Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
9
2
1
Contributors
5
2
2
1
1
Categories
7
5
5
4
3
Platforms
12
Products / Services
8
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Detects network connections to known REvil ransomware domains
Detects network connections to URLs associated with the REvil ransomware family, including its payment and drop sites. This rule specifically looks for successful network connections.
Detects network connections to URLs associated with the REvil ransomware family, including its payment and drop sites. This rule specifically looks for successful network connections.
Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)
Detects process command line patterns and locations used by REvil group in Kaseya incident (can also match on other malware)
The following analytic detects a suspicious process loading a COM object from wbemprox.dll, fastprox.dll, or wbemcomn.dll. It leverages Sysmon EventCode 7 to identify instances where these DLLs are loaded by processes not typically associated with them, excluding known legitimate processes and directories. This activity is significant as it may indicate an attempt by threat actors to abuse COM objects for privilege escalation or evasion of detection mechanisms. If confirmed malicious, this could allow attackers to gain elevated privileges or maintain persistence within the environment, posing a significant security risk.
Detects specific command-line patterns and process image paths associated with the REvil ransomware group's attack on Kaseya VSA. The rule looks for execution of 'cert.exe' and 'MsMpEng.exe' from unusual paths, as well as specific file deletion commands and references to 'Kaseya VSA Agent Hot-fix' and 'agent.exe'/'agent.crt' in 'kworking' or 'kworking1' directories, which were observed during the Kaseya supply chain incident.
