Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
445 detections
Filters
Last updated
All Time
Detection languages
200
123
25
25
20
Contributors
96
68
59
44
34
Categories
266
237
104
47
39
Platforms
313
149
52
51
12
Products / Services
95
72
36
26
21
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
15
14
13
11
8
IDS Classtypes
6
4
3
2
2
IDS Protocols
15
3
2
This query was originally published in the threat analytics report, WinRAR CVE-2018-20250 exploit
WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
The following query detects possible CVE-2020-20250 exploitation by looking for files with the .ace extension.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
WinRAR is a third-party file compressing application. Versions 5.61 and earlier contained a flaw that could be exploited by an attacker to read and write to an arbitrary path on the target's system. This could be used to run arbitrary code, overwrite system files, or access sensitive information. This vulnerability was designated CVE-2018-20250, and it is associated an outdated version of the legacy ACE compression library, 'unacev2.dll'.
The following query detects possible CVE-2020-20250 exploitation by looking for files with the .ace extension.
Reference - https://nvd.nist.gov/vuln/detail/CVE-2018-20250
// Author: jan geisbauer
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
The query checks for suspicious Tomcat process launches associated with likely exploitation of Confluence - CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
Read more here:.
https://confluence.atlassian.com/doc/confluence-security-advisory-2022-06-02-1130377146.html
https://nvd.nist.gov/vuln/detail/CVE-2022-26134
Tags: #exploit #CVE-2022-26134
// Author: jan geisbauer
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
// @janvonkirchheim
// ------------------------
// 1. A list of all devices that have this vulnerability
// 2. A list of all users that uses those devices
// 3. If these users received .mkv files recently
This query was originally published in a threat analytics report about the group known to other security researchers as APT32 or OceanLotus
This tracked activity group uses a wide array of malicious documents to conduct attacks. Some of their favorite techniques include sideloading dynamic link libraries, and disguising payloads as image files. The group has weaponized files with exploits for the following vulnerabilities:
1. CVE-2017-11882 - Software update
2. CVE-2017-0199 - Software update
The following query detects known malicious files associated with the group's campaigns.
See Detect malicious network activity associated with group known as "OceanLotus" for another query related to this group's activity.
This tracked activity group uses a wide array of malicious documents to conduct attacks. Some of their favorite techniques include sideloading dynamic link libraries, and disguising payloads as image files. The group has weaponized files with exploits for the following vulnerabilities:
1. CVE-2017-11882 - Software update
2. CVE-2017-0199 - Software update
The following query detects known malicious files associated with the group's campaigns.
See Detect malicious network activity associated with group known as "OceanLotus" for another query related to this group's activity.
Detects antivirus alerts indicating the presence of exploitation frameworks or known offensive security tools. This rule emphasizes the importance of investigating such alerts, even if the malware is blocked, to understand the initial compromise vector.
'This query looks for writes of PE files to C:\Windows\System32\spool\drivers\color\.
This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This query was originally published in the threat analytics report, CVE-2018-8653 scripting engine vulnerability.
CVE-2018-8653 is a remote code execution vulnerability found in the scripting engine for several releases of Internet Explorer. An attacker exploiting this CVE could use a malicious webpage to gain the same access rights as the currently logged-in user -- which is particularly problematic if the user is an administrator.
Microsoft has since addressed this vulnerability.
The following queries detect possible exploitation of this CVE.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8653
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2018-8653
CVE-2018-8653 is a remote code execution vulnerability found in the scripting engine for several releases of Internet Explorer. An attacker exploiting this CVE could use a malicious webpage to gain the same access rights as the currently logged-in user -- which is particularly problematic if the user is an administrator.
Microsoft has since addressed this vulnerability.
The following queries detect possible exploitation of this CVE.
References:
https://nvd.nist.gov/vuln/detail/CVE-2018-8653
https://portal.msrc.microsoft.com/security-guidance/advisory/CVE-2018-8653
The query checks process command lines arguments and parent/child combinations to find machines where there have been.
Attempts to exploit the Protocol Handler Vulnerability of Electron framework CVE-2018-1000006.
Electron is a common framework used by many popular applications (e.g. Skype, Teams, Slack, VSCode) which expose protocol handlers.
Which can trigger a remote code execution vulnerability via a browser vector (e.g. Chrome, Internet Explorer, Edge).
CVE: CVE-2018-1000006.
Read more here:.
Https://electronjs.org/blog/protocol-handler-fix.
Https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000006.
Https://www.exploit-db.com/exploits/43899.
Https://hackernoon.com/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374.
Tags: #exploit #CVE-2018-1000006 #Electron.
Attempts to exploit the Protocol Handler Vulnerability of Electron framework CVE-2018-1000006.
Electron is a common framework used by many popular applications (e.g. Skype, Teams, Slack, VSCode) which expose protocol handlers.
Which can trigger a remote code execution vulnerability via a browser vector (e.g. Chrome, Internet Explorer, Edge).
CVE: CVE-2018-1000006.
Read more here:.
Https://electronjs.org/blog/protocol-handler-fix.
