Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
694 detections
Filters
Last updated
All Time
Detection languages
267
179
70
42
40
Contributors
200
97
66
47
34
Categories
441
397
254
82
78
Platforms
598
233
198
21
5
Products / Services
192
161
157
68
41
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
6
3
2
2
2
IDS Classtypes
6
3
1
1
IDS Protocols
9
1
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Detects remote thread creation from CACTUSTORCH as described in references.
'Identifies a match for SQL Injection attack in the Application gateway WAF logs. The Threshold value in the query can be changed as per your infrastructure's requirement.
References: https://owasp.org/Top10/A03_2021-Injection/'
References: https://owasp.org/Top10/A03_2021-Injection/'
Adwind RAT / JRAT
Sigma
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Detects wscript/cscript executions of scripts located in user directories
Detects script file execution (.js, .jse, .vba, .vbe, .vbs, .wsf) by Wscript/Cscript
Detects execution of mshta.exe with file types that looks like they do not typically represent HTA (HTML Application) content,
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
such as .png, .jpg, .zip, .pdf, and others, which are often polyglots. MSHTA is a legitimate Windows utility for executing HTML Applications
containing VBScript or JScript. Threat actors often abuse this lolbin utility to download and
execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Detects command line parameters used by Koadic hack tool
Detects a file ending in jse, vbe, js, vba, vbs written by cscript.exe or wscript.exe
Finding base64 encoded PE files header seen in the command line parameters.
Tags: #fileLess #powershell.
Tags: #fileLess #powershell.
Detects Wscript/Cscript executing a file with an uncommon (i.e. non-script) extension
Detects the execution of other scripts using the Node executable packaged with Adobe Creative Cloud
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
StrRAT is a Java-based remote access tool which steals browser credentials, logs keystrokes and take remote control of infected systems. It also has a module to download additional payload onto to the infected machine based on C2 server command. Additionally, this threat also has a ransomware encryption/decryption module which appends .crimson extension.
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
This query surfaces alerts related to Gootkit and enriches with command and control information, which has been observed delivering ransomware.
Page 31 of 34