Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3 detections
Filters
Last updated
All Time
Detection languages
1
1
1
Contributors
1
1
1
Categories
2
1
1
1
1
Platforms
2
1
Products / Services
1
1
1
1
1
MITRE Techniques
18,098
15,553
12,544
8,358
6,159
Detects suspicious cron utility activity, including modifications or executions, with specific indicators associated with the MYRA malware family. This rule identifies attempts to establish persistence or execute malicious code via scheduled tasks on Linux systems.
The following analytic identifies potential DLL side-loading instances involving unsigned DLLs mimicking Microsoft signatures. It detects this activity by analyzing Sysmon logs for Event Code 7, where both the `Image` and `ImageLoaded` paths do not match system directories like `system32`, `syswow64`, and `programfiles`. This behavior is significant as adversaries often exploit DLL side-loading to execute malicious code via legitimate processes. If confirmed malicious, this activity could allow attackers to execute arbitrary code, potentially leading to privilege escalation, persistence, and unauthorized access to sensitive information.
This rule detects the Pandora ransomware based on specific byte patterns found within the executable. It looks for patterns related to file enumeration, key generation, and the dropping of a ransom note, combined with the MZ header indicating a Windows executable.
