Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects potential command-line obfuscation using Unicode characters. Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This rule specifically looks for the use of various Unicode characters that can be used to obscure commands executed by common Windows command-line interpreters and scripting engines.
Detects suspicious encoded character syntax often used in PowerShell for defense evasion, specifically looking for '[char]0x' or '(WCHAR)0x' in command lines, which are common methods to obfuscate commands.
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
Detects the execution of certutil with certain flags that allow the utility to download files
Detects files with suspiciously structured names potentially related to stage 2 malware delivery, focusing on those that contain specific HTML and image file extensions. This is specifically related to known malware TTPs related to Qakbot.
This analytic identifies Snort intrusion signatures that have been triggered by ten or more distinct internal IP addresses within a one-hour window. It leverages Cisco Secure Firewall Threat Defense logs and focuses on the IntrusionEvent event type to detect activity that may indicate broad targeting or mass exploitation attempts. This behavior is often associated with opportunistic scanning, worm propagation, or automated exploitation of known vulnerabilities across multiple systems. If confirmed malicious, this could represent the early phase of a coordinated attack aiming to gain a foothold on several hosts or move laterally across the environment.
The following analytic detects processes with names consisting of a single letter, which is often indicative of malware or an attacker attempting to evade detection. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant because attackers use such techniques to obscure their presence and carry out malicious activities like data theft or ransomware attacks. If confirmed malicious, this behavior could lead to unauthorized access, data exfiltration, or system compromise. Immediate investigation is required to determine the legitimacy of the process.
This analytic detects email attachments with an unusually high number of spaces in their file names, which is a common tactic used by attackers to obfuscate file extensions. It leverages the Email data model to identify attachments where the ratio of spaces to the total file name length exceeds 10%. This behavior is significant as it may indicate an attempt to bypass security filters and deliver malicious payloads. If confirmed malicious, this activity could lead to the execution of harmful code or unauthorized access to sensitive information within the recipient's environment.
This analytic detects the behavior of decoding base64-encoded data and passing it to a Linux shell. The detection is made by searching for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", within the Endpoint.Processes data model. The analytic also includes a filter for Linux shells. This activity is indicative of malicious behavior as Base64 encoding is commonly used to obfuscate malicious commands or payloads, and decoding it can be a step in running those commands. It suggests that an attacker is attempting to run malicious commands on a Linux system to gain unauthorized access, for data exfiltration, or perform other malicious actions.
The analytic detects the use of the base64 decode command on Linux systems, which is often used to deobfuscate files. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include "base64 -d" or "base64 --decode". This activity is significant as it may indicate an attempt to hide malicious payloads or scripts. If confirmed malicious, an attacker could use this technique to execute hidden code, potentially leading to unauthorized access, data exfiltration, or further system compromise.
The analytic detects unusually long command lines, which may indicate malicious activity. Attackers often use obfuscated or complex command lines to evade detection and execute malicious payloads. If confirmed malicious, this activity could lead to data theft, ransomware deployment, or further system compromise. Analysts should investigate the source and content of the command line, inspect relevant artifacts, and review concurrent processes to identify potential threats.
The analytic identifies the creation of a .crmlog file within the %windows%\Registration directory, typically with a format of <RANDOM_GUID>.<RANDOM_GUID>.crmlog. This activity is significant as it is associated with the Snake malware, which uses this file for its operations. If confirmed malicious, this could indicate the presence of Snake malware, leading to potential data exfiltration, system compromise, and further malicious activities. Immediate investigation is required to mitigate the threat.
The analytic identifies unusually long command lines executed on hosts, which may indicate malicious activity. It leverages the Machine Learning Toolkit (MLTK) to detect command lines with lengths that deviate from the norm for a given user. This is significant for a SOC as unusually long command lines can be a sign of obfuscation or complex malicious scripts. If confirmed malicious, this activity could allow attackers to execute sophisticated commands, potentially leading to unauthorized access, data exfiltration, or further compromise of the system.
This rule detects the presence of various emoji characters within the command line arguments of a newly created process. The use of emojis in command lines is considered unusual and could indicate an attempt at defense evasion, potentially to bypass signature-based detections or obfuscate malicious commands.
This rule detects the use of various emojis within command-line arguments. Adversaries may use uncommon characters, such as emojis, in command lines to evade signature-based detections, obfuscate their activities, or bypass security controls that are not designed to parse or analyze such characters. This technique falls under defense evasion, as it attempts to make malicious commands less conspicuous to automated analysis.
Detects the usage of emojis and various Unicode characters in command-line arguments. This technique can be used by adversaries for defense evasion, specifically to obfuscate commands and avoid detection by signature-based security tools. The rule identifies a wide range of such characters, including colored squares, arrows, playing card symbols, clock faces, chess pieces, dice, hieroglyphs, flags, and modern emojis.
This rule detects the presence of specific emoji characters within the command line arguments of a newly created process. The use of emojis in command lines is highly unusual and could indicate an attempt by an adversary to evade detection by security tools that may not be configured to parse or analyze non-standard characters, or to obfuscate malicious commands. The rule specifically targets a wide range of human-like and animal emojis with various skin tones.
Detects suspicious encoded character syntax often used for defense evasion
Detects PowerShell execution that utilizes the bitwise XOR (bxor) operator. Attackers may use this as an alternative obfuscation method to Base64 encoded commands to evade detection. Investigation of the command line and process tree is recommended to determine if the activity is malicious.
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe. AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks. Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
Page 76 of 81