Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
238 detections
Filters
Last updated
All Time
Detection languages
91
71
26
15
15
Contributors
60
46
29
23
11
Categories
147
108
96
56
50
Platforms
203
19
14
8
1
Products / Services
68
38
34
12
10
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
1
1
IDS Classtypes
5
1
1
IDS Protocols
3
2
2
Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects execution of Windows Problem Steps Recorder (psr.exe), a utility used to record the user screen and clicks.
Detects the use of rar.exe, on the command line, to create an archive with password protection or with a specific compression level. This is pretty indicative of malicious actions.
Detects execution of WinRAR in order to compress a file with a ".dmp"/".dump" extension, which could be a step in a process of dump file exfiltration.
An adversary may compress or encrypt data that is collected prior to exfiltration using 3rd party utilities
Detects suspicious patterns in program names or folders that are often found in malicious samples or hacktools
Detects suspicious manipulations of default accounts such as 'administrator' and 'guest'. For example 'enable' or 'disable' accounts or change the password...etc
Page 12 of 12