Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
257 detections
Filters
Last updated
All Time
Detection languages
113
59
26
14
14
Contributors
78
29
27
23
19
Categories
169
136
66
57
39
Platforms
206
22
19
9
2
Products / Services
96
53
31
25
11
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
Detects PowerShell execution spawning 7zr.exe to extract password-protected 7z archives using overwrite and password switches within a specified timeframe, or referencing specific malicious IOC file names and domains.
Detects PowerShell launched hidden and non-interactive with an insecure execution policy and Base64 decode-and-execute, or a script combining Base64 decode-and-execute with browser history collection and WMI shadow copy enumeration, as seen in the Midnight Blizzard (GTG-20006) stager.
Detects PowerShell execution involving Base64 decoding or certutil decoding combined with writing files to the AppData directory using .NET I/O methods or PowerShell cmdlets.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Detects usage of expand.exe to extract Microsoft Cabinet (CAB) archives, with
emphasis on extractions into `C:\\ProgramData` or similar staging locations. In
recent APT37 activity, a CAB payload (e.g., wonder.cab) was expanded into
ProgramData prior to persistence and execution. This behavior is a strong signal
for ingress tool transfer and staging of payloads.
emphasis on extractions into `C:\\ProgramData` or similar staging locations. In
recent APT37 activity, a CAB payload (e.g., wonder.cab) was expanded into
ProgramData prior to persistence and execution. This behavior is a strong signal
for ingress tool transfer and staging of payloads.
The following analytic detects the behavior of decoding base64-encoded data and passing it to a Linux shell. Additionally, it mitigates the potential damage and protects the organization's systems and data.The detection is made by searching for specific commands in the Splunk query, namely "base64 -d" and "base64 --decode", within the Endpoint.Processes data model. The analytic also includes a filter for Linux shells. The detection is important because it indicates the presence of malicious activity since Base64 encoding is commonly used to obfuscate malicious commands or payloads, and decoding it can be a step in running those commands. It suggests that an attacker is attempting to run malicious commands on a Linux system to gain unauthorized access, for data exfiltration, or perform other malicious actions.
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving CertUtil.exe. This activity is significant because attackers often use CertUtil to decode malicious files downloaded from the internet, which are then executed to compromise the system. If confirmed malicious, this activity could lead to unauthorized code execution, further system compromise, and potential data exfiltration.
Detects execution of shell commands containing obfuscated patterns (such as base64 decoding, hex character sequences, or piped commands) when spawned by core Citrix NetScaler service processes (nsppe, httpd, or nsaaad). This behavior is often indicative of exploitation attempts or post-exploitation activities on network appliances.
Detects unauthorized access to DPAPI master key files located in the Windows user profile (%APPDATA%\Microsoft\Protect\). This activity is commonly associated with infostealers attempting to decrypt browser-stored credentials (cookies, passwords) by manually accessing the master key files after exfiltrating encrypted data stores.
Detects suspicious PowerShell process creation patterns often associated with malicious activity. The rule identifies PowerShell execution invoked by common parent processes (like Office applications or scripting engines) or using highly suspicious command-line arguments such as encoded commands, hidden windows, or common download and execution patterns (e.g., IEX, WebClient).
Detects the execution of the encryptbase64.ps1 PowerShell script when invoked by a process other than PowerShell or PowerShell Core. This behavior is indicative of NeedyMantis malware attempting to evade detection by executing scripts outside standard script hosts.
Detects the use of certutil.exe to decode files located within directories associated with the MSSQL service account (e.g., AppData, ServiceProfiles). This behavior is characteristic of an attack chain where an adversary uses SQL Server's xp_cmdshell to stage and decode a malicious payload from a base64-encoded file.
Detects the suspicious execution of common Windows system binaries (LOLBAS) often used for proxying malicious code execution or deobfuscating payloads. This includes regsvr32.exe for remote scriptlet execution, mshta.exe for remote HTA execution, rundll32.exe for JavaScript or DLL function execution, and certutil.exe for decoding or retrieving remote files.
Detects DB/DLL files masquerading as legitimate components that embed an XOR-encrypted PE (SectopRAT payload) or the sdkcra.dll loader export used in the FrameworkBase.dll tampered-IAT chain
This rule detects potential malicious activity where a file (in this case, a PDF) is downloaded using curl via conhost, followed shortly by a PowerShell command that searches the file for a specific marker ("cAB") and decodes/executes embedded Base64 content. This pattern aligns with known TTPs observed in Star Blizzard (COLDRIVER) campaigns.
This rule detects non-browser processes that simultaneously access a web browser's 'Local State' file and the Windows DPAPI master key storage directory. This behavior is a common precursor to credential dumping, as adversaries must decrypt browser-protected secrets (passwords and cookies) using DPAPI keys stored in the user's profile.
Detects unauthorized non-browser processes attempting to access Chrome browser master keys or bypass App-Bound Encryption by interacting with the Chrome IElevator service, DPAPI routines, or the 'Local State' configuration file. This behavior is indicative of infostealer activity aiming to decrypt browser-stored session cookies and credentials.
Detects suspicious PowerShell process creation patterns often associated with malicious activity. The rule identifies PowerShell execution invoked by common parent processes (like Office applications or scripting engines) or using highly suspicious command-line arguments such as encoded commands, hidden windows, or common download and execution patterns (e.g., IEX, WebClient).
Detects the use of legitimate Windows system utilities certutil.exe and bitsadmin.exe to perform remote file downloads or decode remote content. Adversaries often use these dual-use tools to bypass network security controls by masquerading as standard system processes for staging second-stage payloads.
Page 1 of 13