Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule detects specific command-line parameters and image paths associated with Mustang Panda droppers. It looks for patterns like 'Temp\wtask.exe /create', specific environment variable manipulations ('%windir:~-3,1%%PUBLIC:~-9,1%', '%windir:~-1,1%'), VBScript execution with file paths containing 'C:\Users\' and '.txt', and the execution of 'Temp\winwsh.exe'. These indicators are characteristic of the dropper stage used by the Mustang Panda APT group.
Detects the execution of binaries located in potentially suspicious locations, specifically within the '/tmp/' directory, using the 'nohup' command. This behavior is often associated with malware attempting to maintain execution even after a user logs off or a session terminates.
Detects executions of scripts located in potentially suspicious locations such as "/tmp" via a shell such as "bash", "sh", etc. This behavior is often associated with malware or adversaries attempting to execute payloads from temporary or user-writable directories.
Detects the execution of suspicious child processes from macOS installer package parent processes. This includes various scripting interpreters like osascript, JXA, and common network utilities like curl and wget, which can be abused during preinstall or postinstall phases of a package installation.
Detects potential suspicious child processes of "jamf". This could indicate the abuse of Jamf as a C2 server, as observed with the Typhon MythicAgent. Specifically, the rule looks for '/bash' or '/sh' being spawned as child processes of the 'jamf' executable.
Detects process activity patterns indicative of the Sliver C2 framework implants. Specifically, it looks for command-line arguments used by Sliver to execute PowerShell with specific encoding settings.
This rule detects suspicious child processes spawned by the VMware Tools daemon (vmtoolsd.exe). Adversaries may leverage vmtoolsd.exe to establish persistence by executing various scripting and command-line interpreters such as cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. The rule specifically filters out legitimate VMware Tools scripts related to power management to reduce false positives.
This rule detects specific command-line executions associated with Mustang Panda's activity, particularly targeting the Australian government, as reported by Lab52. The rule looks for two distinct patterns: the copying of 'SolidPDFCreator.dll' to a specific public user directory, and the modification of the Windows Registry 'Run' key to establish persistence for 'SolidPDF' using the same directory. These actions indicate an attempt to install and persist malicious software.
This rule detects the execution of script files with extensions such as .js, .jse, .vba, .vbe, .vbs, and .wsf by the Windows Script Host executables, Wscript.exe or Cscript.exe. This activity is often associated with malicious script execution, including those delivered via phishing or used in post-exploitation phases.
Detects changes to the EC2 instance startup script (User Data). The shell script will be executed as root/SYSTEM every time the specific instances are booted up, allowing for persistence and execution of arbitrary commands.
Detects when the built-in 'openssl' utility is used on macOS to decode and decrypt a payload, specifically when the command line arguments indicate base64 encoding and decryption, and the input file is located within a '/Volumes/' path. This behavior is often observed in adware or malware families like Bundlore and Shlayer, which use disk images (DMGs) to deliver encoded and encrypted payloads to evade detection and trick users into execution.
Detects various process execution behaviors associated with the Lazarus Group, including attempts to dump SAM registry hive, network connection enumeration using netstat, network share discovery patterns, persistence mechanisms involving common program data directories, and rundll32 execution with specific file extensions.
This rule detects attempts to inject Cross-Site Scripting (XSS) payloads via GET requests in web access logs. It specifically looks for common XSS strings and encoded variations within the request URL, such as '<script>', '<iframe>', '<svg>', 'document.cookie', 'document.domain', 'onerror=', 'onresize=', 'onload=', 'onmouseover=', '${alert', 'javascript:alert', and their URL-encoded forms. The rule filters out requests that result in a 404 HTTP status code to reduce false positives.
Detects a potentially suspicious execution where a parent process located in the "\Users\Public" folder executes a child process that is a common shell or scripting binary, indicated by its image name or command line arguments. This behavior is often associated with malware attempting to hide in a publicly accessible directory and then execute further malicious commands.
Detects process executions characteristic of Formbook malware. Specifically, it looks for processes originating from System32 or SysWOW64 directories with an executable extension, that then execute a command line containing '/c', 'del', and paths within 'C:\Users\<user>\AppData\Local\Temp\' or 'C:\Users\<user>\Desktop\'. It also covers a variant using '/C' and 'type nul >' for deletion on the Desktop. The rule aims to avoid false positives by excluding parent processes with command line parameters, suggesting an injection scenario where the parent process itself doesn't have complex command line arguments.
Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.
Detects the execution of 'curl.exe' with the '-c' flag or '--cookie-jar' option to save cookie data. This activity can be indicative of an attacker attempting to hijack sessions by extracting authentication cookies.
Detects when the Microsoft Management Console (MMC) spawns a Windows shell or command-line executable. This behavior can indicate an adversary abusing the MMC2.0 Application COM object for remote code execution or lateral movement. The rule specifically looks for mmc.exe as the parent process of common shell executables like cmd.exe, powershell.exe, wscript.exe, cscript.exe, reg.exe, regsvr32.exe, or other scripting/command interpreters.
This rule detects suspicious scripting commands within WMI event consumers, which can be indicative of persistence mechanisms. Specifically, it looks for PowerShell web download commands (`new-object net.webclient .downloadstring`, `new-object net.webclient .downloadfile`), common PowerShell execution flags (`-nop`, `-noprofile`, `-decode`, `-enc`), and references to `WScript.Shell` or `System.Security.Cryptography.FromBase64Transform` within the 'Destination' field of WMI event logs. These patterns are frequently used by attackers to execute malicious scripts or download payloads via WMI persistence.
Detects a specific command line argument sequence used by the SNAKE malware during its installation phase, as detailed in a CISA report. The rule looks for a process creation event where the command line contains two specific arguments: the first is a 64-character hexadecimal string (assumed to be a SHA-256 hash), and the second is at least a 16-character hexadecimal string (assumed to be part of an AES initialization vector).
This rule identifies when a new Azure Cloud Shell instance is created within the Azure portal. Cloud Shell provides a browser-based shell experience for managing Azure resources, and its creation could indicate administrative activity, or potentially, an attacker establishing a persistent command-line environment within a compromised Azure subscription.
Page 149 of 155