Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects various activities associated with the 'Operation Wocao' campaign, including the use of 'checkadmin.exe', 'netsh' commands to modify firewall rules, PowerShell execution with bypass and encoded commands, scheduled task creation, and attempts to query KeePass configuration files and PuTTY sessions from the registry. These activities indicate potential privilege escalation, persistence, discovery, and defense evasion techniques used by the threat actor.
This rule detects the creation of an executable named 'Get-Variable.exe' within the 'Local\Microsoft\WindowsApps\' directory. This is a suspicious activity because 'Get-Variable' is a legitimate PowerShell cmdlet, not an executable. Adversaries can exploit the Windows application execution alias feature, where executables in the WindowsApps directory can be prioritized over PowerShell cmdlets with the same name. By placing a malicious 'Get-Variable.exe' in this path, an attacker can trick the system into executing their malicious binary instead of the intended PowerShell cmdlet when 'Get-Variable' is invoked, leading to persistence or privilege escalation.
This rule detects attempts to obfuscate the `SOFTWARE\Microsoft\Windows\CurrentVersion\Run` registry key path by inserting various special characters between the letters. This technique is often used by malware to establish persistence and evade detection.
This rule detects PHP webshells that utilize a specific obfuscation technique. It looks for PHP code that concatenates strings using apostrophes and dots, where each string segment is 1 to 3 alphanumeric characters long. This pattern is indicative of an attempt to hide malicious code within a PHP file.
This rule detects the ToxicEye Remote Access Trojan (RAT) based on specific byte patterns, configuration strings, and various other strings found within the malware's executable. The rule is split into three parts: one for identifying specific instruction sequences related to configuration settings (e.g., cryptocurrency addresses, file encryption types, installation paths, autorun settings, anti-VM capabilities), another for wide character strings indicative of ToxicEye's internal messages, C2 infrastructure, and data exfiltration targets, and a third for ASCII strings related to its internal components and functionalities. The combined conditions aim to provide high confidence detection of ToxicEye.
This rule detects HTML content that is structured to resemble an imageless QR code, typically rendered using an HTML table. It looks for the presence of both black and white color definitions (hex codes #FFFFFF and #000000) in conjunction with HTML table tags (<table> or <td) and color styling attributes (background-color: or color:). This technique can be used for obfuscation or to embed data in a way that might bypass traditional image-based QR code detection.
This analytic detects the execution of PowerShell scripts containing Base64 encoded content, specifically identifying the use of `FromBase64String`. It leverages PowerShell Script Block Logging (EventCode=4104) to capture and analyze the full command sent to PowerShell. This activity is significant as Base64 encoding is often used by attackers to obfuscate malicious payloads, making it harder to detect. If confirmed malicious, this could lead to code execution, allowing attackers to run arbitrary commands and potentially compromise the system.
The following analytic detects PowerShell processes launched with command-line arguments indicative of obfuscation techniques. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and complete command-line executions. This activity is significant because obfuscated PowerShell commands are often used by attackers to evade detection and execute malicious scripts. If confirmed malicious, this activity could lead to unauthorized code execution, privilege escalation, or persistent access within the environment, posing a significant security risk.
Detects PowerShell command-line execution with unusual or randomized character casing for keywords like "powershell" or "-noprofile". This is a common obfuscation technique used by attackers to evade basic, case-sensitive detections. This rule is inspired by the THOR PowerShell_Case_Anomaly Yara rule.
This rule detects the use of 'Set-Alias' or 'New-Alias' cmdlets in PowerShell script block logs. Adversaries often use these cmdlets to create aliases for legitimate or malicious commands, thereby obfuscating their activities and making detection more difficult. The rule includes a filter for common, legitimate CIM session-related aliases to reduce false positives.
Detects PowerShell scripts that contain decryption routines and in-memory execution commands, a technique used by UNC5142 to run final payloads while evading disk-based detection.
Detects the execution of the 'ping.exe' command with a hexadecimal encoded IP address in the command line. This technique is often used by adversaries for defense evasion, specifically to obfuscate network communication or command and control activities, making it harder for security tools to detect the target IP address.
Detects the use of short name paths (8.3 format) in command lines, which can be used to obfuscate paths or access restricted locations. Windows creates short 8.3 filenames (like PROGRA~1) for compatibility with MS-DOS-based or 16-bit Windows programs. This technique can be used to bypass security controls, especially in web servers on Windows.
MAL Bat Dropper
YARA
Detects a specific multi-stage batch file dropper identified by its hash. This malware uses PowerShell, VBScript, and multiple layers of obfuscation (Base64, XOR, Gzip) to deliver its payload.
Detects a PowerShell command that carves an MSI file from a source file by searching for a specific byte sequence ('UUUU' or 0x55 four times). This novel technique has been used by a Chinese APT group as part of their infection chain, often initiated by a malicious LNK file.
Detects PowerShell execution patterns consistent with the 'FileFix' social engineering technique. This technique tricks users into pasting and running a malicious command, often from the Run dialog or File Explorer address bar, which results in explorer.exe being the parent process. The command typically involves downloading and executing a remote script.
This rule detects PowerShell or pwsh.exe process creations that include command-line arguments indicative of image file manipulation and obfuscation techniques. Specifically, it looks for the presence of image file extensions (.png, .jpg, .jpeg, .gif, .bmp, .tiff, .tif) combined with PowerShell commands or .NET methods related to base64 decoding, expression invocation, command invocation, GDI+ graphics operations (System.Drawing, Bitmap, GetPixel, SetPixel, LockBits, UnlockBits, PixelFormat), or file content reading ([IO.File]::ReadAllBytes, Get-Content). Additionally, it checks for common obfuscation or execution flags such as '-enc', '-encoded', '-e', '-w hidden', '-windowstyle hidden', '-nop', '-noprofile', '-ep bypass', or '-executionpolicy bypass'. This combination suggests an attempt to execute malicious code hidden within image files, often using steganography or other covert methods.
Detects components of the NET-STAR malware suite, including IIServerCore and AssemblyExecuter, used by the Chinese-nexus APT group Phantom Taurus.
Detects AdaptixC2 beacon (PE) and shellcode loader components based on unique code patterns and API hashes.
Detects VenomRAT, a variant of QuasarRAT, used by the RevengeHotels group in recent campaigns targeting the hospitality industry. This rule identifies the RAT based on a characteristic list of security and analysis tools it attempts to terminate, along with other unique features.
The following analytic detects the use of the EncodedCommand parameter in PowerShell processes. It leverages Endpoint Detection and Response (EDR) data to identify variations of the EncodedCommand parameter, including shortened forms and different command switch types. This activity is significant because adversaries often use encoded commands to obfuscate malicious scripts, making detection harder. If confirmed malicious, this behavior could allow attackers to execute hidden code, potentially leading to unauthorized access, privilege escalation, or persistent threats within the environment. Review parallel events to determine legitimacy and tune based on known administrative scripts.
Page 64 of 81