Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4 detections
Filters
Last updated
All Time
Detection languages
3
1
Contributors
2
1
1
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
3
1
Products / Services
2
1
1
MITRE Techniques
4
4
1
1
1
Detects the execution of the temp_auto_push.bat tool, associated with the threat actor Void Dokkaebi, used to perform malicious commit amendments and code injection in source code repositories. The tool achieves this by manipulating the system clock to timestomp commit metadata, amending commits using 'git commit --amend --no-verify' to bypass security controls, and force-pushing the compromised history.
Detect scenarios where a potentially unauthorized application or user is modifying the system time.
This detection identifies a significant change to the system clock on an ESXi host, which may indicate an attempt to manipulate timestamps and evade detection or forensic analysis. The rule parses syslog messages from ESXi to extract the stepped time, the delta of the change, and the direction (forward or backward).
Detects scenarios where a potentially unauthorized application or user modifies the system time. This can be an indicator of defense evasion or an attempt to disrupt system operations or forensic analysis.