Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
56 detections
Filters
Last updated
All Time
Detection languages
33
9
8
4
2
Contributors
9
7
7
6
6
Categories
30
13
9
9
7
Platforms
46
5
4
Products / Services
24
7
5
2
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
Detects the execution of a shell script downloaded via curl or wget on macOS, a technique associated with ClickFix campaigns delivering malware like Atomic macOS Stealer (AMOS).
Detects network traffic to command and control (C2) servers associated with the Katz Stealer malware, identified by known IP addresses and domains.
KQL Query
KQL Query from file: MDE KQL to detect UAC bypass of Fickle Stealer
Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant that is known to be used for stealing sensitive information from compromised systems. In Enterprise environments, DNS queries to these domains may indicate potential malicious activity or compromise.
Detects DNS queries to domains associated with Katz Stealer malware. Katz Stealer is a malware variant known for stealing sensitive information. In enterprise environments, such DNS queries may indicate potential malicious activity or compromise.
This analytic detects suspicious processes accessing registry entries related to default internet browsers. It specifically looks for Windows Security Event Code 4663, which indicates an attempt to access registry paths associated with browser configurations. Adversaries often target these registry keys to gather information about installed browsers and their settings, which can lead to the theft of sensitive data like login credentials and browsing history. The rule filters out common legitimate processes to reduce false positives. If confirmed malicious, this activity could enable attackers to exfiltrate sensitive information and compromise user accounts.
The following analytic detects the copying of Chrome's Local State and Login Data files into temporary folders, a tactic often used by the Braodo stealer malware. These files contain encrypted user credentials, including saved passwords and login session details. The detection monitors for suspicious copying activity involving these specific Chrome files, particularly in temp directories where malware typically processes the stolen data. Identifying this behavior enables security teams to act quickly, preventing attackers from decrypting and exfiltrating sensitive browser credentials and mitigating the risk of unauthorized access.
The following analytic detects a suspicious modification to the Windows registry that changes the auto-update notification setting to "Notify before download." This detection leverages data from the Endpoint.Registry data model, focusing on specific registry paths and values. This activity is significant because it is a known technique used by adversaries, including malware like RedLine Stealer, to evade detection and potentially deploy additional payloads. If confirmed malicious, this modification could allow attackers to bypass security measures, maintain persistence, and exploit vulnerabilities on the target host.
The following analytic detects a suspicious registry modification aimed at disabling Windows Defender notifications. It leverages data from the Endpoint.Registry data model, specifically looking for changes to the registry path "*\SOFTWARE\Policies\Microsoft\Windows Defender Security Center\Notifications\DisableNotifications" with a value of "0x00000001". This activity is significant as it indicates an attempt to evade detection by disabling security alerts, a technique used by adversaries and malware like RedLine Stealer. If confirmed malicious, this could allow attackers to operate undetected, increasing the risk of further compromise and data exfiltration.
This analytic detects a suspicious modification to the Windows registry that disables automatic reboot with a logged-on user. This detection leverages the Endpoint data model to identify changes to the registry path `SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU\NoAutoRebootWithLoggedOnUsers` with a value of `0x00000001`. This activity is significant as it is commonly used by adversaries, including malware like RedLine Stealer, to evade detection and maintain persistence. If confirmed malicious, this could allow attackers to bypass security measures and deploy additional payloads without interruption.
This analytic detects when critical Windows Update services, specifically "Update Orchestrator Service for Windows Update," "WaaSMedicSvc," and "Windows Update," have their start mode changed to 'disabled.' It uses Windows System Event ID 7040 logs to identify these changes. Disabling these services can be an adversary's tactic to prevent system updates, thereby maintaining persistence and exploiting unpatched vulnerabilities, compromising system integrity and security.
The following analytic detects an access request on the uninstall registry key. It leverages Windows Security Event logs, specifically event code 4663. This activity is significant because adversaries or malware can exploit this key to gather information about installed applications, aiding in further attacks. If confirmed malicious, this behavior could allow attackers to map out installed software, potentially identifying vulnerabilities or software to exploit, leading to further system compromise.
This rule detects the StealC infostealer malware by identifying specific byte patterns within the executable. These patterns correspond to functions for resolving Windows APIs, loading SQLite3 functions (often used by infostealers to extract data from browsers and other applications), and checking license expiration dates, which are characteristic of this particular malware family. The rule requires all three patterns to be present in a PE file (identified by the 'MZ' header) to trigger, reducing false positives.
Page 3 of 3