Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Remote Monitoring and Management (RMM) programs are IT to manage remote endpoints. Attackers have begun to abuse these programs to persist or provide C2 channels.
https://github.com/jischell-msft/RemoteManagementMonitoringTools
https://github.com/jischell-msft/RemoteManagementMonitoringTools
Hash Prevalence
YARA-L
Correlate process events with hashes that have a low rolling max over the past 10 days
Executable downloaded by Microsoft Excel by user with GCP entity relationship
Detection of process/file events that match Safe Browsing hashes, which are files deemed to be malicious
Detect process launch events that correlate to Safe Browsing hash data and have low prevalence
IOC SHA256 Hash
YARA-L
Detect file/process events that match watchlisted hashes in MISP
Alert on known File Hash executing known File Hash with VT Relationships.
Detect web traffic to a recently expired domain followed by an exe file creation event
This analytic detects the writing of data with an IMPHASH value to an Alternate Data Stream (ADS) in the NTFS file system. It leverages Sysmon Event ID 15 and regex to identify files with a Portable Executable (PE) structure. This activity is significant as it may indicate a threat actor staging malicious code in hidden areas for persistence or future execution. If confirmed malicious, this could allow attackers to execute hidden code, maintain persistence, or escalate privileges within the environment.
The following analytic identifies when a malicious file is detected within the SharePoint Online ecosystem. Attackers may stage and execute malicious files from within the Microsoft Office 365 ecosystem. Any detections from built-in Office 365 capabilities should be monitored and responded to appropriately. Certain premium Office 365 capabilities further enhance these detection and response functions.
This YARA rule detects the Linux AutoColor backdoor by identifying specific byte patterns related to its core functionalities. These functionalities include installing library implants, self-deletion mechanisms, executing local files, and network proxy communication. The rule specifically targets ELF (Executable and Linkable Format) files, indicating it's designed for Linux executables.
Yara rule that detects AutoColor backdoor.
Yara rule that detects Sshdinjector backdoor.
Yara rule that detects WolfsBane backdoor.
Identifies when a user downloads a potentially malicious file from Google Drive.
Detects the creation of a binary file with the ".sed" extension. The ".sed" extension stand for Self Extraction Directive files.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.
These files are used by the "iexpress.exe" utility in order to create self extracting packages.
Attackers were seen abusing this utility and creating PE files with embedded ".sed" entries.
Usually ".sed" files are simple ini files and not PE binaries.
Yara rule that detects GomorrahStealer infostealer.
Yara rule that detects GTPDOOR backdoor.
This rule detects the creation of an Alternate Data Stream (ADS) that contains an executable file. It specifically looks for the presence of a non-empty Import Hash (Imphash) within the created stream, indicating executable content. The rule filters out streams with a null Imphash, which typically correspond to non-executable data.
This rule detects the creation of any Portable Executable (PE) file that is monitored by the Sysmon configuration. It specifically triggers on Sysmon Event ID 29, which corresponds to 'FileExecutableDetected'. This event indicates that Sysmon has identified and logged the creation of an executable file based on its internal configuration.
This rule detects Sysmon Event ID 27, which signifies a "FileBlockExecutable" event. This event is generated when Sysmon's configured block policy prevents an executable file from being created or modified. This indicates an attempt to introduce or alter an executable that violates the defined security policy.
Page 76 of 80