Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
238 detections
Filters
Last updated
All Time
Detection languages
91
71
26
15
15
Contributors
60
46
29
23
11
Categories
147
108
96
56
50
Platforms
203
19
14
8
1
Products / Services
68
38
34
12
10
MITRE Techniques
18,108
15,617
12,573
8,385
6,207
CVEs
2
1
1
1
1
IDS Classtypes
5
1
1
IDS Protocols
3
2
2
This rule detects the execution of Gpg4win's GnuPG tool (gpg.exe or gpg2.exe) when it is used to encrypt files. The detection specifically looks for command-line arguments that indicate file encryption ('-c') and the use of a passphrase ('passphrase'). This activity can be indicative of malicious actors encrypting data for exfiltration or to render it inaccessible.
Detects the creation of a file by WinRAR with a double extension and a space in the filename, specifically targeting the temporary directory. This pattern is indicative of an exploitation attempt related to CVE-2023-38331, a vulnerability in WinRAR that allows for arbitrary code execution through specially crafted archives.
This rule detects potentially suspicious command-line arguments used with common data compression tools like 7-Zip and WinRAR. The presence of parameters such as '-p' (password), '-hp' (header password), '-sdel' (secure delete after archiving), '-ta', '-tb', and '-dw' can indicate an adversary's attempt to archive collected data, potentially encrypt it, and then remove the original files to cover their tracks. This behavior is often observed during the collection and staging phases of an attack, prior to exfiltration. The rule includes a filter to reduce false positives by excluding processes launched from standard program file paths.
This rule detects the execution of the 'rar.exe' utility with command-line arguments indicating the creation of an archive that is either password-protected ('-hp') or uses a specific compression level ('-m'). This combination of parameters is often associated with malicious activities, such as data exfiltration or staging, where adversaries compress and password-protect data before moving it off a compromised system.
Detects potential QakBot activity by identifying specific process execution patterns previously associated with the malware. This includes scenarios where WinRAR executes wscript.exe, command lines containing 'ping.exe -n 6 127.0.0.1 & type', or regsvr32.exe executing from 'C:\ProgramData' with a '.tmp' file.
Detects the creation of ".rev" files by WinRAR, which can indicate potential exploitation of CVE-2023-40477. This vulnerability allows for arbitrary code execution. The rule looks for file creation events where the process is either 'explorer.exe' (suggesting extraction via context menu) or 'WinRAR.exe', and the created file has a '.rev' extension. Further investigation for suspicious execution or WinRAR application crashes shortly after such file creation is recommended.
Detects the use of 7-Zip utilities (7z.exe, 7za.exe, and 7zr.exe) to extract password-protected compressed files. This activity can be indicative of an adversary decompressing sensitive data or malware that was archived with a password, potentially as part of collection or staging activities.
This rule detects various keywords associated with data transfer and staging activities on Cisco devices. These activities could indicate an adversary attempting to move data onto the device for further exfiltration or to move data off the device. The keywords include common protocols and commands like 'tftp', 'rcp', 'puts', 'copy', 'configure replace', and 'archive tar', which are often used for file transfers and configuration management on network devices.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects the execution of 7-Zip (7z.exe, 7za.exe, 7zr.exe) to compress files with extensions like '.dmp', '.dump', or '.hdmp'. This activity is often a precursor to data exfiltration, where memory dump files or other sensitive data are compressed for easier transfer.
Detects a crash of the "WinRAR.exe" application with a version lower than 6.23, which could indicate an attempted exploitation of CVE-2023-40477. The rule specifically looks for Application Error events (EventID 1000) where the provider is 'Application Error' and the crashing application is 'WinRAR.exe', excluding versions 6.23 and higher.
This rule detects the creation of files with the '.dmp', '.dump', or '.hdmp' extensions. These files are typically memory dumps generated by software during a crash. While often legitimate, memory dumps can contain sensitive information, including credentials, which could be exploited by adversaries. The rule aims to identify instances where such files are created to allow for investigation into the cause of the crash and to ensure no sensitive data is exposed or exfiltrated.
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in suspicious temporary locations often used by malware for exfiltration. Adversaries may compress collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network transfer.
Detects PowerShell scripts that utilize the "Compress-Archive" cmdlet to compress folders and files, storing the output in common temporary directories often used by adversaries for data staging prior to exfiltration. This behavior is indicative of an adversary preparing collected data for exfiltration by archiving it to minimize size and make it portable.
This rule detects the use of 7-Zip to compress and password-protect data, which is a common technique used by adversaries for exfiltration. It specifically looks for the execution of 7-Zip executables (7z.exe, 7zr.exe, 7za.exe) combined with command-line arguments indicating both compression/archiving ('a' or 'u') and password protection ('-p').
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in potentially suspicious locations often used by malware for exfiltration. This activity indicates an adversary might be compressing collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network data transfer.
Detects the execution of 'diantz.exe' with command-line arguments indicating the creation of a cabinet (.cab) file and the use of an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious data within legitimate files.
This rule detects the use of 'rar.exe' to add files to an archive. Adversaries often compress collected data, such as sensitive documents, before exfiltration to make it more portable and reduce the amount of data transferred over the network. The detection specifically looks for the execution of 'rar.exe' with the 'a' command-line argument, which is used for adding files to an archive.
Detects the execution of WinRAR to compress files with '.dmp', '.dump', or '.hdmp' extensions. This activity could indicate a step in exfiltrating memory dump files or other sensitive dump files.
This rule detects the use of WinZip (winzip.exe or winzip64.exe) to compress and password-protect data. This activity is often associated with adversaries preparing data for exfiltration, as it allows them to package and secure collected information. The rule specifically looks for command-line arguments indicating the use of WinZip along with a password option and common archiving flags.
This rule detects the execution of 'diantz.exe' with command-line arguments that indicate both a remote file path (identified by '\\') and the creation of a CAB file (identified by '.cab'). This combination suggests that the 'diantz.exe' utility is being used to download a remote file and compress it into a CAB archive on the local machine. This behavior is often associated with adversaries transferring tools or data into a compromised environment.
Page 11 of 12