Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
48 detections
Filters
Last updated
All Time
Detection languages
31
14
2
1
Contributors
21
14
8
4
1
Categories
21
15
12
9
5
Platforms
48
2
2
Products / Services
18
14
9
5
4
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
This rule detects potential activity associated with the EmpireMonkey APT group. Specifically, it looks for process creation events where the command line contains both '/e:jscript' and '\Local\Temp\Errors.bat'. This combination suggests the execution of a JScript file, possibly a malicious script, from a temporary directory, which is a common tactic used by threat actors for defense evasion and execution.
This rule detects process creation events indicative of the Griffon malware. Specifically, it looks for command-line arguments that contain all of the following strings: '\local\temp\', '//b /e:jscript', and '.txt'. This pattern suggests the execution of a JScript file from a temporary directory, which is a known behavior of Griffon malware as reported by Kaspersky.
This rule detects the creation of suspicious file types (e.g., executables, scripts, archives) within the `C:\PerfLogs\` directory. This directory is typically used for performance logs and primarily contains `.etl` files. The presence of other executable or script file types in this location is highly unusual and can indicate malicious activity, such as staging for execution, persistence, or data exfiltration.
Detects an executable in a user's directory that is spawned by a Microsoft Office application (Word, Excel, PowerPoint, Publisher, Visio, Access, Equation Editor). This behavior is often associated with malicious documents attempting to execute payloads.
This rule detects the execution of 'curl.exe' when it is used with the '-H' flag to specify a custom 'User-Agent' string. This behavior can be indicative of an attacker attempting to download or exfiltrate data to a domain that requires a specific User-Agent for access, potentially to bypass security controls or blend in with legitimate traffic. The rule specifically looks for the 'curl.exe' image or original filename and the presence of '-H' followed by 'User-Agent:' in the command line.
This rule detects the execution of 'curl.exe' to download files from a direct IP address, rather than a domain name. It specifically looks for command-line arguments that indicate a download operation (e.g., '-O', '--remote-name', '--output') and the presence of an IP address in the URL. The rule also filters for common executable and script file extensions, suggesting the download of malicious payloads. This activity is often associated with adversaries attempting to retrieve tools or malware onto a compromised system, bypassing typical domain-based reputation checks.
Page 3 of 3