Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects potential exploitation attempts related to the 'Squidbleed' vulnerability (CVE-2021-28116) by monitoring 'squid.exe' process command lines for keywords indicative of stack variable overflow exploitation in its FTP parser. Specifically, it looks for the presence of terms like 'stack', 'heap', 'offset', 'buffer', or 'pointer' combined with 'overread', 'overflow', or 'bounds'.
Detects potential memory leak debugging or exploitation attempts related to the Squid proxy server by monitoring process command lines for keywords like 'leak', 'memory', 'valgrind', 'gdb', or 'debug'. This could indicate an adversary attempting to exploit a memory leak vulnerability or a developer debugging one.
Detects attempts to exploit the Squidbleed vulnerability by monitoring process command lines for Squid (squid.exe) using specific accept_filter or defer_accept related keywords. This could indicate an attempt to bypass configuration or exploit a vulnerability related to TCP connection handling.
This rule detects suspicious command-line arguments indicative of a potential buffer overflow attempt targeting the 'squid.exe' process. The presence of keywords like 'buffer+', 'ptr++', 'offset', 'increment', or 'boundary' in the command line of 'squid.exe' suggests an attempt to manipulate memory or exploit a vulnerability.
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges.
Detects the execution of wscript.exe or cscript.exe (Windows Script Host) from a parent process that is not commonly associated with legitimate script execution. This can indicate malicious script execution, potentially bypassing security controls or being part of an initial access or execution chain. Exclusions are made for common legitimate parent processes like explorer.exe, cmd.exe, powershell.exe, svchost.exe, system.exe, and web browsers.
Detects suspicious process executions where 'ctfmon.exe' or 'cloudfiles.exe' are initiated by a non-SYSTEM user but contain 'SYSTEM' in their command line. This could indicate an attempt to impersonate or escalate privileges, potentially by manipulating process arguments to mimic system processes.
Detects suspicious command-line arguments associated with the 'squid.exe' process that may indicate exploitation attempts related to the Squidbleed vulnerability, specifically looking for patterns indicative of 4KB buffer freelist recycling. This includes keywords like 'malloc', 'free', '4096', '4KB', 'buffer', and 'MEM_'.
Detects the execution or presence of a script named 'proxyshell_01.sh' in process command lines. This script has been associated with MuddyWater activity, specifically in the context of exploiting ProxyShell vulnerabilities.
This rule detects attempts by non-browser executables to access DPAPI (Data Protection API) for decryption, specifically when the command line also references Chromium Local State. This behavior is indicative of credential theft, where an attacker might be trying to extract stored browser credentials. The rule filters out legitimate browser processes (Chrome, MS Edge, Brave) to reduce false positives and focuses on the causal chain of events.
This rule detects instances where mshta.exe is used to execute a remote resource with a .7z file extension. This behavior is often indicative of an adversary attempting to bypass traditional security controls by disguising malicious script content as a compressed archive, as observed in some malware distribution campaigns.
Detects when a browser desktop shortcut (.lnk file) is modified by a setup or update executable, which could indicate a Potentially Unwanted Program (PUP) injecting malicious arguments or redirecting the browser to an attacker-controlled gateway upon launch.
Detects the execution of binaries where the digital certificate has been explicitly revoked or timestamped after revocation.
Correlates the malware attempting to permanently disable macOS system-wide Gatekeeper functionality (spctl --master-disable).
Identifies LNK shortcut files contained in ISOs executing the Fox Tempest signed payload, bypassing initial scrutiny. This rule specifically looks for 'explorer.exe' initiating a process with a command line containing '.lnk' and then joins this with image load events where the initiating process's signature status is 'Valid'. This combination aims to detect the execution of malicious LNK files that launch signed binaries, a technique used by threat actors like Fox Tempest.
Identifies the payload establishing reboot persistence by writing a .plist to the user's ~/Library/LaunchAgents directory and activating it using 'launchctl load'.
Detects Python reading the .env file or executing env commands to scrape Hugging Face tokens or AWS keys after loading a model.
This rule correlates the credential scraping phase with the invocation of zip, tar, or ditto to compress stolen artifacts into a single file in the /tmp directory. Specifically, it looks for these archiving utilities being executed with a command line that targets a .zip or .tar.gz file within /tmp, and joins this activity with the prior access of a file named 'Login Data' by the same initiating process.
Correlates the download of a payload using 'curl' to the /tmp/ directory with an immediate 'chmod +x' command on a file in the /tmp/ directory, making it executable. This sequence of events is indicative of preparing a downloaded script or binary for execution, often seen in the initial stages of infostealer attacks on macOS.
Detects execution and suspicious behavior associated with the SharkLoader malware, specifically monitoring the masquerading of SystemSettings.exe within user AppData or ProgramData paths. It identifies unauthorized cross-process activities, module loads of specific suspicious DLLs, and potential code injection techniques typical of shellcode staging, such as those used by Cobalt Strike Beacon.
Detects instances where suspicious, non-Windows-standard processes (residing outside of System32 or SysWOW64) spawn or interact with critical system processes like svchost.exe or explorer.exe. This activity is indicative of process injection techniques used by malware loaders, such as SharkLoader, to execute malicious code within the context of trusted system processes to maintain persistence or elevate privileges.
Page 52 of 84