Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
28 detections
Filters
Last updated
All Time
Detection languages
15
5
3
3
1
Contributors
5
5
4
4
3
Categories
15
6
4
4
3
Platforms
14
8
4
1
Products / Services
3
3
2
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects a explorer.exe sub process of the RazerInstaller software which can be invoked from the installer to select a different installation folder but can also be exploited to escalate privileges to LOCAL SYSTEM
Detects the execution of a renamed BOINC binary.
This rule detects the execution of software whose metadata includes the description 'University of California, Berkeley'. This string is commonly associated with the BOINC (Berkeley Open Infrastructure for Network Computing) software. While BOINC is legitimate software used for volunteer computing, its unauthorized installation or use could indicate malicious activity, such as an adversary attempting to leverage system resources for their own purposes or as part of a larger compromise.
The following analytic detects modifications to the Windows Registry SIP Provider. It leverages Sysmon EventID 7 to monitor registry changes in paths and values related to Cryptography Providers and OID Encoding Types. This activity is significant as it may indicate an attempt to subvert trust controls, a common tactic for bypassing security measures and maintaining persistence. If confirmed malicious, an attacker could manipulate the system's cryptographic functions, potentially leading to unauthorized access, data theft, or other damaging outcomes. Review the modified registry paths and concurrent processes to identify the attack source.
The following analytic detects failed trust validation attempts using Windows Event Log - CAPI2 (CryptoAPI 2). It specifically triggers on EventID 81, which indicates that "The digital signature of the object did not verify." This detection leverages the CAPI2 Operational log to identify instances where digital signatures fail to validate. Monitoring this activity is crucial as it can indicate attempts to execute untrusted or potentially malicious binaries. If confirmed malicious, this activity could allow attackers to bypass security controls and execute unauthorized code, leading to potential system compromise.
This analytic identifies all SIP (Subject Interface Package) providers on a Windows system by capturing DLL paths from relevant events. It is designed to detect potentially malicious SIP providers that could bypass trust controls and allow unauthorized code execution. The rule is intended for hunting and inventory purposes, prompting analysts to review for new and non-standard DLL paths to identify potential threats. If confirmed malicious, such activity could subvert system integrity, leading to unauthorized access or persistent threats.
This rule detects when the macOS Script Editor application spawns child processes that are commonly used for malicious activities. Specifically, it looks for the Script Editor launching shell interpreters (bash, sh, zsh, dash, fish), scripting languages (python, perl, php, osascript), or utilities often leveraged in attack chains (curl, mktemp, chmod, nohup, openssl, plutil, PlistBuddy, xattr, sqlite, funzip, popen). This behavior can indicate an adversary using AppleScript or other scripting capabilities within Script Editor to execute arbitrary commands, download payloads, or manipulate system configurations.
Page 2 of 2