Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2 detections
Filters
Last updated
All Time
Detection languages
1
1
Contributors
1
1
Categories
1
1
1
Platforms
2
Products / Services
1
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
This rule detects attempts to access the Windows share IPC with the specific target name "cert," which could indicate unauthorized certificate requests. This behavior has been linked to tools such as Certipy.
This YARA rule detects the Greenp virus by looking for specific byte sequences within the Portable Executable (PE) file. It checks for two distinct bodies of code ($greenp_body_1 and $greenp_body_2) and requires that $greenp_body_1 is present at the entry point of the PE file. The rule also verifies that the file starts with the MZ header (0x5A4D), indicating a valid Windows executable.
