Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,153 detections
Filters
Last updated
All Time
Detection languages
541
211
97
75
69
Contributors
363
214
171
65
55
Categories
384
376
337
250
233
Platforms
1,097
44
8
7
3
Products / Services
448
379
89
86
36
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,153
CVEs
6
5
2
1
1
IDS Classtypes
3
2
2
IDS Protocols
4
1
The analytic detects a process from a non-standard file path on Windows attempting to create a remote thread in another process. This is identified using Sysmon EventCode 8, focusing on processes not originating from typical system directories. This behavior is significant as it often indicates process injection, a technique used by adversaries to evade detection or escalate privileges. If confirmed malicious, this activity could allow an attacker to execute arbitrary code within another process, potentially leading to unauthorized actions and further compromise of the system.
This analytic detects processes with command lines containing named pipes. This behavior is often used by adversaries for inter-process communication post-injection, aiding in defense evasion and privilege escalation. The rule specifically excludes processes originating from common program file paths to reduce false positives. If confirmed malicious, this activity could allow attackers to maintain persistence, escalate privileges, or evade defenses, potentially leading to further compromise of the system.
The analytic detects the creation of a file named "license.dat" in the %appdata% or %programdata% directories. This behavior is strongly associated with the IcedID malware, which uses this file to inject its core bot into other processes for banking credential theft. The detection leverages Sysmon EventCode 11 to monitor file creation events in these directories. This activity is significant as it indicates a potential malware infection aiming to steal sensitive banking information. If confirmed malicious, the attacker could gain unauthorized access to financial data, leading to significant financial loss and data breaches.
The analytic detects the suspicious creation of a remote thread by rundll32.exe targeting browser processes such as firefox.exe, chrome.exe, iexplore.exe, and microsoftedgecp.exe. This detection leverages Sysmon EventCode 8, focusing on SourceImage and TargetImage fields to identify the behavior. This activity is significant as it is commonly associated with malware like IcedID, which hooks browsers to steal sensitive information such as banking details. If confirmed malicious, this could allow attackers to intercept and exfiltrate sensitive user data, leading to potential financial loss and privacy breaches.
The analytic detects instances of DLLHost.exe executing without command line arguments. This behavior is unusual and often associated with malicious activities, such as those performed by Cobalt Strike. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant because DLLHost.exe typically requires arguments to function correctly, and its absence may indicate an attempt to evade detection. If confirmed malicious, this could lead to unauthorized actions like credential dumping or file manipulation, posing a severe threat to the environment.
The following analytic detects Microsoft Remote Assistance (msra.exe) spawning PowerShell.exe or cmd.exe as a child process. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where msra.exe is the parent process. This activity is significant because msra.exe typically does not spawn command-line interfaces, indicating potential process injection or misuse. If confirmed malicious, an attacker could use this technique to execute arbitrary commands, escalate privileges, or maintain persistence on the compromised system.
The analytic identifies instances of the `searchindexer.exe` process that are not spawned by `services.exe`, indicating potential process injection. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes. This activity is significant because QakBot malware often uses a fake `searchindexer.exe` to evade detection and perform malicious actions such as data exfiltration and keystroke logging. If confirmed malicious, this activity could allow attackers to maintain persistence, steal sensitive information, and communicate with command and control servers.
The analytic identifies a suspicious instance of wermgr.exe spawning a child process unrelated to error or fault handling. This activity is significant as it can indicate Qakbot malware, which injects malicious code into wermgr.exe to evade detection and execute malicious actions. If confirmed malicious, this behavior could allow an attacker to conduct reconnaissance, execute arbitrary code, and persist within the network, posing a severe security risk.
The following analytic detects the spawning of cmd or PowerShell processes by the wermgr.exe process. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process telemetry, including parent-child process relationships and command-line executions. This behavior is significant as it is commonly associated with code injection techniques used by malware like TrickBot to execute shellcode or malicious DLL modules. If confirmed malicious, this activity could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a severe threat to system security.
This analytic detects the creation of a remote thread by rundll32.exe into another process, leveraging Sysmon EventCode 8 logs. This activity is a common technique used by malware, such as IcedID, to execute malicious code within legitimate processes, aiding in defense evasion and data theft. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code, escalate privileges, and exfiltrate sensitive information from the compromised host.
The analytic detects `winhlp32.exe` spawning a child process that loads a file from `appdata`, `programdata`, or `temp` directories. This activity is significant because `winhlp32.exe` has known vulnerabilities and can be exploited to execute malicious code. If confirmed malicious, an attacker could use this technique to execute arbitrary scripts, escalate privileges, or maintain persistence within the environment. Analysts should review parallel processes, module loads, and file modifications for further suspicious behavior.
Detects when the Console Window Host (conhost.exe) process is spawned by an uncommon parent process, which could be indicative of potential code injection activity. The rule specifically looks for conhost.exe being spawned by processes other than a predefined list of common and legitimate parents, while also filtering out specific command-line patterns for svchost.exe and Dropbox to reduce false positives.
Connection to ADFS via named pipes that are not using specific Windows ADFS processes may be indicative of user attempting to access ADFS for suspicious purposes
Yara rule that detects PygmyGoat backdoor.
Detects remote thread creation in the 'mstsc.exe' process by a process originating from a suspicious temporary or public user directory. This technique is often used by attackers to inject code into 'mstsc.exe' to hook APIs and steal credentials during RDP authentications.
Detects the creation of named pipes with patterns characteristic of the EfsPotato privilege escalation tool. This tool exploits a vulnerability related to the Encrypting File System (EFS) service to achieve local privilege escalation by creating specific named pipes for inter-process communication.
Detects whether a process is created from an image path that does not have a standard executable file extension (e.g., .exe, .com, .bin). This behavior can indicate advanced evasion techniques like process ghosting or other unorthodox methods to launch processes, where an executable might be disguised or loaded without a typical extension. The rule includes various filters to reduce false positives from legitimate system processes, temporary files, installer components, and specific third-party applications.
This rule detects the execution of 'Autoit3.exe' when it is spawned by suspicious parent processes such as 'cmd.exe', 'KeyScramblerLogon.exe', or 'msiexec.exe'. It specifically filters out legitimate executions of 'Autoit3.exe' from standard installation paths to reduce false positives. This activity is indicative of the DarkGate malware infection chain, which leverages AutoIt3.exe to execute shellcode for process injection and command-and-control communication.
Detects the creation of a named pipe with the pattern '\coerced\' which is indicative of the hack tool CoercedPotato. This tool is used for privilege escalation by coercing authentication from a target system.
Detects the creation of named pipes that match specific patterns known to be used by Cobalt Strike's Malleable C2 profiles. These patterns are often indicative of Cobalt Strike beacon activity on a system.
This rule detects potential Dridex malware activity by identifying specific process patterns. It looks for `svchost.exe` processes with command lines indicating execution from a user's Desktop directory, which is unusual for legitimate svchost processes. It also identifies `regsvr32.exe` being spawned by `excel.exe` with specific command-line arguments often used by Dridex for DLL execution from temporary directories. Additionally, it flags anomalous child processes like `whoami.exe /all` or `net.exe view` (or `net1.exe view`) being spawned by `svchost.exe`, which could indicate discovery activities post-compromise by Dridex.
Page 54 of 55