Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
726 detections
Filters
Last updated
All Time
Detection languages
401
142
54
54
27
Contributors
153
152
78
42
33
Categories
227
208
134
132
119
Platforms
466
226
29
29
27
Products / Services
237
212
122
48
21
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
726
CVEs
5
5
5
4
4
IDS Classtypes
7
2
IDS Protocols
6
2
1
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Detects attempts to create a DLL file to a known desktop application dependencies folder such as Slack, Teams or OneDrive and by an unusual process. This may indicate an attempt to load a malicious module via DLL search order hijacking.
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
The following analytic detects shared files in Google Drive with suspicious filenames commonly used in spear phishing campaigns. It leverages GSuite Drive logs to identify documents with titles that include keywords like "dhl," "ups," "invoice," and "shipment." This activity is significant because such filenames are often used to lure users into opening malicious documents or clicking harmful links. If confirmed malicious, this activity could lead to unauthorized access, data theft, or further compromise of the user's system.
Alerts on trust record modification within the registry, indicating usage of macros
Detects exploits that use CVE-2017-11882 to start EQNEDT32.EXE and other sub processes like mshta.exe
This query helps hunting for email conversation take over attempts
This query finds the 10 latest logons performed by email recipients within 30 minutes after they received known malicious emails. You can use this query to check whether the accounts of the email recipients have been compromised.
This query visualises total emails with Malware detections summarizing the data by ThreatNames of the malware detected.
Detects Winword starting uncommon sub process csc.exe as used in exploits for CVE-2017-8759
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
This query checks devices for the presence of files that have been sent by a known malicious sender. To use this query, replace the email address with the address of the known malicious sender.
Detects the execution of the hdiutil utility in order to mount disk images.
Detects Winword starting uncommon sub process FLTLDR.exe as used in exploits for CVE-2017-0261 and CVE-2017-0262
Detects a suspicious program execution in Outlook temp folder
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
The .SettingContent-ms file type was introduced in Windows 10 and allows a user to create "shortcuts" to various Windows 10 setting pages. These files are simply XML and contain paths to various Windows 10 settings binaries.
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Page 31 of 35