Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects the creation of specific files associated with the Small Sieve malware. This includes files with a characteristic typo ('Microsift' instead of 'Microsoft') in their path or a specific filename ('MicrosoftWindowsOutlookDataPlus.txt') in the AppData\Local directory, which are indicators of the Small Sieve malware's activity.
Detects the creation of a specific file named 'Comadmin.dat' in the 'C:\Windows\System32\Com\' directory, which is identified as a kernel driver file indicator for the SNAKE malware. This rule aims to identify the presence of this known malicious file.
This rule detects the creation or modification of AppX packages in suspicious file system locations. Adversaries may place malicious AppX packages in common temporary or public directories to evade detection or achieve persistence. The rule specifically looks for Event ID 854 from the 'appxdeployment-server' service, indicating an AppX package being added to the processing pipeline, and checks if the package's path contains known suspicious locations such as public user directories, temporary folders, or desktop/downloads folders.
This rule detects the creation of files with names commonly associated with credential dumping tools or the output files generated by such tools. This includes executables of known credential dumpers like fgdump, pwdump, cachedump, procdump, and Windows Credential Editor (WCE), as well as output files like 'fgdump-log', 'kirbi', 'pwdump', 'pwhashes', 'wce_ccache', 'wce_krbtkts', 'NTDS.out', 'SAM.out', 'SECURITY.out', and 'SYSTEM.out'.
This rule detects the creation of executable files with suspicious names or extensions. Specifically, it looks for files ending with '.exe' that are appended to common system directory names (e.g., ':\$Recycle.Bin.exe', ':\MSOCache.exe') or other executable extensions (e.g., '.bat.exe', '.sys.exe'). This pattern is often used in unquoted service path vulnerabilities or to masquerade malicious executables as legitimate system files.
This rule detects the creation of specific files that indicate interactive PowerShell usage within the SYSTEM user context. The rule looks for the creation of 'ConsoleHost_history.txt' or 'StartupProfileData-Interactive' files in the 'C:\Windows\System32\config\systemprofile\AppData\Roaming\Microsoft\Windows\PowerShell\PSReadLine\' or 'C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\' directories respectively. The presence of these files in the SYSTEM profile suggests that PowerShell was used interactively by the SYSTEM account, which is highly unusual and could indicate privilege escalation or malicious activity.
Detects file creation patterns indicative of the CVE-2021-40444 exploit, specifically the creation of CAB and INF files by Microsoft Word in temporary internet cache or local temporary directories.
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process. This activity is indicative of potential SNAKE malware persistence, as documented by the NSA and CISA. The rule specifically looks for file creations where the target filename starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe', while excluding processes originating from standard Windows system directories to reduce false positives.
This rule detects the creation of PowerShell script files with specific filenames or suffixes that have been observed in campaigns attributed to the FIN7 threat group. Specifically, it looks for files ending with '_64refl.ps1' or named 'host_ip.ps1'. These patterns are indicative of PowerShell scripts used by FIN7 for various malicious activities, including execution and potentially reflective loading.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario. This is identified by monitoring Windows Security Event ID 5145 for file creations ending with `\wbem\wbemcomn.dll` and filtering out legitimate system accounts (those ending with '$').
This rule detects the creation of Microsoft Office macro-enabled files (docm, dotm, xlsm, xltm, potm, pptm) when the creating process or its parent process is a suspicious utility often abused by adversaries. The suspicious utilities include cscript.exe, mshta.exe, regsvr32.exe, rundll32.exe, and wscript.exe. This behavior is indicative of potential initial access or execution techniques where malicious macros are delivered or generated.
Detects the creation of new DLL assembly files by "aspnet_compiler.exe" within the 'Temporary ASP.NET Files' directory, specifically in the 'assembly\tmp\' subdirectory. This activity could indicate abuse of "aspnet_compiler" to proxy execution through a build provider, potentially for malicious purposes.
Detects the creation of an 'ntds.dit' file, which contains Active Directory database information including credential hashes, by processes commonly abused by attackers or processes running from suspicious directories like 'Temp' or 'AppData'. This activity is highly indicative of credential dumping attempts.
Detects the creation of the 'ntds.dit' file, which contains Active Directory database information, by processes that are not typically associated with this activity. This rule specifically looks for 'ntds.dit' creation when the parent process is an uncommon executable (e.g., cscript.exe, powershell.exe, web server processes) or originates from suspicious directories (e.g., AppData, Temp, Public). This activity often indicates an attempt to dump Active Directory credentials.
Detects the creation of new Office macro files on systems via applications such as web browsers or email clients. This rule identifies files with common Office macro extensions (.docm, .dotm, .xlsm, .xltm, .potm, .pptm) or those with Zone.Identifier streams indicating a download, when created by known browser or email client processes.
This rule detects the creation of files with specific web-related extensions (.ashx, .asp, .ph, .soap) in common web server directories such as '\inetpub\wwwroot\', '\www\', '\htdocs\', or '\html\'. This activity is often indicative of an attacker uploading a web shell to maintain persistence or execute commands on the compromised web server.
Detects the creation of ".rev" files by WinRAR, which can indicate potential exploitation of CVE-2023-40477. This vulnerability allows for arbitrary code execution. The rule looks for file creation events where the process is either 'explorer.exe' (suggesting extraction via context menu) or 'WinRAR.exe', and the created file has a '.rev' extension. Further investigation for suspicious execution or WinRAR application crashes shortly after such file creation is recommended.
Detects the creation of the file "/tmp/rootlog" which is used by the TripleCross eBPF rootkit as a way to check if the backdoor is already running. This file acts as a lockfile to prevent multiple instances of the rootkit from running simultaneously.
This rule detects attempts to dump the NTDS.dit database to suspicious locations. It specifically looks for ESENT event ID 325 (New Database Created) where the data contains 'ntds.dit' and the path includes common suspicious directories such as Appdata, Desktop, Downloads, Perflogs, Temp, or Users\Public.
Detects the creation of an "Active Directory Schema Cache File" (.sch) by an uncommon process. This activity can be indicative of tools performing Active Directory-related operations, potentially for reconnaissance or command and control, such as LDAPFragger. The rule filters out common legitimate processes that create these files.
Detects the creation of specific files commonly associated with Mimikatz, a credential dumping tool. Specifically, it looks for files ending with '.kirbi' (Kerberos tickets) or named 'mimilsa.log' (related to MemSSP). This activity often indicates an attempt to steal Kerberos credentials or other sensitive authentication information.
Page 213 of 217