Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe"
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Both can be used for AWL bypass and to execute F# code via scripts or inline.
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
Detects execution of "ftp.exe" script with the "-s" or "/s" flag and any child processes ran by "ftp.exe".
Detects a suspicious script executions from temporary folder
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Detects a suspicious script execution in temporary folders or folders accessible by environment variables
Detects usage of winget to add a new insecure (http) download source.
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Winget will not allow the addition of insecure sources, hence this could indicate potential suspicious activity (or typos)
Detects execution of perl using the "-e"/"-E" flags. This is could be used as a way to launch a reverse shell or execute live perl code.
Detects execution of php using the "-r" flag. This is could be used as a way to launch a reverse shell or execute live php code.
Detects processes loading modules related to PCRE.NET package
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges. Use this rule to hunt for potential suspicious processes.
Detects suspicious file based on their extension being created in "C:\PerfLogs\". Note that this directory mostly contains ".etl" files
Detects Windows shells and scripting applications that write files to suspicious folders
Detects processes creating temp files related to PCRE.NET package
This query was originally published in the threat analytics report, Python abuse on macOS
The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
The following query checks for Microsoft Office documents that run Python scripts.
Reference - https://www.powershellempire.com/
The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
The following query checks for Microsoft Office documents that run Python scripts.
Reference - https://www.powershellempire.com/
This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push.
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
'This query identifies when a process execution command-line indicates that a registry value is written to allow for later execution a malicious script
References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/'
References: https://www.microsoft.com/security/blog/2021/03/04/goldmax-goldfinder-sibot-analyzing-nobelium-malware/'
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query hunts for an attacker-created copy of certutil.exe, a legitimate process, which the macro uses to download BazaLoader.
This query hunts for an attacker-created copy of certutil.exe, a legitimate process, which the macro uses to download BazaLoader.
LemonDuck is an actively updated and robust malware primarily known for its botnet and cryptocurrency mining objectives. First discovered in 2019, LemonDuck has since adopted more sophisticated behavior and escalated its operations in 2021. Today, beyond using resources for its traditional bot and mining activities, LemonDuck steals credentials, removes security controls, spreads via emails, moves laterally, and ultimately drops more tools for human-operated activity.
This query was originally published in the threat analytics report, Ursnif (Gozi) continues to evolve.
Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser.
Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques.
The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers.
References:
https://docs.microsoft.com/previous-versions/ms536496(v=vs.85)
https://attack.mitre.org/techniques/T1170/
Microsoft HTML Applications, or HTAs, are executable files that use the same technologies and models as Internet Explorer, but do not run inside of a web browser.
Mshta.exe is a Windows utility that provides a host for HTA files to run in. Although it has legitimate uses, attackers can use mshta.exe to run malicious Javascript or VBScript commands. The MITRE ATT&CK framework includes Mshta among its list of enterprise attack techniques.
The following query detects when mshta.exe has been run, which might include illegitimate usage by attackers.
References:
https://docs.microsoft.com/previous-versions/ms536496(v=vs.85)
https://attack.mitre.org/techniques/T1170/
'Summarizes uses of uncommon & undocumented commandline switches to create persistence
User accounts may be created to achieve persistence on a machine.
Read more here: https://attack.mitre.org/wiki/Technique/T1136
Query for users being created using "net user" command
"net user" commands are noisy, so needs to be joined with another signal -
e.g. in this example we look for some undocumented variations (e.g. /ad instead of /add)'
User accounts may be created to achieve persistence on a machine.
Read more here: https://attack.mitre.org/wiki/Technique/T1136
Query for users being created using "net user" command
"net user" commands are noisy, so needs to be joined with another signal -
e.g. in this example we look for some undocumented variations (e.g. /ad instead of /add)'
Page 141 of 155