Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
21
15
4
4
2
Contributors
11
9
7
5
5
Categories
12
11
8
8
8
Platforms
41
4
2
2
1
Products / Services
13
9
8
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects attempts by the Remcos RAT to access audio and video capture devices (camera, microphone) by monitoring process command lines for keywords related to these devices. It also looks for processes initiated by PowerShell or cmd.exe, which are common methods for malware execution.
Detects attempts by the Remcos RAT to access audio and video capture devices (camera, microphone) by monitoring process command lines for keywords related to these devices. It also looks for processes initiated by PowerShell or cmd.exe, which are common methods for malware execution.
Detects an untrusted process creating WAV or compressed audio files in a temporary path after loading multimedia capture components. This behavior is indicative of potential audio surveillance or data collection.
Detects audio capture and exfiltration via RTP media streams
This rule detects potential audio stream exfiltration using the Real-time Transport Protocol (RTP). It specifically looks for UDP traffic with a packet size between 160 and 200 bytes, which is characteristic of some RTP audio streams. A threshold of 100 such packets from the same source within 10 seconds triggers the alert, indicating a sustained audio stream.
Detects the enumeration of camera or microphone hardware using the 'Get-PnpDevice' PowerShell cmdlet. This behavior is a precursor to surveillance activities such as webcam capture or audio recording and has been associated with the Moonrise RAT.
Detects RAT command structure
Audio Capture
Sigma
Detects attempts to record audio using the arecord and ecasound utilities.
Potential adversaries accessing the microphone and webcam in an endpoint.
Detects Processes accessing the camera and microphone from suspicious folder
Detects Processes accessing the camera and microphone from suspicious folder
Detects the execution of Chromium-based browsers with command-line flags that automatically accept camera/microphone access or select desktop capture sources, which can be used for spying.
Detects audio capture via PowerShell Cmdlet.
Detect attacker collecting audio via SoundRecorder application.
Detect attacker collecting audio via SoundRecorder application.
Detects audio capture via PowerShell Cmdlet.
This rule detects rare audio devices used in Zoom meetings by analyzing Zoom logs. It specifically looks for speaker devices that are not commonly observed (e.g., not iPhone, FaceTime, AirPods, or MacBook built-in devices). The intent is to identify unusual device usage that could be indicative of Remote Employment Fraud (REF), where actors might use atypical setups. The rule uses a 'rare' command to find the top 50 least frequent speaker devices after filtering out common ones.
This rule detects rare video devices used during Zoom meetings. The intent is to identify unusual device information that might be associated with actors performing Remote Employment Fraud (REF). The rule filters out common devices like iPhones, FaceTimes, AirPods, and MacBooks to focus on less common camera, speaker, and microphone devices. Detecting this activity requires careful analysis, regular review, and a thorough understanding of the audio and video devices commonly used within an environment.
This rule detects rare input devices (microphones) used during Zoom meetings. It specifically looks for microphone devices that are not commonly observed, while excluding typical devices like iPhones, FaceTimes, AirPods, and MacBooks. The primary goal is to identify unusual device usage that could be indicative of Remote Employment Fraud (REF), where actors might use non-standard equipment. This is a hunting query designed to flag anomalies for further investigation.
Detects attempts to record audio using the `arecord` and `ecasound` utilities on Linux systems. This rule specifically looks for the execution of `arecord` with common audio recording flags (`-vv`, `-fdat`) or the `ecasound` utility making a `memfd_create` syscall, which could indicate audio processing or recording.
This analytic detects the creation of .wav files in the AppData\Roaming folder, a behavior associated with Remcos RAT malware. Remcos RAT is known to store audio recordings in this location for data exfiltration. The detection leverages endpoint process and filesystem data to identify this activity. This activity is significant as it indicates potential unauthorized data collection and exfiltration by malware, which could lead to sensitive information being sent to an attacker's command and control server, compromising the affected system's confidentiality.
Page 2 of 3