Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of temporary files by the ScreenConnect remote monitoring and management (RMM) tool in a specific user document directory. This behavior is associated with ScreenConnect's feature to remotely execute binaries on a target machine, where these binaries are first dropped to the specified temporary location before execution.
This rule detects file activity indicative of potential exploitation of the MOVEit Transfer CVE-2023-34362 vulnerability. It specifically looks for the creation or modification of suspicious file types (like .7z, .bat, .dll, .exe, .ps1, .rar, .vbe, .vbs, .zip) within the MOVEit Transfer webroot directory. Additionally, it identifies the presence of known malicious files such as `_human2.aspx` or `human2.aspx` and their shortcut files (`.lnk`) within the same directory. The rule also includes a selection for newly compiled ASP.NET DLLs within the temporary ASP.NET files directory, created around the time the vulnerability was actively exploited (March-June 2023), which could indicate the deployment of web shells or other malicious code.
This rule detects the creation of specific files that are commonly generated by the BloodHound collection tool, SharpHound. These files, such as 'BloodHound.zip', '_computers.json', '_domains.json', '_groups.json', and others, contain collected Active Directory information. The presence of these files on a system indicates that BloodHound or SharpHound has been used for reconnaissance, which is often a precursor to further malicious activity within an Active Directory environment.
Detects the creation of a file by WinRAR with a double extension and a space in the filename, specifically targeting the temporary directory. This pattern is indicative of an exploitation attempt related to CVE-2023-38331, a vulnerability in WinRAR that allows for arbitrary code execution through specially crafted archives.
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario. This rule specifically looks for EventID 5145 (a network share access event) where the target file path ends with `\Internet Explorer\iertutil.dll` and the `SubjectUserName` does not end with a `$` (indicating a machine account, which is filtered out to reduce false positives).
Detects the use of the NPPSpy hacktool by monitoring for the creation of its characteristic output files, 'NPPSpy.txt' or 'NPPSpy.dll'. This tool is known to capture cleartext credentials from users logging into a local system.
Detects suspicious file types (such as web shells, scripts, or executables) being dropped by the IIS worker process (w3wp.exe) associated with Microsoft Exchange. This behavior is indicative of successful exploitation of Exchange vulnerabilities, often leading to the deployment of web shells for persistent access.
Detects the creation of an ISO file in the Outlook temporary folder or in the AppData temporary folder. This activity is typical of Qakbot TTPs observed from late July 2022, often associated with bypassing Mark-of-the-Web controls.
Detects the creation of files with specific name patterns that are commonly used by tools like Metasploit and Impacket's secretsdump.py to export and stage the NTDS.DIT database for exfiltration. These patterns include '.ntds.cleartext' and 'All.cab', which are indicative of attempts to dump Active Directory credentials.
Detects the creation of new Outlook form files, which can be used by adversaries to establish persistence by embedding malicious code. The rule specifically looks for file creation events by 'outlook.exe' in known Outlook forms directories.
Detects suspicious activity where the MSExchangeMailboxReplication process writes .asp or .aspx files to disk. This behavior is often indicative of web shell deployment, potentially following an exploit like ProxyShell, to establish persistence or further access.
Detects the creation of files with a specific naming pattern '/mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}.tar.gz' which has been observed to be used by the threat actor UNC4841 for staging and exfiltration of email-related data.
Detects attempts to export an Exchange mailbox to an unusual file path, specifically to a network share or a file with an .aspx extension, which could indicate an adversary attempting to place a webshell. It also detects the assignment of the 'Mailbox Import Export' role to a user, a prerequisite for performing mailbox exports.
This rule detects the creation of a property list (.plist) file within the `/Library/StartupItems/` or `/System/Library/StartupItems` directories on macOS. These directories are associated with a deprecated persistence mechanism where files placed within them are automatically executed at boot initialization. Adversaries can leverage this to establish persistence on a compromised system by ensuring their malicious code runs every time the system starts.
This rule detects the creation of a file named 'dumpert.dmp', which is the default output file used by the Outflank Dumpert tool. Dumpert is a process dumper specifically designed to extract memory from the Local Security Authority Subsystem Service (LSASS) process, which often contains sensitive credential material.
This rule detects the creation of a file named "ntds.dit", which is the Active Directory database. The NTDS.dit file contains critical information including user credentials (hashed passwords), group memberships, and other Active Directory objects. Adversaries often target this file to dump credentials for lateral movement and privilege escalation within a Windows domain.
This rule detects the creation of new Microsoft Office macro-enabled files. These file types (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) can contain embedded macros, which are often used by adversaries for initial access, persistence, or execution of malicious code. Monitoring their creation can help identify suspicious activity related to macro-enabled document attacks.
Detects the creation of a file named "wpbbin.exe" in the "C:\Windows\System32\" directory. This activity can be indicative of a UEFI-based persistence method used by adversaries to maintain access to a system, often by injecting executable files into the boot process, potentially bypassing security measures like BitLocker.
Detects possible successful exploitation of CVE-2021-26858 (ProxyLogon) by monitoring for the creation of non-standard files by the Exchange Server's Unified Messaging service (UMWorkerProcess.exe). This activity could indicate the dropping of web shells or other malicious content post-exploitation.
Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.
This rule detects the creation of new text files (.txt) within a user's Desktop directory by the 'cmd.exe' process. This behavior is often associated with ransomware dropping ransom notes or other instructional files after encrypting data.
Page 212 of 217