Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This hunt targets a documented Iranian MOIS-affiliated behaviour: re-executing DCSync
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
(MITRE ATT&CK T1003.006 — OS Credential Dumping: DCSync) after defenders reset
compromised account passwords, allowing actors to recollect current and historical NTLM
hashes and restore domain-wide access without repeating initial access stages.
This rule detects processes attempting to access web browser credential files (e.g., 'Login Data', 'Web Data') within the AppData directory. This activity is often associated with credential dumping techniques used by adversaries to steal stored browser credentials.
This rule detects the execution of SUID binaries by a non-root user, immediately followed by the creation of a persistence mechanism such as a systemd service file or a cron job. This correlation aims to identify potential privilege escalation attempts where an attacker uses an SUID binary to gain elevated privileges and then establishes persistence on the system.
This rule detects the use of specific Linux environment variables (LD_AUDIT, LD_DEBUG, LD_DEBUG_OUTPUT) in command lines. These variables can be abused for dynamic-link library (DLL) injection or other forms of process injection, allowing adversaries to execute arbitrary code or debug processes in a way that might bypass security controls.
This rule detects attempts to remove AppArmor profiles on Linux systems. AppArmor is a Linux security module that allows system administrators to restrict program capabilities with per-program profiles. An adversary might attempt to remove or disable AppArmor profiles to bypass restrictions and perform unauthorized actions.
This query hunts for potential execution linked to the Axios npm supply chain compromise by detecting node.exe process activity tied to suspicious npm lifecycle markers (postinstall, setup.js, plain-crypto-js). It helps identify systems that may have executed malicious install-time scripts.
This rule detects suspicious processes (winupdate.exe, windows.exe, svchost.exe, system32.exe) initiating network connections from unusual directories (Downloads, Public, System32) to known cloud storage providers (Amazon AWS, DigitalOcean, Azure Blob Storage) or over port 443. This behavior could indicate data exfiltration, command and control activity, or malware communication.
Detects the execution of Windows Snipping Tool (SnippingTool.exe) or Screen Sketch (ScreenSketch.exe) when launched with the 'ms-screensketch' command-line argument. This behavior is indicative of a user or process taking a screenshot, which could be part of information gathering by an adversary.
Detects suspicious processes attempting to access Microsoft Teams local storage or cookies via command line parameters, a technique commonly used by info-stealers. The rule specifically looks for command line arguments targeting 'Cookies' or 'Local Storage\leveldb' paths within the Microsoft Teams directory, while excluding legitimate Teams executables to reduce false positives.
Detects the use of the `syslog` syscall with action code 5 (SYSLOG_ACTION_CLEAR),
(4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel
ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation
or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.
(4 is SYSLOG_ACTION_READ_CLEAR and 6 is SYSLOG_ACTION_CONSOLE_OFF) which clears the kernel
ring buffer (dmesg logs). This can be used by attackers to hide traces after exploitation
or privilege escalation. A common technique is running `dmesg -c`, which triggers this syscall internally.
Detects the creation of a new bits job by PowerShell
This rule detects the execution of Remote Monitoring and Management (RMM) tools by service accounts. RMM tools are legitimate software used for IT administration, but their use by service accounts can be indicative of malicious activity, such as an adversary maintaining persistence or performing lateral movement using compromised credentials. The rule identifies processes whose filenames match a predefined list of RMM tool executables or process names and are executed by accounts identified as service accounts based on common naming patterns.
This rule detects suspicious activity across process events, file events, and network events by looking for specific SHA1/SHA256 hashes, command line arguments, folder paths, and remote URLs. The indicators suggest potential malware execution, file manipulation, or command and control communication.
This detection helps you spot activity linked to TeamPCP LiteLLM PyPI compromise (litellm 1.82.7 / 1.82.8) using the specific indicators in the linked source. It is written to be high confidence by focusing on exact versions, domains, paths, or file fingerprints that were observed in the reporting. A match does not prove a system is compromised by itself, but it is a strong reason to investigate. Confirm the affected host and user, check whether the access was expected, and review nearby activity for follow-on steps like additional downloads, new persistence, or repeated connections. Use the source link to support incident.
This rule detects a multi-stage exfiltration technique observed on macOS systems, specifically targeting the AMOS malware. It correlates process execution events related to archiving (using 'ditto'), splitting files (using 'split'), and network connections involving 'curl' with specific headers or to known malicious infrastructure. The rule looks for a combination of these activities, indicating data staging and subsequent exfiltration in chunks.
KQL Query
Detects PowerShell commands that attempt to modify Windows Defender preferences to add exclusions for paths, extensions, or processes. This activity is often indicative of an adversary attempting to disable or bypass security controls. Also seen by XWorm Malware.
This rule detects various indicators of compromise associated with the GlassWorm malware. It monitors for network connections to known GlassWorm remote IPs and domains, process activity involving specific GlassWorm filenames, folder paths, command line arguments (including wallet addresses and command terms), and registry modifications for persistence (Run/RunOnce keys with GlassWorm-related values). The rule correlates multiple evidence types to reduce false positives.
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to attacker-controlled cloud buckets.
This rule detects attempts to stop services or tamper with security tools (Windows Defender, EventLog) using 'sc stop', 'net stop', 'wevtutil cl', 'Add-MpPreference', or 'Set-MpPreference' commands, specifically when initiated by 'explorer.exe'. This could indicate an adversary attempting to impair defenses or achieve persistence.
AI is becoming a key part of detection and response, but it’s important not to overlook simpler techniques that are still effective.
In this article, I share a practical example of how Powershell clipboard commands can be abused, based on a real scenario. It covers how basic activities related to Get/Set-Clipboard can be leveraged in ways that may go unnoticed.
The following KQL (which can be configured as Detection Rule) help s to identify this type of activity in your environment.
In this article, I share a practical example of how Powershell clipboard commands can be abused, based on a real scenario. It covers how basic activities related to Get/Set-Clipboard can be leveraged in ways that may go unnoticed.
The following KQL (which can be configured as Detection Rule) help s to identify this type of activity in your environment.
Page 71 of 84