Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
216 detections
Filters
Last updated
All Time
Detection languages
77
60
14
13
13
Contributors
72
29
26
19
18
Categories
58
58
39
35
28
Platforms
191
12
10
6
5
Products / Services
69
53
12
12
7
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
3
1
1
IDS Protocols
5
Detects processes loading "System.Drawing.ni.dll". This could be an indicator of potential Screen Capture.
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
Intent:
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
- Use MTP capability to look for insider threat potential risk indicators
- Indicators would then serve as the building block for insider threat risk modeling in subsequent tools
Definition of Insider Threat:
"The potential for an individual who has or had authorized access to an organization's assets to use their access, either maliciously or unintentionally, to act in a way that could negatively affect the organization."
This collection of queries describes the different indicators that could be used to model and look for patterns suggesting an increased risk of an individual becoming a potential insider threat.
Note: no single indicator should be used as a lone determinant of insider threat activity, but should be part of an overall program to understand the increased risk to your organization's critical assets. This in turn is used to feed an investigation by a formal insider threat program to look at the context associated with the whole person to understand the implication of a set of indicators.
This YARA rule detects the Skuld infostealer by identifying specific byte patterns associated with its functionalities. These functionalities include retrieving the MAC address of the infected system, enumerating files (likely for data collection), taking screenshots, and specifically targeting Discord backup codes. The rule looks for a combination of these distinct code patterns within a PE file (indicated by the MZ header).
Yara rule that detects Skuld infostealer.
Detects the enabling of the "EnablePeriodicBackup" registry value. Once enabled, The OS will backup System registry hives on restarts to the "C:\Windows\System32\config\RegBack" folder. Windows creates a "RegIdleBackup" task to manage subsequent backups.
Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
Registry backup was a default behavior on Windows and was disabled as of "Windows 10, version 1803".
The analytic detects the creation of files in the Remcos folder within the AppData directory, specifically targeting .dat files which are often used for keylog and clipboard log files by the Remcos RAT. This activity indicates the presence of the Remcos RAT, which performs keylogging, clipboard capturing, and audio recording, potentially leading to unauthorized data exfiltration and extensive surveillance.
Detects the enabling of the Windows Recall feature by manipulating registry keys using `reg.exe`. This rule specifically looks for commands that either delete the `DisableAIDataAnalysis` registry value or set it to `0` within the `Microsoft\Windows\WindowsAI` path, indicating an attempt to activate the Recall feature. This activity is often associated with post-exploitation discovery and collection by adversaries.
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0". Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Detects the enabling of the Windows Recall feature by deleting the "DisableAIDataAnalysis" registry value. Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities. This rule assumes that Recall is already explicitly disabled on the host and is subsequently enabled by an adversary.
Detects the enabling of the Windows Recall feature via registry manipulation.
Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" value, or setting it to 0.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by deleting the existing "DisableAIDataAnalysis" registry value.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Detects the enabling of the Windows Recall feature via registry manipulation. Windows Recall can be enabled by setting the value of "DisableAIDataAnalysis" to "0".
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Adversaries may enable Windows Recall as part of post-exploitation discovery and collection activities.
This rule assumes that Recall is already explicitly disabled on the host, and subsequently enabled by the adversary.
Yara rule that detects MiyaRAT backdoor.
This rule detects the GomorrahStealer infostealer by identifying specific bytecode patterns associated with its capabilities. These capabilities include extracting browser autofill data, browser cookies, taking screenshots, gathering antivirus information, and collecting browser history. The rule looks for the presence of all these distinct bytecode signatures within a file to confirm the presence of GomorrahStealer.
Yara rule that detects GomorrahStealer infostealer.
This YARA rule detects the OrcusRAT backdoor by identifying specific bytecode patterns associated with its functionalities. These functionalities include retrieving TCP connections, gathering operating system information, taking screenshots, extracting passwords, and processing keylogger actions. The rule looks for a combination of these patterns within a file that also has a valid DOS header (MZ signature).
Yara rule that detects OrcusRAT backdoor.
Detects attempts to use the built-in 'screencapture' utility to collect screenshots on macOS systems. This utility can be used by adversaries to gather visual information from a compromised system.
Detects the execution of the Windows Problem Steps Recorder (psr.exe) with command-line arguments indicating a recording start. Psr.exe is a legitimate utility that can be abused by adversaries to capture screen activity, which is a form of information collection.
This rule detects when the "System.Drawing.ni.dll" library is loaded by a process. This DLL is often used for graphical operations, including screen capturing. Its loading can indicate an attempt to capture screen content, which is a common technique used by adversaries for reconnaissance or data exfiltration.
Page 10 of 11