Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects potential privilege escalation attempts by the Remcos RAT loader using token impersonation. The rule looks for process command lines containing keywords related to token manipulation ('impersonate', 'token', 'duplicate', 'SeImpersonate', 'logon') specifically when the initiating process is identified as 'Remcos'.
Detects the use of .NET Reflection methods (System.Reflection, Activator.CreateInstance, InvokeMember, MethodInfo) by processes named 'GST*.com' or 'Optimax.dll'. This behavior is indicative of obfuscation techniques often employed by malware, specifically associated with the Remcos RAT loader in this context.
Detects process command lines containing keywords associated with the 'Scorched Earth' package, potentially indicating activity related to Prinz Eugen ransomware. The keywords include 'scorched', 'earth', 'ausfolgung', and 'deutsch'.
Detects references to 'evisa_cookies.txt' in process command lines, which is indicative of data exfiltration related to the Omani eVisa portal, as observed in specific threat actor activities.
Identifies 'VirtualSmokestGuy120' in process command lines, which is an indicator of CastleRAT Build 120 persistence. This rule specifically looks for a unique string associated with this malware variant's persistence mechanism.
This rule detects command-line activity indicative of encryption key extraction or dumping. It looks for specific keywords like 'dumpkey', 'exportkey', 'savekey', 'keystore', and 'privkey' in the command line of processes such as 'servertool.exe', 'encrypt.exe', 'powershell.exe', and 'cmd.exe'. This activity is often associated with ransomware or other malicious software attempting to exfiltrate cryptographic keys.
This rule detects network connections to common lateral movement ports (SMB, NetBIOS, RDP, FTP, Telnet, SSH) occurring within a 30-minute window before or a 60-minute window after the execution of known ransomware encryption binaries ('servertool.exe', 'encrypt.exe'). This correlation aims to identify post-encryption lateral movement attempts by ransomware, potentially for further compromise or data exfiltration.
Detects process command lines containing keywords associated with the 'Scorched Earth' package, potentially indicating activity related to Prinz Eugen ransomware. The keywords include 'scorched', 'earth', 'ausfolgung', and 'deutsch'.
This rule detects the execution of commands associated with memory clearing and garbage collection, potentially used by the Prinz Eugen ransomware to hinder forensic analysis or ensure data destruction. It specifically looks for command-line arguments like 'erasefreespace', 'cleanmem', 'memset', or 'zeromem' when initiated by 'servertool.exe' or 'encrypt.exe'.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
Detects wscript.exe spawning PowerShell with encoded command from C:\Temp.
Detects curl.exe exfiltrating screenshots to .onion domains via proxy.
Detects InvisibleFerret decoding XOR-encoded C2 IP strings.
This rule detects the execution of commands associated with memory clearing and garbage collection, potentially used by the Prinz Eugen ransomware to hinder forensic analysis or ensure data destruction. It specifically looks for command-line arguments like 'erasefreespace', 'cleanmem', 'memset', or 'zeromem' when initiated by 'servertool.exe' or 'encrypt.exe'.
Detects the removal of known Amos Stealer staging artifacts, specifically the 'osalogging.zip' file or 'sync' directories within the /tmp folder. This behavior indicates post-exfiltration cleanup to evade detection.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
LdrCallEnclave shellcode execution
Cortex XDR
This rule detects the use of LdrCallEnclave, a function often associated with shellcode execution, when initiated by Python or an executable located in a user-writable temporary directory (e.g., Temp, AppData, ProgramData). The detection focuses on processes whose image name matches 'python', 'python3', or any executable name followed by '.exe', and whose path contains common temporary or user-writable directories. The rule specifically looks for 'ldrcallenclave' in the command line arguments, indicating potential malicious activity such as process injection or shellcode execution.
RawWNPF rootkit device artefact
Cortex XDR
This rule detects the presence of the RawWNPF rootkit by searching for references to '\device\rawwnpf' or 'rawwnpf' in process command lines. It focuses on process events and provides causality fields for investigation.
This rule detects environment discovery activities that query Windows Defender PUA (Potentially Unwanted Application) policy settings and Windows product edition values. It specifically looks for commands executed via `reg.exe`, `powershell.exe`, `pwsh.exe`, or `wmic.exe` that contain keywords related to 'puaprotection', 'windows defender', 'productname', or 'editionid', especially when combined with 'enterprise'. The rule is designed to provide a causality view for investigation, linking the discovery activity to the initiating process.
Page 60 of 84