce false positives.
Detects file write events from or to a fake Recycle.Bin folder, which is often used by malware as a staging directory. Adversaries may create folders with names similar to legitimate system directories (e.g., "RECYCLERS.BIN" instead of "RECYCLER.BIN") to hide their malicious files and evade detection.
Detects the creation of files with names commonly used by various memory dumping tools to extract credentials from the Local Security Authority Subsystem Service (LSASS) process memory. This includes specific filenames and patterns associated with tools like Procdump, MirrorDump, PPLBlade, RustiveDump, NativeDump, and Nanodump.
Detects the creation of specific files within the SysAidServer Tomcat webapps directory, which are indicators associated with the Lace Tempest threat group (also known as FIN7). The rule looks for specific filenames and suffixes that have been observed in attacks involving PowerShell scripts by this group.
Detects the creation of a specific file path commonly used in Proof-of-Concept (PoC) exploits for the Print Spooler vulnerability CVE-2021-1675, also known as PrintNightmare. This file path is typically created when an attacker successfully exploits the vulnerability to achieve remote code execution or privilege escalation.
Detects the creation of files that resemble exports of the local Security Account Manager (SAM) database. This activity is often associated with credential dumping techniques used by adversaries to obtain local user hashes. The rule specifically looks for common filenames and paths used when dumping the SAM hive, including those related to known exploits like CVE-2021-36934 and tools like ShadowSteal and hivenightmare.
Detects signs of the exploitation of Local Privilege Escalation (LPE) vulnerability CVE-2021-41379. This specific rule identifies the creation of an 'elevation_service.exe' file by 'msiexec.exe' within the Microsoft Edge application directory, which is a known indicator of this exploit.
Detects the creation of 'Autoit3.exe' by uncommon or suspicious processes such as 'curl.exe', 'KeyScramblerLogon.exe', 'ExtExport.exe', or 'wmprph.exe'. This activity is associated with DarkGate malware, which leverages 'Autoit3.exe' to execute shellcode for process injection and C2 communication. The identified parent processes are considered non-standard for creating this executable.
This rule detects the creation of a file named "code_tunnel.json". This file is associated with the execution and usage of the Visual Studio Code (VSCode) tunneling utility. Adversaries can abuse this functionality to establish a command and control (C2) channel, allowing them to remotely control compromised systems.
Detects the creation of files by the "node.exe" process within the ".vscode-server" directory, specifically targeting paths related to user history. This activity could indicate remote file creation via the Visual Studio Code tunnel feature, which might be used for unauthorized access or data transfer.
Detects the creation of files with a double extension where the second extension is ".lnk" and the first extension is commonly associated with documents or images. This technique is often used by malware to masquerade malicious LNK files as benign documents or images, exploiting the default Windows behavior of hiding known file extensions.
Detects the creation of an HTA file in the Windows Startup folder by FoxitPDFReader. This activity is indicative of potential exploitation of CVE-2023-27363, a vulnerability in Foxit Reader that could allow an attacker to achieve persistence by placing a malicious HTA file in a location that executes upon user login.
Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager, a common technique for credential access.
Detects the creation of specific files in the ProgramData directory, which are known indicators of compromise associated with the Diamond Sleet APT group. These files include executables, DLLs, and other data files used in their attack campaigns.
Detects the creation of a specific file, 'inetmgr.exe', in the 'C:\Windows\ADFS\bg\' directory. This activity has been linked to the Onyx Sleet (also known as Andariel) APT group, particularly in the context of exploiting the TeamCity CVE-2023-42793 vulnerability.
Page 211 of 217