Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
54
22
10
8
7
Contributors
23
21
16
12
7
Categories
58
36
34
24
16
Platforms
93
18
4
4
1
Products / Services
36
25
12
7
4
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
2
IDS Protocols
4
Detects process execution from a fake recycle bin folder, which is a common technique used by adversaries to evade security solutions and hide malicious executables. The rule specifically looks for process images (executables) located within paths containing 'RECYCLERS.BIN\' or 'RECYCLER.BIN\'.
Detects the execution of the `attrib.exe` utility with the `+s` flag, which is used to mark files as system files. This technique can be used by adversaries to hide malicious files from users and some security tools, contributing to defense evasion.
Detects the creation of suspicious files and folders inside the user's AppData folder but not within the common and well-known subdirectories (Local, Roaming, LocalLow). This technique can be used by adversaries to bypass detections that exclude common AppData paths to reduce false positives.
This rule detects the use of the `attrib.exe` utility to hide files by setting the hidden attribute (`+h`). Adversaries often use this technique to conceal malicious files or directories from users and basic forensic analysis, aiding in defense evasion. The rule specifically looks for the execution of `attrib.exe` with the `+h` command-line argument.
Detects the usage of `attrib.exe` with the `+s` option to set scripts or executables located in suspicious directories as system files. This technique is used to hide files from users and prevent them from being easily deleted. The rule specifically targets common suspicious locations and file extensions to reduce false positives.
This rule detects modifications to the Windows Registry that are used to hide file extensions or make files hidden. Specifically, it looks for changes to the 'HideFileExt' and 'Hidden' DWORD values within the 'SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced' registry key. Setting 'HideFileExt' to '0x00000001' hides known file extensions, and setting 'Hidden' to '0x00000002' shows hidden files, which could be used by an attacker to manipulate visibility of malicious files.
Detects the use of `icacls.exe` with specific command-line arguments to deny access for everyone (represented by the SID *S-1-1-0*) to a file or directory. This technique is often used by adversaries to hide malicious files by making them inaccessible to users and potentially some security tools.
Detects modifications to the "Hidden" and "ShowSuperHidden" explorer registry values in order to disable showing of hidden files and system files.
This technique is abused by several malware families to hide their files from normal users.
This technique is abused by several malware families to hide their files from normal users.
Detects registry modifications that hide internal tools or functions from the user (malware like Agent Tesla, Hermetic Wiper uses this technique)
Page 6 of 6