Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
54
22
10
8
7
Contributors
23
21
16
12
7
Categories
58
36
34
24
16
Platforms
93
18
4
4
1
Products / Services
36
25
12
7
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
2
IDS Protocols
4
Detects files associated with the ClipXDaemon malware campaign based on their SHA256 hashes.
Detects the creation of files within hidden folders on removable media that are designed to mimic the Windows Recycle Bin ($RECYCLE.BIN or $RECYCLE.BIN.USER). This technique is used by APT37's THUMBSBD and VIRUSTASK malware to stage malicious files (.rb, .dat) for bridging air-gapped networks.
Detects the creation of specific directories (Bluetooth, ProShow, Adobe\Scripts) in the AppData folder by the Notepad++ updater (GUP.exe), a behavior associated with the Chrysalis backdoor persistence mechanism.
Detects the use of non-standard signals with the 'kill' command, which are used to manage the ShadowGuard eBPF rootkit's process hiding capabilities. Signal -900 is used for allow-listing a PID, and -901 is used to remove a PID from the allow-list.
Detects the creation of a hidden directory under %LOCALAPPDATA%\Google Chrome. This technique is used by a Vietnamese threat actor associated with the PureRAT campaign to stage malicious components while blending in with legitimate application data.
Detects the use of attrib.exe to set system (+s) and hidden (+h) attributes on an executable file in a suspicious folder. This technique was observed being used by threat actors to hide payloads like SparkRAT.
Detects the creation or modification of the '/tmp/sslvpn.log' file, a known artifact of a new Linux variant of the Lazarus BADCALL backdoor.
Detects a process executing from a temporary directory that masquerades as the legitimate 'systemd-logind' service. This behavior is characteristic of the V3G4 Mirai-derived botnet, which uses this technique to evade detection.
Detects the use of the 'attrib.exe' utility to set the hidden attribute on a .lnk file. Adversaries may use this technique to hide malicious shortcuts used for persistence or initial execution.
Detects various activities associated with the DRAYN malware family, as described in a detailed analysis. This includes stealthy installation command-line arguments, PowerShell-based system reconnaissance, and modification of file permissions for defense evasion.
Detects suspicious file writes or modifications within the 'CryptnetUrlCache' directory. Malware abuses this directory to hide payloads and configuration files, blending in with legitimate system activity.
Detects calls to hidden files or files located in hidden directories in Linux systems. This rule specifically looks for file paths containing '/.' which is a common convention for hidden files and directories in Unix-like systems, while filtering out common legitimate hidden paths like '.cache' and '.config'.
Detects registry modifications that hide internal tools or functions from the user, a technique often employed by malware such as Agent Tesla and Hermetic Wiper. The rule specifically looks for changes to registry keys related to hiding clock, health, network, power, and volume icons in the system tray, as well as disabling advanced explorer features like showing info tips or compressed file colors.
The analytic detects the use of Windows Curl.exe to download a file to a suspicious location, such as AppData, ProgramData, or Public directories. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions that include the -O or --output options. This activity is significant because downloading files to these locations can indicate an attempt to bypass security controls or establish persistence. If confirmed malicious, this behavior could lead to unauthorized code execution, data exfiltration, or further compromise of the system.
This detection identifies the use of attrib.exe to remove hidden (-h) or system (-s) attributes from the Default.rdp file, which is automatically created in a user's Documents folder when a Remote Desktop Protocol (RDP) session is initiated using mstsc.exe. The Default.rdp file stores session configuration details such as the remote host address and screen settings. Unhiding this file is uncommon in normal user behavior and may indicate that an attacker or red team operator is attempting to access or manipulate RDP connection history that was previously hidden—either by default or as part of an earlier anti-forensics effort. This activity may represent part of a broader pattern of reconnaissance or staging for credential reuse, lateral movement, or forensic analysis evasion. Monitoring for this behavior can help uncover suspicious manipulation of user artifacts and highlight interactive attacker activity on a compromised host.
Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign, often used with an append redirection operator ">>" to update file content indirectly. This technique can be used by attackers to append data to files, as demonstrated by the example: `cmd /c >> example.txt set /p="test data"` which appends "test data" to "example.txt". The rule specifically looks for `cmd.exe` executions containing `/c set /p=` or `"set /p=` or `>>*set /p=` in the command line.
Detects the execution of the "chflags" utility with the "hidden" flag on macOS. When this flag is set on a file or directory, it becomes invisible to default file listing commands and graphical file browsers, a common technique used by adversaries for defense evasion.
This rule detects the creation of hidden files or directories on Linux systems. It specifically looks for common commands like 'mkdir', 'nano', 'touch', 'vi', or 'vim' being executed with arguments that start with a '.' (dot), which is the standard convention for hidden files and directories in Unix-like operating systems. This behavior is often used by adversaries for defense evasion.
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Detects the usage of attrib with the "+s" option to set scripts or executables located in suspicious locations as system files to hide them from users and make them unable to be deleted with simple rights. The rule limits the search to specific extensions and directories to avoid FPs
The following analytic detects the use of the Windows binary attrib.exe to hide files or directories by marking them with specific flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments that include the "+h" flag. This activity is significant because hiding files can be a tactic used by attackers to conceal malicious files or tools from users and security software. If confirmed malicious, this behavior could allow an attacker to persist in the environment undetected, potentially leading to further compromise or data exfiltration.
Page 4 of 6