Https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-1000006.
Https://www.exploit-db.com/exploits/43899.
Https://hackernoon.com/exploiting-electron-rce-in-exodus-wallet-d9e6db13c374.
Tags: #exploit #CVE-2018-1000006 #Electron.
Detects suspicious use of command-line tools such as curl or wget to download remote
content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by
immediate execution, indicating potential malicious activity. This pattern is commonly used
by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
content - particularly scripts - into temporary directories (e.g., /dev/shm, /tmp), followed by
immediate execution, indicating potential malicious activity. This pattern is commonly used
by malicious scripts, stagers, or downloaders in fileless or multi-stage Linux attacks.
This rule identifies process creations or file creations where the associated file has been tagged as an 'exploit' by VirusTotal. It leverages enrichment from a VirusTotal integration to flag potentially malicious activity related to exploit execution.
Detects suspicious child processes spawned by 'pc-app.exe', which is the main application executable for PaperCut MF/NG. The presence of common system utilities and scripting interpreters as child processes of 'pc-app.exe' can indicate successful exploitation of a vulnerability within PaperCut, potentially leading to arbitrary code execution.
Detects potential exploitation of a chained vulnerability attack targeting Ivanti EPMM 12.5.0.0. CVE-2025-4427 allows unauthenticated access to protected API endpoints via an authentication bypass, which can then be leveraged to trigger CVE-2025-4428 — a remote code execution vulnerability through template injection. This sequence enables unauthenticated remote code execution, significantly increasing the impact of exploitation.
This analytic highlights high-impact intrusion events detected by Cisco Secure Firewall. It leverages Cisco Secure Firewall Threat Defense logs, specifically the IntrusionEvent event type, and focuses on events with an `Impact` score of 1 or 2. If confirmed malicious, these events may indicate a potentially compromised host.
This analytic detects the presence of SIGRed (CVE-2020-1350), a critical DNS vulnerability, using Zeek DNS and Zeek Conn data. It identifies specific DNS query types (SIG and KEY) and checks for high data transfer within a flow (over 65KB). This detection is significant because SIGRed allows attackers to execute remote code on Windows DNS servers, potentially leading to unauthorized access and control. If confirmed malicious, this activity could result in data exfiltration, service disruption, or further network compromise. Immediate investigation and mitigation, such as patching or isolating the affected server, are crucial.
This analytic detects file downloads involving executable, archive, or scripting-related file types that are commonly used in malware delivery. These file types include formats like PE executables, shell scripts, autorun files, installers, and known testing samples such as EICAR. This detection leverages Cisco Secure Firewall Threat Defense logs and enriches the results using a filetype lookup to provide context. If confirmed malicious, these downloads could indicate the initial infection vector, malware staging, or scripting abuse.
The analytic identifies the loading of the malicious SolarWinds.Orion.Core.BusinessLayer.dll by SolarWinds.BusinessLayerHost.exe and subsequent DNS queries to avsvmcloud.com. It uses Sysmon EventID 7 for DLL loading and Event ID 22 for DNS queries, correlating these events within a 12-14 day period. This activity is significant as it indicates potential Sunburst malware infection, a known supply chain attack. If confirmed malicious, this could lead to unauthorized network access, data exfiltration, and further compromise of the affected systems.
The analytic detects potential MSC EvilTwin loader exploitation, which manipulates directory paths with spaces to bypass security controls. The technique, described as CVE-2025-26633, involves crafting malicious MSC files that leverage MUIPath parameter manipulation. This detection focuses on suspicious MSC file execution patterns with unconventional command-line parameters, particularly those containing unusual spaces in Windows System32 paths or suspicious additional parameters after the MSC file. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code with elevated privileges through DLL side-loading or path traversal techniques.
The analytic detects attempts to exploit the SIGRed vulnerability (CVE-2020-1350) in Windows DNS servers. It leverages Splunk Stream DNS and TCP data to identify DNS SIG and KEY records, as well as TCP payloads exceeding 65KB. This activity is significant because SIGRed is a critical wormable vulnerability that allows remote code execution. If confirmed malicious, an attacker could gain unauthorized access, execute arbitrary code, and potentially disrupt services, leading to severe data breaches and infrastructure compromise. Immediate investigation and remediation are crucial to mitigate these risks.
The following analytic identifies Windows endpoints that have not generated an event indicating a successful Windows update in the last 60 days. It leverages the 'Update' data model in Splunk, specifically looking for the latest 'Installed' status events from Microsoft Windows. This activity is significant for a SOC because endpoints that are not regularly patched are vulnerable to known exploits and security vulnerabilities. If confirmed malicious, this could indicate a compromised endpoint that is intentionally being kept unpatched, potentially allowing attackers to exploit unpatched vulnerabilities and gain unauthorized access or control.
Detects network connections initiated by 'dfsvc.exe', which is responsible for handling ClickOnce applications, to non-local IP addresses. This activity can be indicative of malicious ClickOnce abuse for trusted code execution, especially when connecting to external or unexpected destinations.
Page 20 of 22