Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
445 detections
Filters
Last updated
All Time
Detection languages
200
123
25
25
20
Contributors
96
68
59
44
34
Categories
266
237
104
47
39
Platforms
313
149
52
51
12
Products / Services
95
72
36
26
21
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
15
14
13
11
8
IDS Classtypes
6
4
3
2
2
IDS Protocols
15
3
2
Detects the execution of a shell as a sub-process of "rsync" without the expected command line flag "-e" being used. This behavior is commonly associated with attempts to exploit CVE-2024-12084, leading to arbitrary command execution or privilege escalation.
Detects the execution of a shell as sub process of "rsync" without the expected command line flag "-e" being used, which could be an indication of exploitation as described in CVE-2024-12084. This behavior is commonly associated with attempts to execute arbitrary commands or escalate privileges, potentially leading to unauthorized access or further exploitation.
Detects exploitation attempts of CVE-2023-38331 (WinRAR before v6.23), where an attacker can leverage WinRAR to execute arbitrary commands and binaries. The rule specifically looks for child processes spawned by WinRAR.exe, where the command line contains a temporary path indicative of the vulnerability (e.g., '\AppData\Local\Temp\Rar$') and a double extension (e.g., '.ext .exe'), combined with the execution of common binaries like cmd.exe, powershell.exe, or scripting hosts.
Detects exploits that leverage CVE-2017-11882 by monitoring for the execution of EQNEDT32.EXE as a parent process, which is indicative of the vulnerability being exploited to launch further malicious processes like mshta.exe.
This rule detects the execution of 'csc.exe' as a sub-process of 'WINWORD.EXE'. This specific process relationship is indicative of exploitation attempts leveraging CVE-2017-8759, where a crafted document (opened by Winword) can lead to the execution of arbitrary code, often using csc.exe (C# compiler) to compile and execute malicious code on the fly.
Detects the download of potentially malicious file types (executables, scripts, documents, archives, etc.) from domains using suspicious or commonly abused Top-Level Domains (TLDs). This rule aims to identify initial access attempts often associated with phishing or drive-by download campaigns.
This rule detects the creation of potentially suspicious child processes by WinRAR.exe. Adversaries may exploit vulnerabilities in WinRAR, such as CVE-2023-38831, to achieve arbitrary code execution. This rule specifically looks for WinRAR.exe spawning common scripting or execution binaries like cmd.exe, cscript.exe, mshta.exe, powershell.exe, pwsh.exe, regsvr32.exe, rundll32.exe, and wscript.exe. Such activity is highly indicative of an adversary attempting to execute further commands or payloads after exploiting WinRAR.
Detects events generated by user-mode applications when they call the CveEventWrite API, indicating that a known vulnerability is potentially being exploited. Microsoft started using this log in January 2020, notably with CVE-2020-0601 (a Windows CryptoAPI vulnerability). However, the rule's description notes that this log has historically seen limited use for reporting CVEs.
Detects file creation patterns indicative of the CVE-2021-40444 exploit, specifically the creation of CAB and INF files by Microsoft Word in temporary internet cache or local temporary directories.
Detects downloads of potentially malicious file types (executables, scripts, documents, archives) from domains that are not common Top-Level Domains (TLDs). This rule aims to identify suspicious file transfers that bypass typical, trusted sources.
This rule detects potential successful exploitation of CVE-2021-26857, a Microsoft Exchange Server vulnerability. It specifically looks for abnormal child processes spawning from the 'UMWorkerProcess.exe' (Unified Messaging service) on Exchange servers. The rule filters out legitimate Windows Error Reporting processes ('wermgr.exe' and 'WerFault.exe') to reduce false positives, indicating that any other process spawned by 'UMWorkerProcess.exe' is considered suspicious and a potential indicator of compromise.
Detects suspicious child processes spawned from web browsers on macOS. This activity often indicates a potential web browser exploitation attempt, where an attacker leverages a browser vulnerability to execute arbitrary commands or scripts on the system. The rule specifically looks for common scripting and command-line interpreters being launched as child processes of various browsers, while filtering out known legitimate browser-related activities like updates or recovery scripts.
Detects the creation of ".rev" files by WinRAR, which can indicate potential exploitation of CVE-2023-40477. This vulnerability allows for arbitrary code execution. The rule looks for file creation events where the process is either 'explorer.exe' (suggesting extraction via context menu) or 'WinRAR.exe', and the created file has a '.rev' extension. Further investigation for suspicious execution or WinRAR application crashes shortly after such file creation is recommended.
Detects Microsoft Word (WINWORD.EXE) starting the uncommon sub-process FLTLDR.exe, which is indicative of exploitation attempts for vulnerabilities like CVE-2017-0261 and CVE-2017-0262. This behavior suggests a malicious document is attempting to execute arbitrary code.
This rule detects the execution of a script via the SCX RunAsProvider ExecuteScript function, which is associated with the OMIGOD vulnerability. Specifically, it looks for process creation events where the user is 'root', the LogonId is '0', the CurrentDirectory is '/var/opt/microsoft/scx/tmp', and the CommandLine contains '/etc/opt/microsoft/scx/conf/tmpdir/scx'. This pattern indicates the execution of a temporary script created by the SCX agent, often exploited for privilege escalation or initial access.
Detects Microsoft Office applications executing child processes that include directory traversal patterns in their command line. This behavior is indicative of exploitation attempts, specifically referencing vulnerabilities like CVE-2022-30190 (MSDT RCE, also known as Follina) and CVE-2021-40444 (MSHTML RCE). The rule looks for common Office applications as parent processes and specific directory traversal strings in the child process's command line.
This rule detects the creation of suspicious shell processes or system utilities spawned by the Java utility 'keytool.exe'. This behavior is often indicative of exploitation, such as the CVE-2021-40539 vulnerability in ManageEngine ADSelfService Plus, where attackers leverage keytool to execute arbitrary commands. The rule specifically looks for 'keytool.exe' as the parent process and a wide range of common Windows and Linux shell/utility executables as the child process.
Detects the creation of a 'gbb.exe' process as a sub-process of 'Hwp.exe' (Hangul Word Processor). This behavior is highly suspicious and often indicative of exploitation attempts targeting vulnerabilities within the HWP application, leading to the execution of malicious payloads.
Detects network connections initiated by the Microsoft Equation Editor process (eqnedt32.exe). This activity is highly suspicious as eqnedt32.exe is not expected to make outbound network connections and is often exploited by adversaries to achieve code execution and establish C2 communications.
Detects potentially suspicious child processes of WinRAR.exe.
Detects network connections from the Equation Editor process "eqnedt32.exe".
Page 21 of 22