Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
644 detections
Filters
Last updated
All Time
Detection languages
237
196
93
34
26
Contributors
178
129
64
62
42
Categories
214
185
178
157
144
Platforms
507
161
73
9
8
Products / Services
123
72
48
45
35
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
3
3
2
1
1
IDS Classtypes
2
1
1
IDS Protocols
3
1
Yara rule that detects Skuld infostealer.
Yara rule that detects VanHelsing ransomware.
Detects suspicious commands as identified in CISA Living off the Land pdf. Alone they may be normal but in concert, they may be worth looking into
The following analytic detects suspicious database file and directory discovery activities, which may signal an attacker attempt to locate and assess critical database assets on a compromised system. This behavior is often a precursor to data theft, unauthorized access, or privilege escalation, as attackers seek to identify valuable information stored in databases. By monitoring for unusual or unauthorized attempts to locate database files and directories, this analytic aids in early detection of potential reconnaissance or data breach efforts, enabling security teams to respond swiftly and mitigate the risk of further compromise.
The following analytic detects the use of the Certipy tool to enumerate Active Directory Certificate Services (AD CS) environments by identifying unique file modifications. It leverages endpoint process and filesystem data to spot the creation of files with specific names or extensions associated with Certipy's information gathering and exfiltration activities. This activity is significant as it indicates potential reconnaissance and data exfiltration efforts by an attacker. If confirmed malicious, this could lead to unauthorized access to sensitive AD CS information, enabling further attacks or privilege escalation within the network.
The analytic identifies the creation of a suspicious file named 'win.dat' in the root directory (C:\). This behavior is significant as it is commonly used by malware like NjRAT to check for administrative privileges on a compromised host. If confirmed malicious, this activity could indicate that the malware has administrative access, allowing it to perform high-privilege actions, potentially leading to further system compromise and persistence.
This analytic detects suspicious discovery of virtual disk files and directories on Linux systems. It specifically looks for command-line executions using `find` or `grep` that target common virtual disk file extensions such as `.vhd`, `.vhdx`, and `.vmdk`. This activity may indicate an attacker's attempt to locate and access virtualized storage environments, which could contain sensitive data or critical system configurations. Unauthorized discovery attempts could signify preparatory actions for data exfiltration or further compromise, enabling security teams to identify potential reconnaissance activities and respond promptly.
This analytic detects suspicious attempts to find private keys and certificates on Linux systems, which may indicate an attacker's effort to access sensitive cryptographic information. Private keys are crucial for securing encrypted communications and data, and unauthorized access to them can lead to severe security breaches, including data decryption and identity theft. By monitoring for unusual or unauthorized searches for files with common private key and certificate extensions using commands like 'find' or 'grep', this analytic helps identify potential threats to cryptographic security, enabling security teams to take swift action to protect the integrity and confidentiality of encrypted information.
Yara rule that detects wmRAT backdoor.
Detects the execution of Notepad to open a file that has the string "password" in its name and a common extension (txt, csv, doc, xls). This activity may indicate unauthorized access to credentials or suspicious reconnaissance.
Detects the execution of Notepad to open a file that has the string "password" which may indicate unauthorized access to credentials or suspicious activity.
Detects the use of common Linux utilities such as 'find', 'tree', 'findmnt', 'ls -R', and 'mlocate' for discovering files, directories, and potentially network shares. This activity is often performed by adversaries to gain situational awareness of the file system.
Detects the execution of PCHunter, a powerful system utility similar to Process Hacker, which can be used to view and manipulate processes, kernel options, and other low-level system aspects. Its use by unauthorized personnel can indicate malicious activity, system reconnaissance, or attempts to tamper with system internals.
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
This YARA rule detects the Cicada3301 ransomware by identifying specific byte patterns (signatures) within executable files. The rule looks for distinct code sequences related to enumerating valid drives, recursively collecting files, and encrypting files. It includes multiple parts for file collection and two versions of file encryption routines, indicating a robust detection mechanism for different variants or stages of the ransomware's operation. The presence of these patterns strongly suggests the file is a Cicada3301 ransomware sample.
Yara rule that detects Cicada3301 ransomware.
Detects the use of the "apt" and "apt-get" commands to execute a shell or proxy commands.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
Such behavior may be associated with privilege escalation, unauthorized command execution, or to break out from restricted environments.
This rule detects specific command-line activities associated with the Turla APT group's lateral movement and discovery tactics. It looks for the use of 'net use' to connect to administrative shares (specifically C$) with a hardcoded password, and 'dir' commands used for file and directory discovery, targeting document files and executables in the TEMP directory. These commands are indicative of an adversary attempting to move laterally within a network and gather information about the environment.
Detects the usage of the 'find' command on macOS with specific permission-related arguments. These arguments are often used by attackers during discovery phases to locate files with unusual permissions, such as SUID/SGID binaries or world-writable files, which could indicate potential privilege escalation vectors or misconfigurations.
This rule detects various discovery commands commonly used on Cisco network devices. These commands are often used by adversaries to gather information about the network topology, device configuration, running processes, user sessions, and system details. The rule specifically looks for keywords associated with commands like 'dir' (file/directory listing), 'show arp' (ARP cache), 'show cdp' (Cisco Discovery Protocol neighbors), 'show clock' (system time), 'show ip interface' (IP interface configuration), 'show ip route' (routing table), 'show ip sockets' (network connections), 'show processes' (running processes), 'show ssh' (SSH sessions), 'show users' (logged-in users), and 'show version' (system information).
Page 22 of 31