Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
89
32
9
5
4
Contributors
42
39
20
10
8
Categories
80
53
26
17
15
Platforms
144
1
1
Products / Services
51
27
25
7
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
6
5
5
IDS Classtypes
1
IDS Protocols
1
Detects unauthorized ISO or virtual disk mounting activity combined with the creation of a working directory using the 'RP_' prefix under the system temporary folder. This pattern is indicative of the RoguePlanet exploit staging process, which often uses NTFS junction redirection to bypass security controls like Windows Defender quarantine.
This rule detects suspicious file activity involving Alternate Data Streams (ADS) and file names containing 'WDFOO' or 'wermgr.exe' within specific 'RP_' staging directories. Such activity is often associated with file-based staging, persistence, or potential obfuscation techniques using NTFS streams.
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
Identifies multiple directory junctions being created in a short time frame by the same user or process. This behavior indicates the potential setup of a GhostTree binary tree-like structure, which creates recursive loops to evade EDR and folder scans.
Detection of VBScript/HTA components executing from NTFS Alternate Data Streams (e.g., :GTR or :URL) used by GammaWorm.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity, hardcoded artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
Identifies the execution of the built-in CMD command 'mklink' using the '/J' switch, which creates an NTFS directory junction. Attackers use this to build recursive loops for EDR evasion.
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects NTFS ADS used to hide malicious payloads from standard directory listings
Detects crafted RAR archives abusing NTFS ADS path traversal to drop malicious payloads.
This rule detects network traffic over SMB (port 445) that contains patterns indicative of a payload hidden within an NTFS Alternate Data Stream (ADS). Specifically, it looks for the string ":$DATA" followed by ".exe" (case-insensitive) in the TCP payload, which is a common technique used by malware to conceal executable files within legitimate files.
WScript Execution From ADS
Cortex XDR
Detects wscript.exe or cscript.exe executing a script from an Alternate Data Stream (ADS) path, specifically within the Users directory, as indicated by a colon without a preceding drive letter context. This behavior is known to be used by malware like GammaWorm for persistence by executing hidden VBScript payloads.
Detects crafted RAR archives abusing NTFS ADS path traversal to drop malicious payloads.
Detects the execution of an Alternate Data Stream (ADS) payload located in the %TEMP% directory via wscript.exe, a critical persistence mechanism used by Gamaredon's GammaLoad.
Detects wscript.exe or cscript.exe executing a script hidden within an NTFS Alternate Data Stream (ADS). This technique is notably used by the Gamaredon group's GammaWorm to maintain fileless persistence and conceal malicious VBScript payloads (e.g., %USERPROFILE%:GTR).
Detects the execution of wscript.exe targeting a script concealed within an Alternate Data Stream (ADS) in the user profile directory. This technique is heavily used by Gamaredon's GammaWorm for persistence and execution.
Detects the download of suspicious file type from URLs with IP
Detects the creation of a named file stream with the imphash of a well-known hack tool
Detects the execution of the "chflags" utility with the "hidden" flag, in order to hide files on MacOS.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
When a file or directory has this hidden flag set, it becomes invisible to the default file listing commands and in graphical file browsers.
Page 3 of 7