Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,916 detections
Filters
Last updated
All Time
Detection languages
2,236
1,064
466
410
326
Contributors
725
665
535
485
271
Categories
1,085
870
805
765
576
Platforms
1,843
1,022
856
814
656
Products / Services
988
596
477
456
383
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
4,916
CVEs
37
17
17
15
12
IDS Classtypes
196
73
47
29
16
IDS Protocols
301
27
24
22
6
Detects when a password-protected ZIP archive, likely received as an email attachment, is opened. The detection specifically looks for Event ID 5379 (Detailed File Share) in Windows Security logs, where the TargetName indicates a ZIP folder operation within the 'Temporary Internet Files\Content.Outlook' directory. This pattern is indicative of a user interacting with an email attachment that is a password-protected ZIP file.
Identifies when a service principal was removed in Azure. This action could indicate an attempt to remove legitimate service accounts to hinder detection or to clean up after malicious activity.
This rule detects the execution of 'csc.exe' as a sub-process of 'WINWORD.EXE'. This specific process relationship is indicative of exploitation attempts leveraging CVE-2017-8759, where a crafted document (opened by Winword) can lead to the execution of arbitrary code, often using csc.exe (C# compiler) to compile and execute malicious code on the fly.
Detects the exploitation of the Wazuh RCE vulnerability described in CVE-2021-26814. This rule specifically looks for a URI query containing '/manager/files?path=etc/lists/../../../../..' which is indicative of a path traversal attempt to access sensitive files outside the intended directory.
Detects exploitation attempts of CVE-2021-41773, a path traversal vulnerability in Apache HTTP Server 2.4.49. This flaw allows an attacker to map URLs to files outside the expected document root, potentially leading to information disclosure (e.g., source code of CGI scripts) or arbitrary file access if not properly protected. This vulnerability has been actively exploited in the wild and specifically affects Apache HTTP Server version 2.4.49.
Detects changes to the security groups associated with an Elastic Load Balancer (ELB) or Application Load Balancer (ALB). This can indicate that a misconfiguration allowing more traffic into the system than required, or could indicate that an attacker is attempting to enable new connections into a VPC or subnet controlled by the account.
Detects exploitation attempts against Citrix Netscaler, Application Delivery Controller (ADS), and Citrix Gateway by identifying specific URI query patterns associated with CVE-2020-8193 and CVE-2020-8195.
Detects exploitation attempts targeting CVE-2021-27905, an arbitrary file read and SSRF vulnerability affecting Apache Solr versions up to and including 8.8.1. The rule looks for specific patterns in HTTP request URIs that are indicative of this vulnerability being exploited, such as requests containing '/solr/', '/debug/dump?', 'param=ContentStream', or 'command=fetchindex' with 'masterUrl='.
Detects a potential exploitation attempt of CVE-2023-25157, a SQL injection vulnerability in GeoServer. The rule looks for specific GET requests to '/geoserver/ows' containing 'CQL_FILTER=' along with known vulnerable functions or SQL injection keywords in the query string.
Detects exceptions in the Velocity template renderer, which likely indicates dynamic rendering of user-controlled input. This vulnerability, known as Server-Side Template Injection (SSTI), can lead to Remote Code Execution (RCE) if successfully exploited.
ISO Image Mounted
Sigma
This rule detects when an ISO image is mounted on a Windows endpoint. It specifically looks for Event ID 4663 (An attempt was made to access an object) where the ObjectServer is 'Security', ObjectType is 'File', and the ObjectName starts with '\Device\CdRom'. The rule filters out common legitimate files found on mounted ISOs, such as 'autorun.ico', 'setup.exe', and 'setup64.exe', to reduce false positives. This activity can be indicative of an adversary using ISO images to bypass Mark-of-the-Web (MOTW) protections and deliver malicious payloads.
This rule detects attempts to access a webshell that has been dropped into a keystore folder on an Oracle WebLogic server. The detection is based on the URI query containing '*/config/keystore/*.js*', which is indicative of an attacker trying to interact with a webshell placed in a specific directory often associated with the CVE-2018-2894 vulnerability.
Detects exploitation attempts of the OWASSRF vulnerability targeting Microsoft Exchange servers using publicly available Proof-of-Concept (POC) code. This rule specifically looks for requests to the OWA endpoint attempting to access the PowerShell backend endpoint, characterized by a specific user agent, POST method, successful status code (200), and URI query containing both '/owa/mastermailbox' and '/powershell'. This indicates an attempt to leverage the vulnerability for remote code execution.
Detects the download of potentially malicious file types (executables, scripts, documents, archives, etc.) from domains using suspicious or commonly abused Top-Level Domains (TLDs). This rule aims to identify initial access attempts often associated with phishing or drive-by download campaigns.
Detects exploitation attempts of the OWASSRF variant targeting Exchange servers. This exploit leverages the OWA endpoint to access the PowerShell backend endpoint, often associated with CVE-2022-41080 and CVE-2022-41082.
Detects potential beaconing activity from the 3CXDesktopApp to known malicious domains associated with the 3CX supply chain compromise. This rule identifies outbound network connections initiated by the 3CXDesktopApp.exe process to a specific list of suspicious hostnames, indicating potential command and control communication.
Detects suspicious file types (such as web shells, scripts, or executables) being dropped by the IIS worker process (w3wp.exe) associated with Microsoft Exchange. This behavior is indicative of successful exploitation of Exchange vulnerabilities, often leading to the deployment of web shells for persistent access.
Detects the creation of an ISO file in the Outlook temporary folder or in the AppData temporary folder. This activity is typical of Qakbot TTPs observed from late July 2022, often associated with bypassing Mark-of-the-Web controls.
Detects suspicious activity where the MSExchangeMailboxReplication process writes .asp or .aspx files to disk. This behavior is often indicative of web shell deployment, potentially following an exploit like ProxyShell, to establish persistence or further access.
Detects exploitation attempts against Citrix Netscaler, Application Delivery Controller, and Citrix Gateway devices targeting CVE-2019-19781. The rule looks for specific URI query patterns indicative of directory traversal or direct access to vulnerable scripts.
This rule detects the creation of a new process where the parent process is 'svchost.exe' with the command line containing '-k RPCSS'. This specific parent process signature is associated with the Remote Procedure Call (RPC) service. The rule aims to identify unusual child processes spawned by the RPC service, which could indicate an exploitation attempt of vulnerabilities like CVE-2022-26809. It's considered a 'long shot' detection, meaning it targets anomalous behavior rather than a direct exploit signature.
Page 227 of 235