Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects instances where 'cmd.exe' is spawned by a parent process that is considered unusual or suspicious. The rule specifically lists a set of parent processes that are generally not expected to launch 'cmd.exe' in a typical operating environment. This could indicate malicious activity such as an attacker attempting to execute commands via a compromised legitimate process or a process that has been hijacked.
Detects the creation of specific files within the SysAidServer Tomcat webapps directory, which are indicators associated with the Lace Tempest threat group (also known as FIN7). The rule looks for specific filenames and suffixes that have been observed in attacks involving PowerShell scripts by this group.
This rule detects a specific command-line execution pattern used by the threat actor 'Lace Tempest' to download 'Cobalt Strike'. The pattern involves PowerShell's 'IEX ((new-object net.webclient).downloadstring(' command, which is commonly used for in-memory execution of downloaded scripts or payloads. The detection specifically looks for the combination of '-nop -w hidden -c IEX ((new-object net.webclient).downloadstring(' and '/a') in the command line, indicating an attempt to download and execute a script, likely a Cobalt Strike payload, as reported by the SysAid Team.
Detects the usage of the "Import-Module" cmdlet or its alias "ipmo" in PowerShell command lines to add new Cmdlets to the current PowerShell session. This rule aims to identify instances where modules are dynamically loaded, which can be a legitimate administrative action but also a technique used by adversaries for execution or privilege escalation.
Detects PowerShell commands that decrypt an ".LNK" file to drop the next stage of the malware. The rule specifically looks for PowerShell execution combined with command-line arguments indicative of file system enumeration (Get-ChildItem, dir, gci, ls), file content retrieval (Get-Content, gc, cat, type, ReadAllBytes), and specific patterns involving ".lnk" files, recursion, skipping bytes, expanding properties, and writing all bytes, suggesting decryption and dropping of subsequent malware stages.
This rule detects the usage of the Windows Package Manager (winget.exe) to add new package sources, specifically looking for command-line arguments that include 'source add' and an IP address as the source. This could indicate an attempt to introduce a malicious or untrusted package repository.
Detects suspicious parent process for cmd.exe
Detects the use of "vim" and its sibling commands (rvim, vimdiff) to execute a shell or proxy commands. This behavior can be indicative of privilege escalation, unauthorized command execution, or attempts to break out of restricted environments by leveraging the capabilities of these text editors to run arbitrary commands or scripts (e.g., via :!/, :lua, :py, or direct shell calls).
Detects the redirection of discovery command output by the Ursnif malware. Specifically, it looks for `cmd.exe` processes spawned by `explorer.exe` that execute a command with `/C ` and redirect its output to a `.bin` file in the `AppData\local\temp\` directory.
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands. Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Detects the execution of "csc.exe" by the "w3wp.exe" process, specifically looking for patterns indicative of the MOVEit Transfer CVE-2023-34362 exploitation. This activity is associated with dynamic compilation of malicious DLL files within the .NET framework temporary ASP.NET files directory.
This rule detects attempts to use obfuscated or encoded IP addresses (e.g., hexadecimal, octal, or URL-encoded formats) within command-line arguments of `ping.exe` or `arp.exe`. This technique can be used by adversaries to evade simple string-based detections or to obscure their network communication targets.
This rule detects the execution of a binary that has been renamed from its original 'CURL.exe' name. It identifies this by checking the 'OriginalFileName' and 'Description' fields within the executable's PE metadata. The rule specifically triggers if these fields indicate 'curl.exe' or 'The curl executable', but the actual image path does not contain '\curl', suggesting an attempt to evade detection by renaming the legitimate curl utility.
Detects potential exploitation attempts of CVE-2022-29072, a 7-Zip privilege escalation and command execution vulnerability. This vulnerability affects 7-Zip version 21.07 and earlier on Windows, allowing privilege escalation and command execution when a file with the .7z extension is dragged to the Help>Contents area. This is caused by misconfiguration of 7z.dll and a heap overflow. The rule specifically looks for child processes like cmd.exe, powershell.exe, or pwsh.exe being spawned under the 7zFM.exe process, excluding common command line arguments or file extensions that might indicate legitimate usage.
Yara rule that detects GTPDOOR backdoor.
Detects the execution of the "wusa.exe" (Windows Update Standalone Installer) utility to extract ".cab" files using the "/extract" argument from potentially suspicious paths like PerfLogs, Users\Public, Windows\Temp, or Appdata\Local\Temp. This activity can be indicative of malware unpacking or staging.
This rule detects specific command-line activities associated with the Turla APT group's lateral movement and discovery tactics. It looks for the use of 'net use' to connect to administrative shares (specifically C$) with a hardcoded password, and 'dir' commands used for file and directory discovery, targeting document files and executables in the TEMP directory. These commands are indicative of an adversary attempting to move laterally within a network and gather information about the environment.
Detects specific command-line patterns and process image paths associated with the REvil ransomware group's attack on Kaseya VSA. The rule looks for execution of 'cert.exe' and 'MsMpEng.exe' from unusual paths, as well as specific file deletion commands and references to 'Kaseya VSA Agent Hot-fix' and 'agent.exe'/'agent.crt' in 'kworking' or 'kworking1' directories, which were observed during the Kaseya supply chain incident.
This rule detects when the macOS Script Editor application spawns child processes that are commonly used for malicious activities. Specifically, it looks for the Script Editor launching shell interpreters (bash, sh, zsh, dash, fish), scripting languages (python, perl, php, osascript), or utilities often leveraged in attack chains (curl, mktemp, chmod, nohup, openssl, plutil, PlistBuddy, xattr, sqlite, funzip, popen). This behavior can indicate an adversary using AppleScript or other scripting capabilities within Script Editor to execute arbitrary commands, download payloads, or manipulate system configurations.
This rule detects the execution of Gpg4win's GnuPG tool (gpg.exe or gpg2.exe) when it is used to encrypt files. The detection specifically looks for command-line arguments that indicate file encryption ('-c') and the use of a passphrase ('passphrase'). This activity can be indicative of malicious actors encrypting data for exfiltration or to render it inaccessible.
Detects the creation of a new named pipe using the "mkfifo" utility in a potentially suspicious location, specifically within the /tmp/ directory. Named pipes can be used for inter-process communication and their creation in temporary directories might indicate malicious activity such as local privilege escalation or data exfiltration.
Page 148 of 155