Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
7
4
4
2
1
Contributors
4
3
2
2
2
Categories
10
7
3
3
3
Platforms
12
4
3
2
Products / Services
6
2
1
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
CVEs
1
IDS Classtypes
1
IDS Protocols
1
Detects a setx.exe process launched by python.exe or pip.exe with a command line referencing the PYTHONPATH environment variable. This matches setup.py build-time tampering that persistently rewrites the user's PYTHONPATH, redirecting future module resolution for the affected user to an attacker-controlled directory across all subsequent Python invocations.
This rule detects potential persistence via Python environment variable manipulation (PYTHONPATH) followed by suspicious network activity from a child process of python.exe. It specifically looks for the modification of the PYTHONPATH environment variable using PowerShell on Windows or shell configuration files on Unix-like systems, followed by a python.exe-initiated network connection (like curl) to external domains, which may indicate the execution of a malicious sitecustomize.py hook.
The following analytic detects modification of the PYTHONPATH environment variable in conjunction with a package installation process.
Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules.
If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.
Python looks up the `sys.path` variable, which is generated by combining user and site folders with `.pth` files and the value of the PYTHONPATH environment variable, to determine which directories to use for importing modules.
If an adversary is able to control the value of PYTHONPATH, they can point it to an attacker-controlled directory and hijack imported packages, achieving user-level persistence across future Python invocations and new shell sessions.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked by the affected user.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Detects modification of PATH environment variable for binary hijacking
This rule detects attempts to hijack the PATH environment variable during an SSH session. It specifically looks for the string "export PATH=" within TCP traffic on port 22 (SSH), indicating a potential malicious modification of the PATH environment variable to control command execution paths.
This rule detects the execution of a Linux process where the command line contains environment variables related to dynamic linker debugging (LD_AUDIT, LD_DEBUG, or LD_DEBUG_OUTPUT). These variables can be abused by adversaries to load malicious libraries, bypass security controls.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
Detects the telnetd process spawning child processes with highly suspicious environment variables, such as a modified PATH or LD_PRELOAD. This can indicate an attempt to hijack execution or move laterally, and is a technique associated with CVE-2026-24061.
This rule detects the creation of an executable named 'Get-Variable.exe' within the 'Local\Microsoft\WindowsApps\' directory. This is a suspicious activity because 'Get-Variable' is a legitimate PowerShell cmdlet, not an executable. Adversaries can exploit the Windows application execution alias feature, where executables in the WindowsApps directory can be prioritized over PowerShell cmdlets with the same name. By placing a malicious 'Get-Variable.exe' in this path, an attacker can trick the system into executing their malicious binary instead of the intended PowerShell cmdlet when 'Get-Variable' is invoked, leading to persistence or privilege escalation.
Detects changes to the "Default" property for keys located in the \Software\Microsoft\Windows\CurrentVersion\App Paths\ registry. This might be used as a method of persistence. The entries found under App Paths are used primarily to map an application's executable file name to that file's fully qualified path and to prepend information to the PATH environment variable on a per-application, per-process basis.
Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server. This detection monitors error messages and failure patterns that could signal attempts to abuse model loading functionality for malicious purposes.
Detects DLLs loading from a spoofed Windows directory path with an extra space (e.g "C:\Windows \System32") which can bypass Windows trusted path verification.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
This technique tricks Windows into treating the path as trusted, allowing malicious DLLs to load with high integrity privileges bypassing UAC.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
This query was originally published in the threat analytics report, EvilQuest signals the rise of Mac ransomware.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
As of the time of this writing (October 2020), ransomware designed to target macOS is relatively rare. EvilQuest is one of the few examples of this kind of malware on the platform.
The query below can detect events associated with the launch of the EvilQuest executable, questd, from the shell.
Other queries related to EvilQuest ransomware can be found under the See also section below.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
