Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
726 detections
Filters
Last updated
All Time
Detection languages
401
142
54
54
27
Contributors
153
152
78
42
33
Categories
227
208
134
132
119
Platforms
466
226
29
29
27
Products / Services
237
212
122
48
21
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
726
CVEs
5
5
5
4
4
IDS Classtypes
7
2
IDS Protocols
6
2
1
Detects the creation of recent file shortcuts (.lnk) that point to disk image files (.iso, .img, .vhd, .vhdx). This activity is often observed in phishing attacks where adversaries use these file types to deliver malware. The rule specifically looks for these shortcuts within the 'Recent' folder of a user's profile, indicating that the user has recently interacted with such a file.
Detects the creation of a 'gbb.exe' process as a sub-process of 'Hwp.exe' (Hangul Word Processor). This behavior is highly suspicious and often indicative of exploitation attempts targeting vulnerabilities within the HWP application, leading to the execution of malicious payloads.
This rule detects the execution of any program from the Outlook temporary files folder, which is often used by adversaries to drop and execute malicious payloads received via email. This activity is highly suspicious as legitimate applications typically do not execute from this location.
This rule detects the execution of arbitrary shell commands via the '.SettingContent-ms' file type. These files, introduced in Windows 10, are XML-based shortcuts to Windows settings pages. Adversaries can manipulate these files to execute malicious commands, bypassing typical execution controls. The rule specifically looks for process creation events where the command line contains '.SettingContent-ms' and excludes legitimate calls to 'immersivecontrolpanel'.
This rule detects modifications to the Windows Registry key associated with "TrustRecords" for Microsoft Office applications. These trust records are created when a user enables macros in a document, indicating that the document's source is trusted. Adversaries often leverage malicious macros in documents as an initial access vector. Monitoring changes to this registry path can help identify when macros are being enabled, potentially by a user interacting with a malicious document.
Detects suspicious Hangul Word Processor (Hanword) sub processes that could indicate an exploitation
Detects suspicious child processes of the Microsoft OneNote application. This may indicate an attempt to execute malicious embedded objects from a .one file.
Detects a suspicious program execution in Outlook temp folder
Alerts on trust record modification within the registry, indicating usage of macros
ISO Image Mounted
Sigma
Detects the mount of an ISO image on an endpoint
Detects the creation of recent element file that points to an .ISO, .IMG, .VHD or .VHDX file as often used in phishing attacks.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
This can be a false positive on server systems but on workstations users should rarely mount .iso or .img files.
Detects the creation of a office macro file from a a suspicious process
Page 35 of 35