Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
19 detections
Filters
Last updated
All Time
Detection languages
7
5
2
2
2
Contributors
5
4
3
2
1
Categories
13
6
5
4
4
Platforms
15
2
1
1
Products / Services
5
4
2
1
1
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
IDS Classtypes
1
1
IDS Protocols
2
Detects a malicious sequence of actions originating from an Android Accessibility Service, specifically the 'SystemHelperService'. The activity involves the programmatic enablement of Developer Options and Wireless Debugging, followed by the unauthorized extraction of an ADB pairing PIN from the screen, bypassing user interaction requirements.
This rule monitors the rnpkeys.exe process for suspicious environmental reconnaissance activity, specifically targeting locale/keyboard-layout registry queries or domain enumeration via command-line tools. These activities are identified as occurring in a strict temporal sequence (pre-registration check) shortly before an initial outbound network connection, consistent with the behavior of the Sauron loader malware.
Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.
Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.
Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.
Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.
Correlates a GetUserDefaultUILanguage locale check with subsequent deletion of a known-malicious scheduled task (MicroUpdaterV1, GoogleUpdateService, or MSEdgeUpdateService) and its install directory within a 5-minute window, consistent with DeviceManager's CIS-locale sandbox/analyst evasion self-cleanup routine.
Detects the execution of known OXLOADER malware samples from temporary directories or download locations. The detection focuses on identifying specific filenames and file paths, while the rule metadata highlights the malware's behavior of performing geofencing checks (e.g., CIS region evasion) using Windows API functions to determine the system's locale.
Detects the Meow RAT malware attempting to identify the system locale and keyboard settings on macOS. This behavior is used by the malware to fingerprint the target environment and specifically avoid infection if the system is identified as belonging to CIS (Commonwealth of Independent States) regions.
Detects specific registry queries related to 'en-US' custom locale checks, often used by Grixba (Play Ransomware) to identify and evade sandbox environments. The rule also filters for process names matching known Grixba execution patterns or suspicious locations such as Public Music directories.
This rule detects network traffic (HTTP response) from a server to a client that contains both 'GetUserDefaultLCID' and 'ExitProcess' in the file data, case-insensitively. This combination of strings is indicative of malware attempting to evade sandboxes or target specific locales by checking the system's default locale identifier and then potentially exiting if the environment is not suitable. This behavior is often associated with trojan activity.
This rule detects attempts to query system language and locale information via a web shell. It specifically looks for HTTP requests where the URI contains the case-insensitive string "systeminfo". This activity is indicative of an attacker using a web shell to gather reconnaissance about the compromised system's configuration.
Detects PowerShell commands attempting to retrieve the installed UI culture name. This specific technique is utilized by the EtherRAT SYS_INFO module to check the system's locale and selectively self-destruct on CIS-region machines.
This query will detect when reg.exe is used to query the Windows registry for language settings under the Control\Nls\Language key. That registry path stores information about system locale and language configuration
Attackers sometimes query or modify these registry keys to understand or change the system’s language/locale settings.
Malware may check the system language to avoid execution in certain regions (e.g., skipping machines in Russia or China)
Attackers sometimes query or modify these registry keys to understand or change the system’s language/locale settings.
Malware may check the system language to avoid execution in certain regions (e.g., skipping machines in Russia or China)
Detects the usage of Reg.Exe to query system language settings.
Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,
or avoid targeting certain locales to evade detection.
Attackers may discover the system language to determine the geographic location of victims, customize payloads for specific regions,
or avoid targeting certain locales to evade detection.
Detects use of chcp to look up the system locale value as part of host discovery
Detects the use of the 'chcp' command, typically executed from a command prompt ('cmd.exe'), to discover the system's locale or code page information. This activity is often performed by adversaries as part of host discovery to understand the system's language settings, which can influence subsequent actions.
Detects use of chcp to look up the system locale value as part of host discovery
One of the challenges in making an AppLocker policy is knowing where applications
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
launch from. This query normalizes process launch paths through aliasing, then
counts the number of processes launched from that path, how many distinct machines it
was launched on, and how many distinct file names \ hashes these processes had. The
path is broken into subfolders to help simplify analysis.
