Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
This rule detects the installation of Microsoft Installer (MSI) packages from suspicious file system locations. It specifically looks for MsiInstaller events (Event IDs 1040 and 1042) where the installation source path contains known suspicious directories such as Windows temporary folders, remote shares (indicated by '\\'), Desktop, PerfLogs, or Public user folders. The rule includes filters to reduce false positives from legitimate applications like WinGet or specific update health tools.
Detects a crash of the "WinRAR.exe" application with a version lower than 6.23, which could indicate an attempted exploitation of CVE-2023-40477. The rule specifically looks for Application Error events (EventID 1000) where the provider is 'Application Error' and the crashing application is 'WinRAR.exe', excluding versions 6.23 and higher.
Detects the creation of suspicious executable or script files within the OneNote temporary directory, indicating potential malware delivery and execution via malicious OneNote attachments. This behavior has been observed in recent malware campaigns leveraging OneNote files.
Detects suspicious child processes spawned from Microsoft Outlook. This often indicates an attempt to execute malicious code or scripts via social engineering or exploitation of vulnerabilities within Outlook.
Detects patterns associated with DarkSide Ransomware and its helper processes. Specifically, it looks for command-line arguments used by DarkSide, such as '=[char][byte]('0x'+' or ' -work worker0 -path ', or the execution of an image from the 'AppData\Local\Temp\' directory when the parent process is 'DllHost.exe /Processid:{3E5FC7F9-9A51-4367-9063-A120244FBEC7}'.
Detects the creation of a "Report.wer" file in an uncommon folder structure, specifically outside of the typical Windows Error Reporting (WER) archive paths. This activity could indicate potential exploitation of CVE-2023-36874, where adversaries might manipulate WER to achieve execution or persistence.
Detects when a Microsoft Office application (Excel, Publisher, OneNote, Outlook, PowerPoint, Word) loads specific Visual Basic for Applications (VBA) related DLLs (VBE7.DLL, VBEUI.DLL, VBE7INTL.DLL). This activity can indicate the presence and execution of VBA macros, which are often used by adversaries for initial access or execution.
Detects the execution of various scripting interpreters or command-line tools via a LNK file accessed from a WebDAV share. This technique is often used by adversaries to bypass security controls and execute malicious code, leveraging the `DavWWWRoot` path to indicate WebDAV access. The parent process is expected to be `explorer.exe`, suggesting user interaction.
This rule detects the execution of arbitrary shell commands via the '.SettingContent-ms' file type. These files, introduced in Windows 10, are XML-based shortcuts to Windows settings pages. Adversaries can manipulate these files to execute malicious commands, bypassing typical execution controls. The rule specifically looks for process creation events where the command line contains '.SettingContent-ms' and excludes legitimate calls to 'immersivecontrolpanel'.
This rule detects modifications to the Windows Registry key associated with "TrustRecords" for Microsoft Office applications. These trust records are created when a user enables macros in a document, indicating that the document's source is trusted. Adversaries often leverage malicious macros in documents as an initial access vector. Monitoring changes to this registry path can help identify when macros are being enabled, potentially by a user interacting with a malicious document.
Detects possible execution via LNK file accessed on a WebDAV server.
Page 26 of 26