Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,240 detections
Filters
Last updated
All Time
Detection languages
1,690
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,253
2,024
730
384
305
Platforms
2,613
886
443
69
43
Products / Services
938
630
365
186
163
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
3,240
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This rule identifies execution traces indicative of the XCSSET macOS malware. XCSSET is known to spread via Xcode projects and maliciously modify applications. The rule looks for specific command-line patterns involving 'curl' to suspicious URLs, 'osacompile' and 'plutil' interacting with user and group containers, and 'zip' archiving data from user and group containers. These activities suggest potential command and control communication, persistence mechanisms, and data staging/exfiltration by the malware.
Detects suspicious child processes spawned by the "Manage Engine ServiceDesk Plus" Java web service. This often indicates successful exploitation of the application, potentially related to vulnerabilities like CVE-2022-47966. The rule looks for the execution of various system utilities and scripting interpreters commonly used by attackers for reconnaissance, privilege escalation, defense evasion, or establishing command and control.
Detects when a Java process spawns suspicious child processes, specifically various shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), or common command-line tools like curl, wget, and python. This behavior can indicate a Java application being exploited to execute arbitrary commands on the system.
Detects the creation of suspicious executable or script files within the OneNote temporary directory, indicating potential malware delivery and execution via malicious OneNote attachments. This behavior has been observed in recent malware campaigns leveraging OneNote files.
This rule detects the use of weak or commonly abused passwords directly within command-line interfaces. Threat actors often use this method to create new user accounts with easily guessable or known compromised passwords. The rule specifically looks for a predefined list of weak passwords appearing in the command line of a process creation event.
Detects the creation of script files (JSE, VBE, JS, VBA, VBS) in common user or program data directories by wscript.exe or cscript.exe. This behavior is often associated with malware droppers or initial access techniques.
Detects the execution of a Chromium-based browser process with the "--headless" flag and a URL pointing to mockbin.org or run.mocky.io. This activity can indicate an attempt to exfiltrate data or use the browser in an automated, potentially malicious, fashion without a visible user interface.
Detects the creation of a "Report.wer" file in an uncommon folder structure, specifically outside of the typical Windows Error Reporting (WER) archive paths. This activity could indicate potential exploitation of CVE-2023-36874, where adversaries might manipulate WER to achieve execution or persistence.
This rule detects the creation of suspicious file types (e.g., executables, scripts, archives) within the `C:\PerfLogs\` directory. This directory is typically used for performance logs and primarily contains `.etl` files. The presence of other executable or script file types in this location is highly unusual and can indicate malicious activity, such as staging for execution, persistence, or data exfiltration.
This rule detects suspicious patterns in program names or command-line arguments that are commonly associated with malicious samples, hacktools, or exploit kits. It looks for specific keywords and file names in the 'Image' (executable path) and 'CommandLine' fields. Examples include CVE-related strings, common exploit/artifact names like 'poc.exe', 'meterpreter', and various PowerShell scripts often used in post-exploitation such as 'inject.ps1', 'Invoke-CVE', 'mimikatz.ps1', and 'powercat.ps1'.
Detects processes loading modules related to the PCRE.NET package, specifically looking for a unique temporary path often associated with its deployment. This could indicate the execution of code leveraging this package, potentially for malicious purposes like regular expression-based obfuscation or payload delivery.
Detects when a Microsoft Office application (Excel, Publisher, Outlook, OneNote, PowerPoint, Word) loads a PowerShell core DLL. This behavior is highly suspicious as Office applications typically do not need to load PowerShell DLLs, and it can indicate an attempt to execute PowerShell code within the context of a trusted Office application, potentially for defense evasion or malicious scripting.
Detects the execution of FSharp Interpreters "FsiAnyCpu.exe" and "FSi.exe". These interpreters can be used by adversaries for application whitelisting bypass and to execute F# code via scripts or inline, potentially for malicious purposes.
Detects execution of commands and binaries from the context of the Program Compatibility Assistant (Pcalua.exe). This can be used as a Living Off The Land Binary (LOLBIN) to bypass application whitelisting.
This rule detects suspicious child processes spawned by Electron-based applications such as Microsoft Teams, Discord, Slack, GitHub Desktop, Keybase, and web browsers like Edge. The detection logic focuses on the creation of common command-line interpreters and scripting engines (e.g., cmd.exe, powershell.exe, cscript.exe, wscript.exe, mshta.exe, regsvr32.exe, whoami.exe) or execution from suspicious temporary or user-writable paths (e.g., ProgramData, Temp, AppData\Local\Temp, Users\Public). This behavior could indicate `.asar` file tampering, where an attacker modifies the application's bundled resources to execute malicious code, or the use of these legitimate applications as execution proxies for arbitrary commands. The rule specifically filters out a known legitimate Discord behavior involving `cmd.exe` and `nvidia-smi.exe` to reduce false positives.
This rule detects the presence of a Base64 encoded MZ header within a command line. The MZ header is characteristic of Windows executable files. Its appearance in a command line, especially in a Base64 encoded format, often indicates an attempt to execute malicious code or a payload that has been obfuscated to evade detection. This technique is commonly used by attackers to deliver and execute malware.
This rule detects suspicious network scanning activity by identifying command-line executions that combine looping constructs ('for', 'foreach') with network discovery tools ('nslookup', 'ping'). This pattern is often used by adversaries to enumerate systems on a network for lateral movement or further reconnaissance.
Detects suspicious execution of "PDQDeployRunner" which is part of the PDQDeploy service stack that is responsible for executing commands and packages on remote machines. The rule specifically looks for PDQDeployRunner spawning suspicious child processes, executing commands with suspicious arguments, or executing from suspicious paths, which could indicate abuse for malicious purposes.
Detects the use of the built-in Windows utility 'query.exe' to extract information about active user sessions or running processes. This activity can be indicative of an attacker performing reconnaissance or staging data for exfiltration.
This rule detects the execution of `fsutil.exe` with specific command-line arguments to set `SymlinkEvaluation`. This action can be used by adversaries, such as ransomware, to enable symbolic link following, potentially allowing them to access and encrypt files through shortcuts or junctions that would otherwise be inaccessible.
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
Page 151 of 155