Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
840 detections
Filters
Last updated
All Time
Detection languages
353
219
61
54
37
Contributors
197
144
98
85
71
Categories
540
142
109
106
99
Platforms
700
78
24
23
18
Products / Services
277
188
102
61
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
840
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
The following analytic identifies the execution of msdtc.exe with specific command-line parameters (-a or -b), which are indicative of the PlugX malware. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because PlugX uses these parameters to masquerade its malicious operations within legitimate processes, making it harder to detect. If confirmed malicious, this behavior could allow attackers to gain unauthorized access, exfiltrate data, and conduct espionage, severely compromising the affected system.
The following analytic detects when a process other than explorer.exe writes to the Windows Recycle Bin. It leverages the Endpoint.Filesystem and Endpoint.Processes data models in Splunk to identify any process writing to the "*$Recycle.Bin*" file path, excluding explorer.exe. This activity is significant because it may indicate an attacker attempting to hide their actions, potentially leading to data theft, ransomware, or other malicious outcomes. If confirmed malicious, this behavior could allow an attacker to persist in the environment and evade detection by security tools.
Detects uses of the SysInternals ProcDump utility in which ProcDump or its output (specifically LSASS memory dumps) get renamed, or a dump file is moved or copied to a different name. This behavior is often used by adversaries to evade detection when performing credential dumping.
Detects the execution of 'createdump.exe' or a renamed version of it, specifically when used to dump process memory. The rule looks for the original internal filename 'FX_VER_INTERNALNAME_STR' and command-line arguments indicative of memory dumping, such as '-u' or '--full' combined with '-f' or '--name' and a '.dmp' extension. This technique is often used by adversaries to extract credentials from processes like LSASS.
Detects the use of 'createdump.exe', a legitimate Windows utility, to dump process memory. This technique is often used by adversaries to extract credentials from processes like LSASS. The rule specifically looks for the execution of 'createdump.exe' or its original filename 'FX_VER_INTERNALNAME_STR' combined with command-line arguments indicative of a memory dump operation, such as '-u', '--full', '-f', '--name', or '.dmp'.
Detects the execution of the XORDump utility, a tool used for dumping process memory, specifically targeting LSASS or using common DLLs for memory dumping like comsvcs, dbghelp, or dbgcore. This activity is indicative of credential access attempts.
Detects the execution of 'DumpMinitool.exe', a tool used to dump process memory, specifically targeting the 'MiniDumpWriteDump' function. This tool can be used to extract credentials from processes like LSASS.
Detects suspicious execution of 'DumpMinitool.exe', a binary that can be used for credential dumping. The rule looks for executions outside of typical Visual Studio directories, or executions with command-line arguments indicative of memory dumping (e.g., '.txt', 'Full', 'Mini', 'WithHeap') unless the '--dumpType' flag is also present, which might indicate legitimate usage.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.). This technique is often used to dump LSASS memory for credential access.
Detects a process memory dump via "comsvcs.dll" using rundll32, covering multiple different techniques (ordinal, minidump function, etc.)
Detects a CodePage modification using the "mode.com" utility. This behavior has been used by threat actors behind Dharma ransomware.
Detects image load events of system control panel items (.cpl) from uncommon or non-system locations which might be the result of sideloading. This technique can be used for defense evasion by masquerading malicious code as legitimate system components.
Detects the modification of the system's code page to Russian language (code page 1251 or 866) using the `mode.com` utility. This activity has been observed in attacks involving Dharma ransomware and other malware.
This rule detects the execution of NetSupport RAT, specifically looking for instances where the 'client32.exe' component has been renamed. It identifies the RAT by checking for specific product strings ('NetSupport Remote Control'), original file names ('client32.exe'), or a known Imphash (A9D50692E95B79723F3E76FCF70D023E). The rule explicitly excludes legitimate executions of 'client32.exe' to focus on renamed instances, indicating an attempt at defense evasion.
Detects the execution of "forfiles" from a non-default location, in order to potentially spawn a custom "cmd.exe" from the current working directory. This technique can be used for defense evasion by masquerading the execution of arbitrary commands.
Detects rename operations of files with non-DLL extensions to files with a DLL extension. This is often performed by malware in order to avoid initial detections based on extensions.
Detects the 'sdiagnhost.exe' process launching suspicious child processes, which has been observed in exploits like Follina (CVE-2022-30190). The rule specifically looks for sdiagnhost.exe as a parent process and a list of common Living Off The Land Binaries (LOLBins) or other suspicious executables as child processes. It includes filters to reduce false positives related to common command-line arguments for cmd.exe and powershell.exe.
Detects the execution of 'find.exe' or 'findstr.exe' where the command line arguments include a '.lnk' file. This behavior has been observed in attacks, such as the HHS redirect attack, where adversaries use these legitimate Windows utilities to indirectly execute malicious shortcut files.
Detects the creation or renaming of a user account with a '$' character in its name. This technique can be used by adversaries to hide user accounts or evade detection systems that may not properly parse or display such characters, making the account appear less conspicuous or legitimate.
Detects suspicious child processes spawned from an interactive bash shell. This rule looks for specific command-line patterns (e.g., base64 encoding, pty.spawn for pseudo-terminal allocation) or specific executables (e.g., whoami, iptables, ncat/netcat) that are uncommon to be direct children of an interactive bash session, indicating potential malicious activity like reverse shells or reconnaissance.
Detects the presence of unicode characters which are homoglyphs, or identical in appearance, to ASCII letter characters in filenames. This is used as an obfuscation and masquerading technique. The rule specifically targets "perfect" homoglyphs that are indistinguishable from ASCII characters.
Page 39 of 40