Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
252 detections
Filters
Last updated
All Time
Detection languages
142
46
17
11
10
Contributors
63
31
24
23
23
Categories
78
69
67
67
49
Platforms
192
32
25
13
7
Products / Services
70
64
19
19
11
MITRE Techniques
18,114
15,634
12,576
8,388
6,215
CVEs
1
1
1
1
1
IDS Classtypes
5
2
IDS Protocols
4
The following analytic identifies a spike in the number of AWS Security Hub alerts for an EC2 instance within a 4-hour interval. It leverages AWS Security Hub findings data, calculating the average and standard deviation of alerts to detect anomalies. This activity is significant for a SOC as a sudden increase in alerts may indicate potential security incidents or misconfigurations requiring immediate attention. If confirmed malicious, this could signify an ongoing attack, leading to unauthorized access, data exfiltration, or disruption of services on the affected EC2 instance.
The following analytic detects attempts to exploit CVE-2022-26134, an unauthenticated remote code execution vulnerability in Confluence. It leverages the Web datamodel to analyze network and CIM-compliant web logs, identifying suspicious URL patterns and parameters indicative of exploitation attempts. This activity is significant as it allows attackers to execute arbitrary code on the Confluence server without authentication, potentially leading to full system compromise. If confirmed malicious, this could result in unauthorized access, data exfiltration, and further lateral movement within the network. Immediate investigation and remediation are crucial to prevent extensive damage.
The analytic detects the use of 'schtasks.exe' to start a Scheduled Task on a remote endpoint. This detection leverages Endpoint Detection and Response (EDR) data, focusing on process details such as process name, parent process, and command-line executions. This activity is significant as adversaries often abuse Task Scheduler for lateral movement and remote code execution. If confirmed malicious, this behavior could allow attackers to execute arbitrary code remotely, potentially leading to further compromise of the network.
The following analytic detects the execution of `powershell.exe` using the `Invoke-WmiMethod` cmdlet to start a process on a remote endpoint via WMI. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process telemetry. This activity is significant as it indicates potential lateral movement or remote code execution attempts by adversaries. If confirmed malicious, this could allow attackers to execute arbitrary code on remote systems, leading to further compromise and persistence within the network.
This YARA rule detects the Sshdinjector backdoor on Linux systems. It identifies specific byte patterns associated with the backdoor's functionalities, including killing and restarting daemons, network communication, reading the /etc/shadow file (for credential dumping), and listing running services.
Detects instances where a VNC service on an OpenCanary node has had a connection attempt. This indicates an adversary attempting to connect to a VNC service, likely for remote access or reconnaissance.
Detects instances where an SMB service on an OpenCanary node has had a file open request.
Detects instances where an SNMP service on an OpenCanary node has had an OID request.
Detects instances where a VNC service on an OpenCanary node has had a connection attempt.
Detects the modification of the 'AllowAnonymousCallback' registry value to '1' (0x00000001) within the WMI CIMOM path. This registry setting enables remote connections between computers that do not have a trust relationship, which can be abused by attackers for lateral movement or remote execution without proper authentication. This modification can indicate an attempt to weaken security controls related to WMI remote access.
This rule detects the installation of the 'Remote Utilities - Host' service on a Windows system. It specifically looks for Event ID 7045 from the 'Service Control Manager' provider, which indicates a service installation. The detection is further refined by checking for the presence of 'rutserv.exe' and '-service' in the ImagePath, or the exact service name 'Remote Utilities - Host'. This activity is often associated with remote access tools, which can be used legitimately for IT administration but also by adversaries for persistence and remote control.
Detects suspicious UltraVNC command line flag combinations that indicate an auto-reconnect upon execution, often used for persistence or remote access. This behavior has been observed in campaigns by the Gamaredon threat group.
This rule detects the creation of a Java process that is configured for remote debugging, specifically when the debugging interface is bound to an address other than localhost (127.0.0.1 or localhost). This configuration allows external connections to the Java Debug Wire Protocol (JDWP) port, which can be exploited by attackers to gain control over the Java application or the underlying system. The rule looks for the 'transport=dt_socket,address=' string in the command line, combined with the absence of 'address=127.0.0.1' or 'address=localhost'. It also includes a check for older JVM versions ('jre1.' or 'jdk1.') which might be more vulnerable.
Detects a remote file copy attempt to a hidden network share. This may indicate lateral movement or data staging activity.
Detects potential use of an SSH utility to establish RDP over a reverse SSH Tunnel. This can be used by attackers to enable routing of network packets that would otherwise not reach their intended destination.
Psexec Execution
Sigma
Detects user accept agreement execution in psexec commandline
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
This YARA rule detects the Bam2021 ransomware by identifying specific byte patterns associated with its core functionalities. These functionalities include enumerating shares, finding files for encryption, generating encryption keys, performing file encryption, and establishing remote connections, likely for command and control or data exfiltration.
This YARA rule detects the Zhen ransomware by identifying specific byte patterns associated with its file finding, file encryption, and network scanning functionalities. The rule looks for distinct sequences of instructions that are characteristic of how Zhen ransomware operates, including patterns related to locating files, encrypting them, and scanning the network for additional targets. The rule requires all three sets of patterns (find_files, encrypt_files, and scan_network) to be present within a PE file (indicated by the 'MZ' header) to trigger a detection.
This rule detects the LooCipher ransomware by identifying specific byte patterns associated with its functionality. The patterns include code related to establishing remote connections, encrypting files, and finding files on the system. The rule requires all three patterns to be present in an executable file (MZ header) to trigger, aiming to reduce false positives.
This Yara rule detects the Mafia ransomware by identifying specific byte patterns related to its file discovery, file encryption, and remote connection functionalities. The rule looks for a combination of these patterns within a file to confirm the presence of the Mafia ransomware.
Page 12 of 12