Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
257 detections
Filters
Last updated
All Time
Detection languages
113
59
26
14
14
Contributors
78
29
27
23
19
Categories
169
136
66
57
39
Platforms
206
22
19
9
2
Products / Services
96
53
31
25
11
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Detects usage of a base64 encoded "FromBase64String" cmdlet in a process command line
Detects command line patterns used by BlackByte ransomware in different operations
Detects usage of the "FromBase64String" function in the commandline which is used to decode a base64 encoded string
Ping Hex IP
Sigma
Detects a ping command that uses a hex encoded IP address
'Identifies instances of a base64 encoded PE file header seen in the process command line parameter.
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
To use this analytics rule, make sure you have deployed the [ASIM normalization parsers](https://aka.ms/ASimProcessEvent)'
This query was originally published in the threat analytics report, OSX/SurfBuyer adware campaign.
It will return results if a shell script has furtively attempted to decode and save a file to a /tmp folder.
If discovered on your system, this kind of activity might be associated with SurfBuyer, which is adware that installs a browser extension to take control of several major web browsers, including Safari, Google Chrome, and Firefox.
It will return results if a shell script has furtively attempted to decode and save a file to a /tmp folder.
If discovered on your system, this kind of activity might be associated with SurfBuyer, which is adware that installs a browser extension to take control of several major web browsers, including Safari, Google Chrome, and Firefox.
This query was originally published in the threat analytics report, OSX/Shlayer sustains adware push.
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Shlayer is adware that spies on users' search terms, and redirects network traffic to serve the user attacker-controlled search results containing ads.
The following query locates activity associated with the Shlayer payload decrypter.
Reference - https://www.intego.com/mac-security-blog/osxshlayer-new-mac-malware-comes-out-of-its-shell/
Detects the execution of mshta.exe with command-line arguments that include file extensions not typically associated with HTML Application (HTA) content, such as image files (.png, .jpg), archives (.zip), documents (.pdf), and others. This behavior is often indicative of adversaries abusing mshta.exe, a legitimate Windows utility, to execute malicious scripts disguised as benign files or hosted under misleading extensions to evade detection.
This rule detects the use of the '::FromBase64String(' function in a command line, which is a common method for decoding Base64 encoded strings in PowerShell. Adversaries often use Base64 encoding to obfuscate malicious commands or payloads, making them harder to detect by signature-based defenses. This detection aims to identify attempts to deobfuscate such encoded content, typically as part of a larger attack chain involving defense evasion and execution.
This rule detects PowerShell commands that utilize encoded arguments such as '-enc', '-ec', or '-en'. Adversaries often use encoded PowerShell commands to obfuscate their malicious scripts, making it harder for security tools and analysts to detect and understand their activities. The rule specifically looks for the execution of 'powershell.exe' or 'powershell_ise.exe' with these encoding flags and attempts to capture and decode the obfuscated command.
Detects encoded powershell commands
The analytic detects suspicious Base64 decode operations that may indicate malicious activity, such as data exfiltration or execution of encoded commands. Base64 is commonly used to encode data for safe transmission, but attackers may abuse it to conceal malicious payloads. This detection focuses on identifying unusual or unexpected Base64 decoding processes, particularly when associated with critical files or directories. By monitoring these activities, the analytic helps uncover potential threats, enabling security teams to respond promptly and mitigate risks associated with encoded malware or unauthorized data access.
Detects command line patterns used by BlackByte ransomware in different operations, including execution from the Public user directory, attempts to delete Task Manager, disable services, and use obfuscated PowerShell commands.
Detects the use of 'tail' to extract bytes at an offset from an image file (e.g., JPEG, PNG) and then pipe the output to 'base64 --decode' to create a new file with the decoded content. This technique is often used by adversaries to deobfuscate or extract hidden payloads from seemingly innocuous image files, typically executed as a bash one-liner.
Detects the execution of 'wget' to download a '.tar' file from an untrusted direct IP address, specifically when the '--no-check-certificate' flag is used. This behavior has been observed in attacks attributed to UNC4841 during their exploitation of Barracuda ESG zero-day vulnerabilities.
Detects the execution of 'wget' to download compressed files ('.zip' or '.rar') from 'temp.sh'. This activity has been observed in attacks attributed to UNC4841, specifically during their exploitation of Barracuda ESG zero-day vulnerabilities.
Detects suspicious command-line activity on Linux systems where base64 encoded input is piped directly into a shell for execution. This technique is often used by adversaries for defense evasion and to obfuscate malicious commands.
Detects when the built-in 'openssl' utility is used on macOS to decode and decrypt a payload, specifically when the command line arguments indicate base64 encoding and decryption, and the input file is located within a '/Volumes/' path. This behavior is often observed in adware or malware families like Bundlore and Shlayer, which use disk images (DMGs) to deliver encoded and encrypted payloads to evade detection and trick users into execution.
This rule detects the presence of base64 encoded shebangs (e.g., #!/bin/bash) within command-line arguments. Adversaries often encode commands to evade detection and obfuscate their malicious intent. The rule specifically looks for the base64 representations of common shell shebangs, indicating that a script or command containing these might be decoded and executed.
Detects the presence of a potentially XOR encoded PowerShell command by looking for the 'bxor' operator in conjunction with common PowerShell command elements like 'ForEach', 'for', '-join', and '[char]'. This pattern is often used by adversaries to obfuscate malicious scripts.
Page 12 of 13