Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,877
5,156
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects the creation or modification of a ScheduledTasks.xml file within the SYSVOL directory. This behavior indicates automated task deployment via Group Policy Preferences (GPP), a technique observed in The Gentlemen RaaS and other operations to simultaneously execute ransomware or other payloads across domain-joined computers.
Detects non-Defender processes accessing the Windows Defender signature definition file (mpasbase.vdm). This file should exclusively be accessed by Defender platform processes (MsMpEng.exe, MpCmdRun.exe, NisSrv.exe, etc.) and Windows servicing components. Any other process touching this file has zero legitimate use cases and is a high-fidelity indicator of the BlueHammer zero-day LPE exploit, which leverages a batch oplock on mpasbase.vdm to freeze Defender mid-read, then performs NTFS junction swapping to redirect SYSTEM-context reads to the SAM hive via a VSS snapshot, resulting in local credential theft and privilege escalation. MITRE: T1068 - Exploitation for Privilege Escalation. References: https://github.com/Nightmare-Eclipse/BlueHammer, https://www.deobfuscated.dev/posts/defender-lpe-0-day
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Detects the creation of the specific LaunchAgent plist file ('com.vfrfeufhtjpwgray.plist') used by the macOS AppleScript dropper in the REF6598 campaign for persistence, ensuring visibility into the non-Windows infection chain.
Detects instances where the ArcGIS Server process ArcSOC.exe, which hosts REST services running on an ArcGIS
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
server, creates a file with suspicious file type, indicating that it may be an executable, script file,
or otherwise unusual.
When C# is compiled dynamically, a .cmdline file will be created as a part of the process.
Certain processes are not typically observed compiling C# code, but can do so without touching disk.
This can be used to unpack a payload for execution
Certain processes are not typically observed compiling C# code, but can do so without touching disk.
This can be used to unpack a payload for execution
Detects the creation of files with scripting or executable extensions by Mysql daemon.
Which could be an indicator of "User Defined Functions" abuse to download malware.
Which could be an indicator of "User Defined Functions" abuse to download malware.
Detects the creation of files with an "LNK" as a second extension. This is sometimes used by malware as a method to abuse the fact that Windows hides the "LNK" extension by default.
Detects suspicious filenames that contain a right-to-left override character and a potentially spoofed file extensions.
Detects the creation of a new office macro files on the systems
Detects the creation of a shortcut (.lnk) file in the Windows Startup folder containing 'Edge' or 'msedge' in its name. This matches the persistence mechanism used by LucidRook and its droppers (like LucidPawn) which drop a disguised Microsoft Edge shortcut to execute a renamed DISM binary.
Detects calls to hidden files or files located in hidden directories in NIX systems.
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
SCR File Write Event
Sigma
Detects the creation of screensaver files (.scr) outside of system folders. Attackers may execute an application as an ".SCR" file using "rundll32.exe desk.cpl,InstallScreenSaver" for example.
Detects suspicious files created via the OneNote application. This could indicate a potential malicious ".one"/".onepkg" file was executed as seen being used in malware activity in the wild
Detects the pattern of UAC Bypass using a msconfig GUI hack (UACMe 55)
Detects non-Defender processes accessing or modifying the Defender signature definition file (mpasbase.vdm).
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
This behavior is indicative of the BlueHammer zero-day LPE, which leverages a batch oplock on this file to freeze Windows Defender mid-read, subsequently executing path confusion to force Defender to read the SAM hive as SYSTEM.
Detects the creation of a DLL named DismCore.dll within the ProgramData or AppData\Local\Microsoft\WindowsApps directories. This behavior is indicative of potential LucidPawn/LucidRook DLL sideloading preparation where it attempts to hijack the search order of legitimate DISM binaries.
Detects a file ending in jse, vbe, js, vba, vbs, wsf, wsh written by cscript.exe or wscript.exe
Detects the creation of doas.conf file in linux host platform.
Page 100 of 139