Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
89
32
9
5
4
Contributors
42
39
20
10
8
Categories
80
53
26
17
15
Platforms
144
1
1
Products / Services
51
27
25
7
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
6
5
5
IDS Classtypes
1
IDS Protocols
1
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects the redirection of an alternate data stream (ADS) of / within a Windows command line session
Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).
Compress target file into a cab file stored in the Alternate Data Stream (ADS) of the target file.
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection
Detects the creation of hidden file/folder with the "::$index_allocation" stream. Which can be used as a technique to prevent access to folder and files from tooling such as "explorer.exe" and "powershell.exe"
Detects the redirection of an alternate data stream (ADS) of / within a Windows command line session
Detects the download of suspicious file type from a well-known file and paste sharing domain
Attackers can use findstr to hide their artifacts or search specific strings and evade defense mechanism
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid Image based detection
Detects execution of rundll32 where the DLL being called is stored in an Alternate Data Stream (ADS).
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection
Detect use of the Windows 8.3 short name. Which could be used as a method to avoid command-line detection
Exports the target Registry key and hides it in the specified alternate data stream.
Detects the download of suspicious file type from URLs with IP
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Extract data from cab file and hide it in an alternate data stream
This analytic detects the writing of data with an IMPHASH value to an Alternate Data Stream (ADS) in the NTFS file system. It leverages Sysmon Event ID 15 and regex to identify files with a Portable Executable (PE) structure. This activity is significant as it may indicate a threat actor staging malicious code in hidden areas for persistence or future execution. If confirmed malicious, this could allow attackers to execute hidden code, maintain persistence, or escalate privileges within the environment.
The analytic detects when a process attempts to execute a file from within an NTFS file system alternate data stream. This detection leverages process execution data from sources like Windows process monitoring or Sysmon Event ID 1, focusing on specific processes known for such behavior. This activity is significant because alternate data streams can be used by threat actors to hide malicious code, making it difficult to detect. If confirmed malicious, this could allow an attacker to execute hidden code, potentially leading to unauthorized actions and further compromise of the system.
This rule detects the creation of a named file stream (Alternate Data Stream - ADS) containing specific Imphash values associated with known hack tools. The Imphash values are for tools such as Mimikatz, PetitPotam, JuicyPotato, RoguePotato, Pwdump, Cobalt Strike beacons, NanoDump, HandleKatz, DripLoader, UACMe, Dumpert, EDRSandBlast, and others. Adversaries often use ADSs to hide malicious executables or data to evade detection by traditional security tools that may not scan alternate data streams.
Detects the creation of hidden files or folders by appending the "::$index_allocation" stream to their names. This technique can be used by adversaries to prevent standard tools like Windows Explorer or PowerShell from accessing or listing these hidden artifacts, thereby evading detection and hindering forensic analysis.
Page 6 of 7