Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
522 detections
Filters
Last updated
All Time
Detection languages
274
88
34
34
26
Contributors
144
82
54
25
22
Categories
350
258
247
69
63
Platforms
404
216
113
16
9
Products / Services
149
114
100
31
30
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
14
4
3
3
3
IDS Classtypes
7
2
1
1
IDS Protocols
11
Detect run not allowed files. Applocker is a very useful tool, especially on servers where unprivileged users have access. For example terminal servers. You need configure applocker and log collect to receive these events.
Detects potential exploitation attempt of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager.
As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.
As reported by Morphisec, part of the attack chain, threat actors used PowerShell commands that executed as a child processes of the legitimate Tomcat "prunsrv.exe" process application.
Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe
This query was originally published in the threat analytics report, Python abuse on macOS
The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
The following query checks for Microsoft Office documents that run Python scripts.
Reference - https://www.powershellempire.com/
The Python programming language comes bundled with macOS. In threat intelligence gathered from macOS endpoints, we have observed numerous attacks run with EmPyre, a Python-based post-exploitation framework similar to PowerShell Empire for Windows.
The following query checks for Microsoft Office documents that run Python scripts.
Reference - https://www.powershellempire.com/
BazaCall is a campaign that manipulate users into calling a customer support center, where they are instructed to download an Excel file to unsubscribe from a phony service. When the user opens the Excel file, they are prompted to enable a malicious macro that infects their device with BazaLoader.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
This query surfaces connections to the distinctive .xyz domains that the BazaCall campaign uses to host malicious Excel files.
Detects the execution of known attacker tools, specifically those associated with the IronSharpPack toolset. This rule identifies process launches where common command and scripting interpreters (cmd.exe, python, ipy.exe, powershell.exe, pwsh.exe, wsl.exe) are used to execute scripts or binaries with names indicative of IronSharpPack components. The presence of these tools in an unauthorized environment suggests malicious activity, often related to offensive security operations, post-exploitation, or privilege escalation.
Detects the creation of Python path configuration files (.pth) within Python library folders on Windows systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically targets files ending with '.pth' in paths matching '\(venv|python(.+)?)\lib\site-packages\', while filtering out known legitimate .pth files like 'pywin32.pth' and 'distutils-precedence.pth'.
Detects the creation of Python path configuration files (.pth) within Python library folders on macOS. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are explicitly imported by a script. The rule specifically looks for files ending with '.pth' in the '/lib/python3.([5-9]|[0-9]{2})/site-packages/' directory structure.
Detects the creation of Python path configuration files (.pth) within Python library folders on Linux systems. These files can be maliciously used for code execution and persistence, as modules referenced by them are executed at every Python startup (v3.5+), regardless of whether they are imported by the calling script. The rule specifically looks for files ending with '.pth' in typical Python site-packages directories.
Detects a Python process attempting to spawn a pseudo-terminal (TTY) using the `pty` module. This behavior is often indicative of an attacker establishing a reverse shell for interactive command execution on a compromised system. The rule specifically looks for Python executables and command-line arguments that import the `pty` module and call its `spawn` function.
Detects the execution of Python code that imports the 'pty' and 'socket' modules and uses 'spawn' and '.connect' functions, which is a common pattern for establishing a reverse shell.
Detects potential exploitation attempts of CVE-2022-22954, a remote code execution vulnerability in VMware Workspace ONE Access and Identity Manager. The rule specifically looks for PowerShell or cmd.exe processes being spawned as child processes of the legitimate Tomcat "prunsrv.exe" process, which was observed as part of the attack chain by Morphisec.
Detects suspicious shell commands commonly used in various exploit codes, including those associated with Apache Struts vulnerabilities and Metasploit framework activities. The rule looks for patterns indicative of downloading and executing scripts, setting up reverse shells, or modifying file permissions for persistence or privilege escalation.
Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.
This rule detects potential exploitation of CVE-2023-21554, dubbed 'QueueJumper'. The vulnerability allows for unauthorized remote code execution within the MSMQ service. The rule specifically looks for the 'mqsvc.exe' process (Microsoft Message Queuing service) spawning common Windows command-line interpreters or scripting engines, which would indicate an attempt to execute arbitrary code.
Detects when a Java process spawns suspicious child processes, specifically various shell interpreters (sh, bash, dash, ksh, zsh, csh, fish), or common command-line tools like curl, wget, and python. This behavior can indicate a Java application being exploited to execute arbitrary commands on the system.
This rule detects executable files created in the Downloads folder that lack common file metadata fields such as FileVersion, Description, Product, or Company. This characteristic is often observed in executables generated by tools like py2exe, which can be used by adversaries to package Python scripts into standalone executables, potentially for malicious purposes. The rule specifically looks for the absence of these fields (indicated by a '?' in the rule logic) in conjunction with the file being located in a user's Downloads directory.
Detects the execution of Python with command-line arguments that indicate an attempt to spawn a pseudo-terminal (TTY). This technique is often used by attackers to gain an interactive shell, especially in compromised environments where direct shell access might be restricted. The rule specifically looks for Python executable names combined with command-line patterns like 'import pty', '.spawn(', or 'from pty import spawn'.
Page 25 of 25