Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
32 detections
Filters
Last updated
All Time
Detection languages
13
11
6
2
Contributors
6
5
4
4
3
Categories
13
11
11
7
5
Platforms
28
2
2
2
Products / Services
11
3
3
2
2
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
2
IDS Protocols
2
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns, where a file with a .ini extension is used for execution, often via cmd.exe.
This rule detects when an executable file is embedded within an Office document that is being downloaded over HTTP. It specifically looks for the presence of both the Office document content type indicator "[Content_Types].xml" and the "MZ" magic bytes, which signify a Windows executable, within the same file data stream. This combination is a strong indicator of a malicious Office document attempting to deliver malware.
This rule detects potential steganography where a payload is embedded within an image file, specifically a JPEG. It triggers when an HTTP response contains JPEG magic bytes (`FF D8 FF`) within the first 3 bytes, and the file size is unusually large (over 1MB), suggesting additional data might be hidden within the image. The rule also includes a threshold to prevent excessive alerts from legitimate large images.
Detects the creation of specific disguised shortcut (.lnk) files on drives, indicative of DeepLoad's USB propagation mechanism. DeepLoad spreads to adjacent endpoints by dropping over 40 disguised .lnk files onto connected USB drives.
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns where a .ini file extension is used to disguise an executable, which is then launched via cmd.exe.
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
Detects TOKEN OBFUSCATION technique from Invoke-Obfuscation
Finding base64 encoded PE files header seen in the command line parameters.
Tags: #fileLess #powershell.
Tags: #fileLess #powershell.
Yara rule that detects Kovter ransomware.
Page 2 of 2