Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,285 detections
Filters
Last updated
All Time
Detection languages
1,276
250
199
141
138
Contributors
660
539
375
96
95
Categories
20,440
11,814
5,871
5,145
4,864
2,285
Platforms
1,502
922
374
70
51
Products / Services
740
407
225
164
140
MITRE Techniques
847
682
602
428
302
CVEs
12
10
9
9
8
IDS Classtypes
24
4
3
1
1
IDS Protocols
20
6
6
1
This rule detects the use of 'dd' and 'truncate' commands to add junk data to a file, a technique adversaries may employ for binary padding to evade detection. Specifically, it looks for 'truncate' with the '-s' (size) option or 'dd' with 'if=' (input file) but without 'of=' (output file), indicating potential in-place modification or padding.
This rule detects changes to critical Linux auditd configuration files. Adversaries may modify these files to disable or alter auditing, thereby hindering detection of their malicious activities. Monitoring these files for changes can help identify attempts to evade security monitoring.
Detects access to files and shares with specific names and extensions associated with BlueSky ransomware, indicating a potential or active encryption attempt. The rule looks for files ending with '.bluesky' or containing 'DECRYPT FILES BLUESKY' in their names, across both local file access events (EventID 4663, 4656) and network share access events (EventID 5145).
Detects commands that attempt to clear or tamper with the Linux command history. This technique is often used by threat actors to evade detection and execute commands without leaving a record in files like "bash_history" or "zsh_history". The rule specifically looks for various commands and patterns used to delete, truncate, or otherwise manipulate history files, as well as the specific log message "empty_bash_history" which can be generated by a provided monitoring script.
Detects additions or modifications to Emond Launch Daemon rule files or client directories, which adversaries may use to gain persistence and elevate privileges on macOS systems. This rule specifically looks for new or changed files in '/etc/emond.d/rules/' (plist files) or '/private/var/db/emondClients/'.
Detects the creation of a suspicious Alternate Data Stream (ADS) file, specifically a ':Zone.Identifier' stream, by processes other than common web browsers. The ':Zone.Identifier' ADS is used by Windows to mark files downloaded from the internet, indicating their origin and often triggering security warnings. This rule looks for the creation of this ADS with a 'ZoneId=3' (indicating an internet origin) on executable or document file types. By filtering out known browser processes, the rule aims to identify instances where other applications or scripts might be creating these ADS files, potentially as a defense evasion technique to bypass security warnings or to masquerade malicious files.
Detects changes to critical syslog daemon configuration files on Linux hosts. Adversaries may modify these files to disable or reconfigure logging, thereby impairing defenses and hindering the detection of their activities.
Detects attempts to overwrite or wipe files using the 'dd' command with '/dev/null' or '/dev/zero' as input. This technique is commonly used for data destruction, making files irrecoverable.
Detects potential overwriting and deletion of a file using the 'dd' command. This rule specifically looks for executions of 'dd' where the output file ('of=') is specified and the input is either '/dev/zero' (writing zeros) or '/dev/null' (effectively truncating/deleting content). This pattern is commonly used for data destruction.
This rule detects the creation or modification of a PowerShell profile specifically for Visual Studio Code (VSCode). Adversaries may modify these profiles to establish persistence or escalate privileges by injecting malicious commands or scripts that execute every time a user opens a VSCode PowerShell session. This technique can be used to run arbitrary code without direct user interaction after the initial compromise.
Detects the creation or modification of PowerShell profile scripts (profile.ps1) in various common locations. Adversaries may modify these profiles to include arbitrary commands, functions, or modules to gain persistence or elevate privileges, as the profile script runs automatically when PowerShell starts.
Detects the creation or modification of 'WsmPty.xsl' or 'WsmTxt.xsl' files outside of the standard Windows system directories. This activity is indicative of an application whitelisting bypass technique involving 'winrm.vbs' and 'cscript.exe' to execute attacker-controlled XSL files.
Detects a threat actor creating a file named `wbemcomn.dll` in the `C:\Windows\System32\wbem\` directory over the network for a WMI DLL Hijack scenario.
Detects specific commands commonly used to remove or empty the syslog
Detects a threat actor creating a file named `iertutil.dll` in the `C:\Program Files\Internet Explorer\` directory over the network for a DCOM InternetExplorer DLL Hijack scenario.
This rule detects the TimeTime ransomware by identifying specific bytecode patterns associated with its file enumeration, encryption, and renaming activities. The rule looks for distinct sequences of operations related to finding files, encrypting files, encrypting folders, and renaming files, which are characteristic behaviors of ransomware.
This rule detects the TaRRaK ransomware based on specific bytecode patterns. The patterns indicate functionality related to finding and encrypting files, changing the desktop background, and dropping a ransom note. The rule specifically targets MSIL (Microsoft Intermediate Language) bytecode, suggesting it's designed for .NET executables.
Page 109 of 109