Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
The following analytic detects the execution of rare processes that appear only once across the network within a specified timeframe. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process execution logs. This activity is significant for a SOC as it helps identify potentially malicious activities or unauthorized software, which could indicate a security breach or ongoing attack. If confirmed malicious, such rare processes could lead to data theft, privilege escalation, or complete system compromise, making early detection crucial for minimizing impact.
This analytic detects previously unseen processes within the Kubernetes environment on master or worker nodes. It leverages process metrics collected via an OTEL collector and hostmetrics receiver, with data pulled from Splunk Observability Cloud. The detection compares processes observed in the last hour against those seen in the previous 30 days. Identifying new processes is crucial as they may indicate unauthorized activity or attempts to compromise the node. If confirmed malicious, these processes could lead to data exfiltration, privilege escalation, denial-of-service attacks, or the introduction of malware, posing significant risks to the Kubernetes cluster.
The following analytic identifies the download of potentially malicious file types, such as .scr, .dll, .bat, and .lnk, within a network. It leverages web proxy logs from Zscaler, focusing on blocked actions and analyzing fields like deviceowner, user, urlcategory, url, dest, and filename. This activity is significant as these file types are often used to spread malware, posing a threat to network security. If confirmed malicious, this activity could lead to malware execution, data compromise, or further network infiltration.
The following analytic detects emails in Gsuite containing links to known abuse web services such as Pastebin, Telegram, and Discord. It leverages Gsuite Gmail logs to identify emails with these specific domains in their links. This activity is significant because these services are commonly used by attackers to deliver malicious payloads. If confirmed malicious, this could lead to the delivery of malware, phishing attacks, or other harmful activities, potentially compromising sensitive information or systems within the organization.
The following analytic identifies the execution of CLOP ransomware variants using specific arguments ("runrun" or "temp.dat") to trigger their malicious activities. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. Monitoring this activity is crucial as it indicates potential ransomware behavior, which can lead to file encryption on network shares or local machines. If confirmed malicious, this activity could result in significant data loss and operational disruption due to encrypted files, highlighting the need for immediate investigation and response.
The following analytic detects the launch of rarely used applications within the environment, which may indicate the use of potentially malicious software or tools by attackers. It leverages Windows AppLocker event logs, aggregating application launch counts over time and flagging those that significantly deviate from the norm. This behavior is significant as it helps identify unusual application activity that could signal a security threat. If confirmed malicious, this activity could allow attackers to execute unauthorized code, potentially leading to further compromise of the system.
Detects exploitation of LNK file command-line length discrepancy, where attackers hide malicious commands beyond the 260-character UI limit while the actual command-line argument field supports 4096 characters using whitespace padding (e.g., 0x20, 0x09-0x0D). Adversaries insert non-printable whitespace characters (e.g., Line Feed \x0A, Carriage Return \x0D) to pad the visible section of the LNK file, pushing malicious commands past the UI-visible boundary. The hidden payload, executed at runtime but invisible in Windows Explorer properties, enables stealthy execution and evasion—commonly used for social engineering attacks. This rule flags suspicious use of such padding observed in real-world attacks.
This rule detects when a user bypasses Chrome Safe Browsing warnings for potentially dangerous content or downloads. It specifically looks for events where Chrome Management reports a bad navigation event, dangerous download event, content transfer event, or unscanned file event, and the security result indicates the event was 'BYPASSED' by the user. The rule also assigns a risk score based on the category of the bypassed threat, with higher scores for malware, dangerous hosts, and social engineering.
This rule detects successful AWS API calls originating from an IP address identified as a Tor exit node. It leverages a GCTI Feed for Tor exit node IP listings and also calculates a risk score based on the geographical location of the originating IP, specifically increasing the score for connections from Cuba, Iran, North Korea, Russia, and Syria.
Detects the creation of files with suspicious extensions (e.g., .bat, .dll, .exe, .hta, .js, .ps1, .vbe, .vbs) within the Windows Public user folder. This activity can indicate an adversary staging malicious scripts or binaries in a location accessible to all users, potentially for execution or further distribution.
Amazon GuardDuty detects a malicious or suspicious file on an Amazon EC2 instance or a container workload.
Detects successful API executions from a Tor exit node.
Detects successful API executions from a Tor exit node.
Identifies when a user downloads a potentially malicious file from Google Drive.
Detects highly relevant antivirus alerts indicating the presence of hack tools or other attack tools. This rule emphasizes that even if the antivirus blocks the malware, the event requires investigation to understand how the tool initially compromised the system.
Detects the execution of commands via the Windows Run dialog box by monitoring modifications to the "RunMRU" registry key. This technique has been observed in campaigns where threat actors trick users into pasting and executing malicious commands, often under the guise of CAPTCHA verification steps, to deliver malware like Lumma Stealer.
This rule detects when the macOS Script Editor application spawns child processes that are commonly used for malicious activities. Specifically, it looks for the Script Editor launching shell interpreters (bash, sh, zsh, dash, fish), scripting languages (python, perl, php, osascript), or utilities often leveraged in attack chains (curl, mktemp, chmod, nohup, openssl, plutil, PlistBuddy, xattr, sqlite, funzip, popen). This behavior can indicate an adversary using AppleScript or other scripting capabilities within Script Editor to execute arbitrary commands, download payloads, or manipulate system configurations.
Detects when the built-in 'openssl' utility is used on macOS to decode and decrypt a payload, specifically when the command line arguments indicate base64 encoding and decryption, and the input file is located within a '/Volumes/' path. This behavior is often observed in adware or malware families like Bundlore and Shlayer, which use disk images (DMGs) to deliver encoded and encrypted payloads to evade detection and trick users into execution.
Detects when a diagcab package is loaded from a remote path. This behavior has been observed in the context of the DogWalk vulnerability, where attackers could leverage this to achieve arbitrary code execution.
Detects suspicious child processes spawning from Microsoft Office suite applications (Word, Excel, PowerPoint, OneNote) on macOS. This behavior often indicates malicious macro execution attempting to leverage scripting interpreters or command-line utilities for further compromise.
Detects the installation of suspicious applications by monitoring the Windows Shell-Core event log for EventID 28115, which indicates a shortcut being added to the app resolver cache. The rule specifically looks for known suspicious application names like Zenmap, AnyDesk, Wireshark, and OpenVPN in the 'Name' or 'AppID' fields.
Page 25 of 26