Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects suspicious child processes spawned by 'pc-app.exe', which is the main application executable for PaperCut MF/NG. The presence of common system utilities and scripting interpreters as child processes of 'pc-app.exe' can indicate successful exploitation of a vulnerability within PaperCut, potentially leading to arbitrary code execution.
This rule detects attempts to create or rename files with a space at the end of their filename, which can be used to obfuscate malicious files or commands. Specifically, it looks for command-line executions involving 'echo "*" > * && chmod +x *' or 'mv * "* "'. The first pattern suggests creating an executable file with a trailing space, and the second suggests renaming a file to include a trailing space.
This rule detects the creation or execution of files that have been identified as malicious by Google Safe Browsing. It correlates process launch or file creation events with a list of known malicious file SHA256 hashes provided by the Google Safe Browsing service, specifically looking for files categorized as 'SOFTWARE_MALICIOUS' with 'CRITICAL' severity.
Detects potentially suspicious child processes spawned by Wscript.exe or Cscript.exe. This includes scenarios where these script hosts launch command-line interpreters (cmd.exe, powershell.exe) that then execute tools like rundll32, regsvr32, msiexec, or mshta with network-related arguments. It also covers direct spawning of rundll32.exe by Wscript/Cscript, while filtering out common legitimate uses of rundll32. This behavior is often observed in malware such as Pikabot and Qakbot for execution and defense evasion.
This rule detects when a process executes another process, and both the principal (parent) process's file hash and the target (child) process's file hash have known 'EXECUTES' relationships in VirusTotal. This indicates that VirusTotal has previously observed the parent process executing the child process, which could be a sign of malicious activity if the hashes are associated with known threats.
This rule detects the use of 'sc.exe' to query and enumerate services, specifically looking for the 'termservice'. Attackers often use 'sc.exe' to gather information about running services on a system, which can help them identify potential attack vectors or sensitive services. The detection focuses on the execution of 'sc.exe' with the 'query' command and the specific service 'termservice'.
Detects the execution of 'cmd.exe' specifically when initiated by the AnyViewer Remote Monitoring and Management (RMM) agent during a remote management session. This activity could indicate an adversary using the legitimate remote access tool to execute commands on a compromised system.
This rule monitors for attempts to write potentially malicious files into the C:\Windows\Fonts\ directory using command-line utilities. This folder is often targeted by adversaries because it typically does not require administrative privileges for writing and execution, making it a suitable location for defense evasion and persistence. The rule specifically looks for common command-line tools (like 'echo', 'copy', 'type', 'file createnew', 'cacls') combined with the target path 'C:\Windows\Fonts\' and various executable or script file extensions.
Detects the execution of the Ammyy Admin RMM agent for remote management, specifically when rundll32.exe is used to load and execute the aa_nts.dll component.
Detects the initial execution pattern of the APT41 TOUGHPROGRESS malware via a malicious LNK file executing rundll32.exe with a specific command line argument as described in the Google Cloud blog.
Detects suspicious command execution patterns in the RunMRU registry key often associated with Lumma Stealer ClickFix delivery using specific executables and unusual character sets.
Detects potentially suspicious child processes spawned by the SSH daemon (sshd) that execute commands using 'bash -c' or 'sh -c' as the root user. This behavior is indicative of potential exploitation of CVE-2024-3094, a backdoor in the XZ Utils library.
Detects an attacker trying to enable the Outlook security setting "EnableUnsafeClientMailRules" which allows Outlook to run applications or execute macros. This setting can be manipulated via the command line, typically through registry modification commands.
Detects a suspicious child process spawning from Microsoft Outlook where the executable image is located on a remote share (SMB/WebDav). This behavior is often associated with adversaries using Outlook to execute malicious code from network shares, potentially as part of persistence or execution techniques.
Detects suspicious PowerShell invocation command parameters indicative of obfuscated or malicious activity, including base64 encoded commands, use of `IEX` (Invoke-Expression) with `New-Object`, encoded commands, attempts to establish persistence via Registry Run keys, and web client downloads.
This rule detects suspicious PowerShell invocations characterized by specific command parameters often used in malicious activities. It looks for combinations of parameters like '-nop', '-w hidden', '-c', and '[Convert]::FromBase64String' for base64 encoded commands; '-w hidden', '-noni', '-nop', '-c', 'iex', and 'New-Object' for obfuscated execution; '-w hidden', '-ep bypass', and '-Enc' for encoded command execution; PowerShell commands interacting with 'reg add' to modify 'Run' keys for persistence; and PowerShell using 'New-Object System.Net.WebClient' with '.Download' for downloading content from the internet, often with 'bypass' and 'hidden' window styles. These patterns are commonly associated with malware, post-exploitation frameworks, and adversary tradecraft.
This analytic identifies internal systems that generate a high volume of intrusion detection events within a 30-minute window, specifically leveraging Cisco Secure Firewall Threat Defense logs. It counts hosts that trigger 15 or more Snort-based signatures. A sudden increase in intrusion alerts from a single host can indicate malicious activity such as malware execution, command-and-control communication, vulnerability scanning, or lateral movement. It may also be caused by misconfigured software. Systems exhibiting this pattern require prompt investigation as repeated Snort rule matches are often early indicators of compromise or active exploitation.
This analytic highlights high-impact intrusion events detected by Cisco Secure Firewall. It leverages Cisco Secure Firewall Threat Defense logs, specifically the IntrusionEvent event type, and focuses on events with an `Impact` score of 1 or 2. If confirmed malicious, these events may indicate a potentially compromised host.
The analytic detects the creation of shadow copies using `vssadmin.exe` or `wmic.exe`. This activity is significant because creating shadow copies can be a precursor to ransomware attacks or data exfiltration, allowing attackers to bypass file locks and access sensitive data. If confirmed malicious, this behavior could enable attackers to maintain persistence, recover deleted files, or prepare for further malicious activities, posing a significant risk to the integrity and confidentiality of the system. Adversaries may create shadow copies to access the NTDS.dit file for credential dumping or to exfiltrate data.
The analytic detects path traversal command-line execution, often used in malicious documents to execute code via msdt.exe for defense evasion. It leverages Endpoint Detection and Response (EDR) data, focusing on specific patterns in process paths. This activity is significant as it can indicate an attempt to bypass security controls and execute unauthorized code. If confirmed malicious, this behavior could lead to code execution, privilege escalation, or persistence within the environment, potentially allowing attackers to deploy malware or leverage other living-off-the-land binaries (LOLBins).
This analytic detects the execution of AdvancedRun.exe, a utility that allows users to run programs with different administrative privileges, user accounts, or environment settings. It identifies the process by its name or original file name and flags common command-line arguments often used for configuration or specific execution parameters. Monitoring this activity is crucial as AdvancedRun can be leveraged by attackers for remote code execution, privilege escalation, or maintaining persistence within an environment, similar to tools like PsExec. If used maliciously, it could enable the execution of arbitrary commands or configuration-based automation.
Page 144 of 155