Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
224 detections
Filters
Last updated
All Time
Detection languages
102
43
27
17
17
Contributors
65
29
21
20
12
Categories
124
120
35
28
20
Platforms
177
40
22
5
5
Products / Services
47
36
24
14
12
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
1
1
1
IDS Classtypes
1
1
1
IDS Protocols
2
Query #1 - Find the machines on which this file was seen.
TODO - set file hash to be a SHA1 hash of your choice...
TODO - set file hash to be a SHA1 hash of your choice...
One of the challenges in making an AppLocker policy is knowing where applications
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
Original Sigma Rule: https://github.com/Neo23x0/sigma/blob/master/rules/apt/apt_sofacy_zebrocy.yml.
Questions via Twitter: @janvonkirchheim.
Questions via Twitter: @janvonkirchheim.
The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
The following analytic detects the use of Windows Management Instrumentation Command-line (WMIC) to retrieve information about running processes, specifically targeting the command lines used to launch those processes. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on logs containing process details and command-line executions. This activity is significant as it may indicate suspicious behavior, such as a user or process gathering detailed process information, which is uncommon for non-technical users. If confirmed malicious, this could allow an attacker to gain insights into running processes, aiding in further exploitation or lateral movement.
This analytic detects previously unseen processes within the Kubernetes environment on master or worker nodes. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, with data pulled from Splunk Observability Cloud. The detection compares processes observed in the last hour against those seen in the previous 30 days. Identifying new processes is crucial as they may indicate unauthorized activity or attempts to compromise the node. If confirmed malicious, these processes could lead to data exfiltration, privilege escalation, denial-of-service attacks, or the introduction of malware, posing significant risks to the Kubernetes cluster.
This rule detects the execution of common Linux utilities used for process discovery. Adversaries often use these commands (atop, htop, pgrep, ps, pstree, top) to gather information about running processes on a system, which helps them understand the environment and plan subsequent actions. This information can reveal common software or applications running on systems within the network.
Detects the execution of PCHunter, a powerful system utility similar to Process Hacker, which can be used to view and manipulate processes, kernel options, and other low-level system aspects. Its use by unauthorized personnel can indicate malicious activity, system reconnaissance, or attempts to tamper with system internals.
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
This rule detects various discovery commands commonly used on Cisco network devices. These commands are often used by adversaries to gather information about the network topology, device configuration, running processes, user sessions, and system details. The rule specifically looks for keywords associated with commands like 'dir' (file/directory listing), 'show arp' (ARP cache), 'show cdp' (Cisco Discovery Protocol neighbors), 'show clock' (system time), 'show ip interface' (IP interface configuration), 'show ip route' (routing table), 'show ip sockets' (network connections), 'show processes' (running processes), 'show ssh' (SSH sessions), 'show users' (logged-in users), and 'show version' (system information).
This rule detects the execution of the 'tasklist' command, which adversaries may use to gather information about running processes on a system. This information can help them understand the system's environment and identify potential targets or further actions.
This rule detects the execution of PowerShell scripts that contain the 'Get-Process' cmdlet. 'Get-Process' is used to retrieve information about running processes on a local computer. This activity is often performed by adversaries as part of the discovery phase to understand the system's environment and identify potential targets or interesting processes.
Cisco Discovery
Sigma
Find information about network devices that is not stored in config files
Get the processes that are running on the local computer.
This rule detects GwisinLocker ransomware activity on Linux systems. It identifies specific byte patterns associated with the ransomware's key initialization, file encryption routines, file discovery mechanisms, process termination, and ESXi shutdown capabilities. The rule has two main versions (v1 and v2) of these functionalities, and a match occurs if all parts of either version are found.
Yara rule that detects GwisinLocker ransomware.
This YARA rule detects the NB65 ransomware by identifying specific byte sequences associated with its file encryption, file discovery, and process enumeration functionalities. The rule looks for distinct patterns in the binary that indicate the presence of these malicious behaviors, which are characteristic of ransomware operations.
Yara rule that detects NB65 ransomware.
This YARA rule detects the BlackCat ransomware by identifying specific byte patterns associated with its functionality. The rule looks for patterns related to remote connection establishment, process enumeration, file discovery, and file encryption routines. The presence of these combined patterns indicates the likely presence of BlackCat ransomware.
Yara rule that detects BlackCat ransomware.
This rule detects the Redeemer ransomware by identifying specific byte patterns associated with its file discovery, encryption routines, and process modification activities. The rule looks for a combination of these patterns within a PE file to confirm the presence of Redeemer ransomware.
Page 10 of 11