Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
46 detections
Filters
Last updated
All Time
Detection languages
18
12
6
4
4
Contributors
8
8
6
5
5
Categories
21
21
13
13
11
Platforms
31
12
1
1
1
Products / Services
11
10
6
6
6
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
6
3
1
1
1
IDS Classtypes
1
IDS Protocols
1
Detects file creation, copy, or rename operations within known VPN application directories (CyberGhost, ExpressVPN, NordVPN) when initiated by Chromium Embedded Framework (CEF) related processes (CefSharp.BrowsersSubprocess). This behavior is highly irregular as standard web browser components should not be modifying the local configuration or installation directories of VPN software.
Detects suspicious modifications to file permissions and attributes on specific artifacts (lambsys, procq, isp.sh) known to be associated with the Lambsys cryptominer campaign. The rule monitors for execution of chmod or chattr on these artifacts, or any generic chmod activity within /tmp or /var/tmp directories.
Detects file creation, copy, or rename operations within known VPN application directories (CyberGhost, ExpressVPN, NordVPN) when initiated by Chromium Embedded Framework (CEF) related processes (CefSharp.BrowsersSubprocess). This behavior is highly irregular as standard web browser components should not be modifying the local configuration or installation directories of VPN software.
Hunting rule for T1222 "Enable Local and Remote Symbolic Links via reg.exe". No public in-the-wild intel reference available; correlate before alerting.
Detects suspicious chmod commands used to hide or protect malware
Detects suspicious chmod commands used to hide or protect malware
Detects remote modification of file and directory permissions via SMB
This rule detects attempts to modify file permissions remotely via SMB by looking for the string "icacls" in TCP traffic directed to port 445 (SMB). The detection is case-insensitive and focuses on established connections flowing to the server. This activity is classified as trojan activity, suggesting an attacker might be attempting to alter file access controls on a remote system.
This detection identifies the use of the chattr command on Linux endpoints to add or remove the immutable (+i/-i) attribute on files. Threat actors abuse this technique to protect malicious files (such as persistence mechanisms or web shells) from modification or deletion, or to remove immutability from system files prior to tampering. Investigate the parent process, executing user, and target file path to determine whether the activity aligns with legitimate administrative work or indicates anti-forensics or persistence behavior.
Detects PowerShell scripts set ACL to of a file or a folder
Detects PowerShell scripts to set the ACL to a file in the Windows folder
Detects the execution of icacls.exe to grant 'Full Control' permissions to the 'Everyone' group for SimpleHelp RMM
Detects the creation or modification of files, particularly shared objects (.so), on Android devices with overly permissive '777' (rwxrwxrwx) permissions. This behavior is a known tactic of the LANDFALL spyware, which sets these permissions on its staged components like 'dec_a.so' to ensure they are executable.
Detects scenarios where an attacker would attempt to escalate privileges by changing the security settings of the responder.
Detects PowerShell scripts set ACL to of a file or a folder
Detects PowerShell scripts to set the ACL to a file in the Windows folder
'The query looks for source code files being modified immediately after a build process is started. The purpose of this is to look for malicious code injection during the build process.
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
More details: https://techcommunity.microsoft.com/t5/azure-sentinel/monitoring-the-software-supply-chain-with-azure-sentinel/ba-p/2176463'
The following analytic identifies excessive usage of `cacls.exe`, `xcacls.exe`, or `icacls.exe` to change file or folder permissions. It looks for 10 or more execution of the aforementioned processes in the span of 1 minute. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it may indicate an adversary attempting to restrict access to malware components or artifacts on a compromised system. If confirmed malicious, this behavior could prevent users from deleting or accessing critical files, aiding in the persistence and concealment of malicious activities.
This analytic detects the modification of Access Control List (ACL) permissions to files or folders on Windows systems, specifically when permissions are granted to 'Everyone' or 'SYSTEM' accounts. It monitors the execution of built-in Windows utilities like `cacls.exe`, `icacls.exe`, and `xcacls.exe` with command-line arguments indicative of granting broad access. Such activity is significant as it may suggest an adversary attempting to bypass security controls, evade detection, or gain unauthorized access to sensitive files, potentially leading to data breaches or further system compromise.
The analytic detects the use of `icacls.exe`, `cacls.exe`, or `xcacls.exe` with the `/grant` argument to modify file or directory permissions. This activity is often used by adversaries, including APTs and coinminer scripts, to establish persistence, evade detection, and maintain control over compromised systems. Granting additional access can lead to unauthorized access, data exfiltration, or further system compromise.
The following analytic detects instances where an adversary modifies security permissions of a file or directory using commands like "icacls.exe", "cacls.exe", or "xcacls.exe" with deny options. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions. This activity is significant as it is commonly used by Advanced Persistent Threats (APTs) and coinminer scripts to evade detection and impede access to critical files. If confirmed malicious, this could allow attackers to maintain persistence and hinder incident response efforts.
Page 2 of 3