Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,876
5,155
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects the creation of screensaver files (.scr) in locations outside of standard Windows system directories. Attackers often leverage .scr files, which are essentially executable files, to deliver and execute malicious payloads. By filtering out common legitimate system paths, the rule aims to identify suspicious instances where an .scr file might be dropped or created by an adversary, potentially as part of a defense evasion or execution technique. The rule's description specifically mentions the use of "rundll32.exe desk.cpl,InstallScreenSaver" as an example of how an attacker might execute such a file.
Detects the creation of specific files associated with the Goofy Guineapig malware, which attempts to impersonate Google Update components. The rule looks for 'config.dat', 'GoogleUpdate.exe', 'tmp.bat', and 'goopdate.dll' within the 'C:\ProgramData\GoogleUpdate\' directory.
Detects the creation of a file named "MoriyaStreamWatchmen.sys" in the 'C:\Windows\System32\drivers\' directory. This specific filename is associated with the Moriya rootkit, as detailed in the Securelist's "Operation TunnelSnake" report. The presence of this file indicates a potential rootkit installation attempt, which could lead to persistence and privilege escalation on a Windows system.
Detects the creation of a file named 'newdev.dll' in a user's AppData\Roaming directory. This specific file path and name are associated with the COLDSTEEL Remote Access Trojan (RAT) for persistence.
This rule detects the creation of files with the '.dmp', '.dump', or '.hdmp' extensions. These files are typically memory dumps generated by software during a crash. While often legitimate, memory dumps can contain sensitive information, including credentials, which could be exploited by adversaries. The rule aims to identify instances where such files are created to allow for investigation into the cause of the crash and to ensure no sensitive data is exposed or exfiltrated.
This rule detects attempts to export an Exchange Certificate Signing Request (CSR) to an unusual directory or with an .aspx file extension. This activity is suspicious because it could indicate an adversary attempting to place a webshell on an Exchange web server for persistent access. The rule specifically looks for the PowerShell cmdlet 'New-ExchangeCertificate' with parameters '-GenerateRequest', '-BinaryEncoded', and '-RequestFile', combined with suspicious file paths like '\\localhost\C$', '\\127.0.0.1\C$', 'C:\inetpub', or the '.aspx' extension.
Detects the creation of suspicious web shell files (ASPX, ASP, ASHX) by the IIS worker process (w3wp.exe) in directories commonly associated with Microsoft Exchange or IIS web roots. This activity is indicative of potential exploitation of Exchange vulnerabilities, such as those used in the ProxyShell or ProxyNotShell attacks, to establish persistence via web shells.
Detects the creation of suspicious executable or script files within the OneNote temporary directory, indicating potential malware delivery and execution via malicious OneNote attachments. This behavior has been observed in recent malware campaigns leveraging OneNote files.
This rule detects when PowerShell (powershell.exe or pwsh.exe) creates a new PowerShell script file (.ps1). While this behavior can be benign in many cases, it can also indicate a dropper script attempting to establish persistence on a system. The rule filters out common legitimate scenarios such as PowerShell's internal script policy tests and temporary files created in user AppData\Local\Temp or C:\Windows\Temp directories.
Detects the creation of new PowerShell module files (.ps or .dll) in the first folder of the module directory structure, specifically within '\WindowsPowerShell\Modules\*\'. This pattern is considered suspicious because legitimate PowerShell modules commonly include a version folder within their directory structure, making direct creation in the module root less common for benign modules.
This rule detects the creation of executable files (.exe) or dynamic link libraries (.dll) within the default Group Policy Object (GPO) storage folder. Adversaries may place malicious files in this location to leverage Group Policy for persistence, privilege escalation, or to distribute malware across a domain. The specific folder path targeted is '\Policies\{31B2F340-016D-11D2-945F-00C04FB984F9}\' which corresponds to the Default Domain Policy GPO.
Detects the creation of the PROCEXP152.sys file in the application-data local temporary folder. This driver is used by Sysinternals Process Explorer but also by KDU (Kernel Driver Utility) or Ghost-In-The-Logs, which uses KDU. This activity can indicate an attempt to load a malicious driver for defense evasion or other purposes.
This rule detects the creation of an executable file named "msiexec.exe" within the 'bin' directory of a ManageEngine SupportCenter Plus installation. This specific file creation pattern is associated with the exploitation of CVE-2021-44077, a vulnerability for which public Proof-of-Concept (POC) exploits are available. The presence of a newly created 'msiexec.exe' in this non-standard location within the application's directory indicates potential compromise and malicious activity, as legitimate 'msiexec.exe' is a system binary typically located in system directories.
Detects the creation of a "Report.wer" file in an uncommon folder structure, specifically outside of the typical Windows Error Reporting (WER) archive paths. This activity could indicate potential exploitation of CVE-2023-36874, where adversaries might manipulate WER to achieve execution or persistence.
Detects the creation of a scheduled task by monitoring file creation events in the standard Windows scheduled task directories. This rule specifically looks for new files being written to ':\Windows\System32\Tasks\', ':\Windows\SysWOW64\Tasks\', and ':\Windows\Tasks\', which are common locations for scheduled task definitions.
Detects the creation of script files (JSE, VBE, JS, VBA, VBS) in common user or program data directories by wscript.exe or cscript.exe. This behavior is often associated with malware droppers or initial access techniques.
This rule detects the creation of a batch file by PowerShell, specifically looking for files ending with '.bat' when the creating process is 'powershell.exe' or 'pwsh.exe'. This behavior is indicative of the Powerup tool's 'Write Hijack DLL' functionality, which creates a self-deleting batch file (often named 'debug.bat') to execute malicious commands for DLL hijacking and privilege escalation.
Detects the creation of suspicious files and folders inside the user's AppData folder but not within the common and well-known subdirectories (Local, Roaming, LocalLow). This technique can be used by adversaries to bypass detections that exclude common AppData paths to reduce false positives.
Detects the creation of files with '.one' or '.onepkg' extensions in suspicious or uncommon locations, which could indicate the abuse of OneNote attachments for malware delivery. The rule specifically excludes files created by the legitimate OneNote application running from its standard installation path.
Detects the creation of new PowerShell module files (e.g., .psm1, .psd1, .dll, .ps1) within standard PowerShell module directories. This activity can indicate an adversary attempting to establish persistence or load malicious modules.
Detects the creation of Rclone configuration files, which are typically stored in a specific user directory path. Rclone is a command-line program used for syncing files with various cloud storage services and is often leveraged by adversaries for data exfiltration.
Page 214 of 217