Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
145 detections
Filters
Last updated
All Time
Detection languages
89
32
9
5
4
Contributors
42
39
20
10
8
Categories
80
53
26
17
15
Platforms
144
1
1
Products / Services
51
27
25
7
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
6
5
5
IDS Classtypes
1
IDS Protocols
1
Detects command line arguments that include '::$index_allocation', which is a technique used to create hidden directories or files within the NTFS file system. This method can prevent standard tools like 'explorer.exe' or 'powershell.exe' from accessing or listing these hidden artifacts, serving as a defense evasion tactic.
This rule detects the creation of an Alternate Data Stream (ADS) that contains an executable file. It specifically looks for the presence of a non-empty Import Hash (Imphash) within the created stream, indicating executable content. The rule filters out streams with a null Imphash, which typically correspond to non-executable data.
This rule detects when 'regedit.exe' is used to export a registry key to an Alternate Data Stream (ADS). This technique can be used by adversaries to hide data, such as exported registry keys, within existing files to evade detection. The rule specifically looks for the execution of 'regedit.exe' which is a legitimate Windows utility, making the detection focused on its suspicious usage in conjunction with ADS.
Detects the download of suspicious file types from URLs containing direct IP addresses. This rule specifically looks for the creation of Zone.Identifier alternate data streams (ADS) for common executable or script file extensions, indicating a file downloaded from the internet, combined with a URL that uses an IP address instead of a domain name. This behavior can be indicative of malware delivery or staging.
Detects PowerShell script execution from an Alternate Data Stream (ADS). This rule identifies instances where 'powershell.exe' or 'pwsh.exe' is launched, and its command line arguments include 'Get-Content' and '-Stream'. This combination indicates that PowerShell is being used to read and potentially execute content hidden within an Alternate Data Stream, a common technique for defense evasion.
This rule detects PowerShell commands that attempt to store data in an Alternate Data Stream (ADS) by redirecting the output of a command executed via `cmd.exe` (comspec) into a file using the `>` operator. This technique is often used by malware, such as Astaroth, to hide malicious data within legitimate files, making it harder to detect.
Detects attempts to write data into NTFS Alternate Data Streams (ADS) using PowerShell cmdlets like `Set-Content` or `Add-Content` in conjunction with the `-Stream` parameter. This technique can be used by adversaries to hide malicious data or executables on a system.
Detects the execution of 'diantz.exe' with command-line arguments indicating the creation of a cabinet (.cab) file and the use of an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious data within legitimate files.
Detects the use of extrac32.exe to extract data from a cabinet (.cab) file and hide it within an Alternate Data Stream (ADS). This technique can be used for defense evasion by concealing malicious payloads.
Detects execution from an Alternate Data Stream (ADS) using various Windows utilities. Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection. The rule specifically looks for command-line patterns indicative of reading from an ADS (e.g., 'txt:') combined with common tools like 'type', 'makecab', 'reg', 'regedit', or 'esentutl' that can interact with or extract data from streams.
Detects the use of Windows 8.3 short names in process images, which can be leveraged by adversaries as a defense evasion technique to bypass image-based detections. This rule specifically looks for common executable and script file extensions preceded by '~1' or '~2' in the Image path.
Detects the execution of rundll32 where the DLL being called is stored within an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious code.
This rule detects the use of Windows 8.3 short names in command-line arguments. Adversaries may use this technique to obfuscate their commands and evade detection by security tools that rely on full file paths or specific keywords. The rule specifically looks for patterns like '~1.exe', '~1.bat', etc., which are indicative of short name usage. This can be a defense evasion technique.
Detects execution of "findstr" with specific flags and a remote share path. This specific set of CLI flags would allow "findstr" to download the content of the file located on the remote share as described in the LOLBAS entry.
Detects the creation of an ADS (Alternate Data Stream) that contains an executable by looking at a non-empty Imphash
Detects writing data into NTFS alternate data streams from powershell. Needs Script Block Logging.
Storing files in Alternate Data Stream (ADS) similar to Astaroth malware.
Detects execution from an Alternate Data Stream (ADS). Adversaries may use NTFS file attributes to hide their malicious data in order to evade detection
Detects PowerShell script execution from Alternate Data Stream (ADS)
Page 7 of 7