Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
52 detections
Filters
Last updated
All Time
Detection languages
21
15
4
4
2
Contributors
11
9
7
5
5
Categories
12
11
8
8
8
Platforms
41
4
2
2
1
Products / Services
13
9
8
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
This YARA rule detects the MiyaRAT backdoor by identifying specific byte patterns associated with its functionalities. The rule looks for distinct code sequences related to obtaining disk information, gathering operating system details, and taking screenshots. The presence of all these patterns within a single executable indicates the presence of MiyaRAT.
Detects instances where an SIP service on an OpenCanary node has had a SIP request.
This rule detects suspicious access to the camera and microphone by processes running from unusual or temporary locations. It monitors registry events related to the CapabilityAccessManager ConsentStore for non-packaged applications. Specifically, it looks for modifications to registry keys that indicate access to 'microphone' or 'webcam' from paths like temporary folders, the Recycle Bin, or public user directories. This behavior can be indicative of malware attempting to record audio or video without user consent.
This rule detects attempts by processes to access the microphone and webcam by monitoring specific registry key access events. It looks for EventIDs 4657, 4656, or 4663 associated with registry paths related to the Windows Capability Access Manager's consent store for microphone and webcam access by non-packaged applications. This can indicate an adversary attempting to collect audio or video from the endpoint.
This rule detects the execution of the Windows built-in SoundRecorder.exe application when it is used with the '/FILE' command-line argument. This specific command-line argument indicates that SoundRecorder is being used to capture audio and save it to a file, which is a common technique used by attackers for audio surveillance.
Detects attempts to capture audio using PowerShell cmdlets, specifically looking for commands related to the 'WindowsAudioDevice-Powershell-Cmdlet' module or similar audio device manipulation cmdlets. This activity could indicate an adversary attempting to record sensitive conversations or gather information from the compromised system's environment.
Detects Processes accessing the camera and microphone from suspicious folder
Potential adversaries accessing the microphone and webcam in an endpoint.
Detects audio capture via PowerShell Cmdlet.
Detect attacker collecting audio via SoundRecorder application.
Page 3 of 3