Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
151 detections
Filters
Last updated
All Time
Detection languages
55
54
11
10
7
Contributors
46
30
17
7
6
Categories
85
63
41
30
13
Platforms
138
9
9
3
2
Products / Services
44
28
25
19
16
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
2
IDS Classtypes
2
1
IDS Protocols
2
1
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
This rule detects the execution of 'findstr.exe' with command-line arguments that include common strings associated with antivirus software processes or services. This activity is often performed by malware, specifically observed in Storm-0408 malvertising campaigns, to discover installed security products before attempting evasion. The rule filters out instances where 'msiexec.exe' is the parent process, as this can indicate legitimate software inventory scripts.
Detects file access attempts targeting the erroneous SysWOW64 path for Kaspersky drivers. This is a specific bug and a high-confidence indicator of Amatera Stealer's anti-sandbox and evasion checks. The malware specifically looks for 'klif.sys', 'kldisk.sys', 'klhk.sys', and 'kneps.sys' within the incorrect '\Windows\SysWOW64\drivers' directory.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. The EtherRAT SYS_INFO module aggressively maps defensive tooling to tailor follow-on payloads and evade detection.
Detects when a registered security product on a Windows system has been turned off or snoozed, indicated by Windows Security Center Event ID 15 with specific states.
The rule detects handle requests and access attempts (Event ID 4663) to the SrpV2\Exe registry key.
This query identifies devices with specific versions of installed software that are considered vulnerable. It is a template that can be easily adapted to track any software by changing the placeholder variables. It enriches the findings with device and user information for easier investigation.
Detects attempts by the TamperedChef malware to discover installed security products by querying specific registry keys. This behavior often precedes credential theft activities, which can involve terminating browser processes.
Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results.
This detection focuses on the keywords that the attacker might use as a filter.
This detection focuses on the keywords that the attacker might use as a filter.
Detects the creation of a child process by a known analysis, debugging, or reverse engineering tool. Malware like Stealit checks for these parent processes to determine if it's being analyzed. Spawning unexpected child processes from these tools can indicate malicious activity, such as the malware continuing its execution path after a failed anti-analysis check or a user interacting with a malicious file within a sandbox. The rule is filtered to exclude common legitimate child processes spawned by these tools.
Detects the execution of common process and memory analysis tools. The presence of these tools on a standard user endpoint could indicate reconnaissance, reverse engineering, or an attempt by malware to check for an analysis environment. This list is based on tools blacklisted by the Stealit malware.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
Detects suspicious command-line activity associated with the "ClickFix" social engineering technique.
Threat actors trick users into pasting and executing malicious commands that typically use scripting engines or built-in utilities to download and run subsequent payloads.
This rule identifies patterns seen in recent NetSupport RAT, Latrodectus, and Lumma Stealer campaigns using this vector.
Threat actors trick users into pasting and executing malicious commands that typically use scripting engines or built-in utilities to download and run subsequent payloads.
This rule identifies patterns seen in recent NetSupport RAT, Latrodectus, and Lumma Stealer campaigns using this vector.
KQL Query
KQL Query from file: CVE-2024-3094 with CVSS Score 10
KQL Query
KQL Query from file: Finding internet facing device with CUPS
KQL Query from file: Detect CVE-2024-31497
Detects execution of "findstr" to search for common names of security tools. Attackers often pipe the results of recon commands such as "tasklist" or "whoami" to "findstr" in order to filter out the results.
This detection focuses on the keywords that the attacker might use as a filter.
This detection focuses on the keywords that the attacker might use as a filter.
Detects usage of "findstr" with the argument "385201". Which could indicate potential discovery of an installed Sysinternals Sysmon service using the default driver altitude (even if the name is changed).
This query will provide a report of many of the best practice configurations for Defender ATP deployment. Special Thanks to Gilad Mittelman for the initial inspiration and concept.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
Any tests which are reporting "BAD" as a result imply that the associated capability is not configured per best practice recommendation.
Page 6 of 8