Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
115 detections
Filters
Last updated
All Time
Detection languages
59
19
11
10
6
Contributors
20
19
15
9
7
Categories
53
25
22
20
13
Platforms
47
36
29
12
9
Products / Services
40
9
8
7
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
5
1
IDS Protocols
4
2
The analytic identifies the creation of AWS Batch jobs that could potentially abuse the AWS Bucket Replication feature on S3 buckets. It leverages AWS CloudTrail logs to detect the `JobCreated` event, analyzing job details and their status. This activity is significant because attackers can exploit this feature to exfiltrate data by creating malicious batch jobs. If confirmed malicious, this could lead to unauthorized data transfer between S3 buckets, resulting in data breaches and loss of sensitive information.
This rule detects the execution of specific Windows utilities (`tree.com`, `WMIC.exe`, `doskey.exe`, `sc.exe`) when their output is redirected to a temporary file. This behavior is often associated with adversaries collecting system information or reconnaissance data for later exfiltration or analysis, as indicated by the use of `> %TEMP%\` or `> %TMP%\` in the command line.
This rule detects PowerShell commands that use `Get-ChildItem` with `-Recurse` and `-Include` parameters to search for common document and archive file extensions. This behavior is indicative of an adversary attempting to automatically collect sensitive data from a system or network.
This rule detects PowerShell commands that perform reconnaissance activities (getting services, child items, or processes) and redirect their output to a file in the temporary directory. This behavior is indicative of an adversary collecting internal system information for potential exfiltration or further analysis.
This rule detects the execution of command-line tools like 'dir' or 'findstr' in conjunction with specific file extensions (e.g., .doc, .pdf, .txt) that are commonly associated with sensitive data or credentials. This behavior indicates an attempt at automated collection of data, potentially for exfiltration or further analysis by an adversary. The rule specifically looks for 'dir' commands with '/b' (bare format) and '/s' (subdirectories) flags, or 'findstr' with '/e' (end of line) and '/si' (case-insensitive search for string in files) flags, targeting common document and text file types.
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Once established within a system or network, an adversary may use automated techniques for collecting internal data
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Once established within a system or network, an adversary may use automated techniques for collecting internal data.
Yara rule that detects Kovter ransomware.
Page 6 of 6