Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
401 detections
Filters
Last updated
All Time
Detection languages
194
103
41
21
13
Contributors
106
64
60
37
30
Categories
195
194
151
46
31
Platforms
395
6
4
1
1
Products / Services
140
106
95
57
28
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
1
1
1
1
IDS Classtypes
2
1
1
IDS Protocols
1
1
Detects PAExec service installation
Detects blocking of process creations originating from PSExec and WMI commands
Detects default CSExec service filename which indicates CSExec service installation and execution
Detects PAExec default named pipe
Detects PsExec default pipe creation where the image executed is located in a suspicious location. Which could indicate that the tool is being used in an attack
Detects the use of smbexec.py tool by detecting a specific service installation
Detects well-known credential dumping tools execution via service execution events
Detects powershell script installed as a Service
Detects CSExec service installation and execution events
Detects installation or execution of services
Detects PsExec service installation and execution events
Detects default RemCom service filename which indicates RemCom service installation and execution
Detects default PsExec service filename which indicates PsExec service installation and execution
Detects default CSExec pipe creation
Detects the usage of the "net.exe" command to start a service using the "start" flag
Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative
Detects the use of NSudo tool for command execution
Detects that a powershell code is written to the registry as a service.
Detects default RemCom pipe creation
This rule detects the WhiteBlackCrypt ransomware by identifying specific byte patterns associated with its file finding, file encryption, and service registration functionalities. The rule looks for a combination of these patterns within a PE file, indicated by the 'MZ' header.
This YARA rule detects the HakunaMatata ransomware by identifying specific byte patterns associated with its file encryption routines, file searching mechanisms, and remote connection capabilities. The rule looks for multiple combinations of these patterns to increase accuracy and reduce false positives. It also includes patterns related to service installation, which is a common persistence mechanism for ransomware.
Page 19 of 20