Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This detection identifies suspicious DLL loads by SpeechRuntime.exe from outside the expected system directories. SpeechRuntime is vulnerable to a COM hijacking attack that allows an attacker to execute code remotely and stealthily by exploiting a Windows COM class. By altering the registry to point to a malicious DLL and then triggering the COM object, the attacker can cause the malicious DLL to load into SpeechRuntime.exe and execute in the user's context.
Detects the creation of a new Windows service (EventID 7045) where the service's ImagePath contains suspicious command-line flags ('-c', '-r', '-k') often used with scripting engines, and the ImagePath itself references common scripting or proxy execution binaries such as cscript, mshta, powershell, pwsh, regsvr32, rundll32, or wscript. This combination indicates an attempt to install a service that executes a script or uses a living-off-the-land binary for malicious purposes, potentially for persistence or privilege escalation.
Detects PowerShell preparing to execute shellcode using the CallWindowProc API. This technique is used to bypass EDRs by executing code without creating a new thread, which is a commonly monitored API call.
This rule detects the use of PsExec or PAExec with command-line flags designed to escalate privileges to the LOCAL_SYSTEM account. Specifically, it looks for the '-s' flag, optionally combined with '-i', followed by common shell executables like 'cmd', 'powershell', or 'pwsh'. This behavior is indicative of an attempt to gain SYSTEM-level access on a Windows machine.
Detects various techniques, procedures, and indicators associated with the RustyPages macOS malware dropper, including persistence, defense evasion, payload download, and known IOCs. This rule specifically looks for the use of `curl` to download a hidden file, `launchctl` to establish persistence, `chmod` to make the payload executable, `xattr` to clear extended attributes, `pgrep` to discover security tools, shell commands to silence notifications, C2 domain/IP connections, and known malware file hashes.
Detects a Component Object Model (COM) TypeLib hijacking persistence technique. This rule identifies modifications to the registry for the 'Microsoft Web Browser' CLSID, where it is altered to point to a malicious scriptlet (.sct) file. This specific method was used by the MixShell malware in the ZipLine campaign to maintain access.
The following analytic detects the creation of a Scheduled Task with a high entropy, randomly generated name, leveraging Event ID 4698. It uses the `ut_shannon` function from the URL ToolBox Splunk application to measure the entropy of the Task Name. This activity is significant as adversaries often use randomly named Scheduled Tasks for lateral movement and remote code execution, employing tools like Impacket or CrackMapExec. If confirmed malicious, this could allow attackers to execute arbitrary code remotely, potentially leading to further compromise and persistence within the network.
The following analytic detects the creation of scheduled tasks on remote Windows endpoints using the at.exe command. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process creation events involving at.exe with remote command-line arguments. Identifying this activity is significant for a SOC as it may indicate lateral movement or remote code execution attempts by an attacker. If confirmed malicious, this activity could lead to unauthorized access, persistence, or execution of malicious code, potentially resulting in data theft or further compromise of the network.
This YARA rule detects the Pumakit rootkit on Linux systems. It identifies specific byte patterns associated with the rootkit's syscall hooking mechanisms, including patterns related to hooking `rmdir` and `gdents64` functions. The rule looks for these distinct code sequences within executable files to indicate the presence of the Pumakit rootkit.
Detects potential DLL side-loading of the CANONSTAGER malware, which is used to deploy the SOGU.SEC backdoor. This rule identifies when the legitimate, signed Canon IJ Printer Assistant Tool (cnmpaui.exe) loads an unsigned DLL with a similar name (cnmpaui.dll) and subsequently reads a .dat file (cnmplog.dat), consistent with the TTPs of the PRC-nexus actor UNC6384.
Detects a command line process that uses explorer.exe to launch arbitrary commands or binaries, which is similar to cmd.exe /c, only it breaks the process tree and makes its parent a new instance of explorer spawning from "svchost". This technique can be used for defense evasion by obscuring the true parent process.
Detects unknown programs attempting to escalate privileges to LOCAL SYSTEM by using command-line arguments commonly associated with tools like PsExec and PAExec. The rule specifically looks for combinations of '-s' (run as SYSTEM) and '-i' (interact with desktop) flags followed by common shell executables like 'cmd', 'pwsh', or 'powershell'. It filters out known instances of 'paexec' and 'PsExec' to avoid overlap with more specific rules.
This analytic identifies suspicious child processes spawned by `WScript.exe` or `CScript.exe`. Adversaries and malware commonly use these scripting hosts to execute various Living Off the Land Binaries (LOLBINs), other scripts like PowerShell, or to spawn suspended processes for code injection as a defense evasion technique. While this TTP may detect some legitimate scripts that utilize the listed child processes, it serves as a strong indicator that a script might be executing suspicious code.
Detects when new credentials are added to an Entra ID Service Principal, followed by a successful login from that principal within a short time frame. This pattern is consistent with MURKY PANDA TTPs for lateral movement and persistence in cloud environments.
The analytic detects the creation of scheduled tasks designed to execute commands using native Windows shells like PowerShell, Cmd, Wscript, or Cscript. It leverages Windows Security EventCode 4698 to identify when such tasks are registered. This activity is significant as it may indicate an attempt to establish persistence or execute malicious commands on a system. If confirmed malicious, this could allow an attacker to maintain access, execute arbitrary code, or escalate privileges, posing a severe threat to the environment.
Detects a user self-assigning access to a large number of applications in Okta within a short time frame. This behavior is associated with the threat group UNC3944 (Scattered Spider) for privilege escalation and lateral movement across SaaS applications.
Detects the execution of a legitimate SentinelOne executable, 'SentinelBrowserNativeHost.exe', from a suspicious location (such as user profile, ProgramData, or Temp directories), which then sideloads a malicious 'SentinelAgentCore.dll'. This is a technique used by Cephalus ransomware.
This rule detects changes to privileged roles and group memberships within Azure Active Directory. It helps identify potential unauthorized privilege escalation, supports compliance and audit requirements, and allows correlation of identity changes with suspicious activity or alerts. The rule specifically looks for operations such as adding/removing members from roles or groups, and updating role memberships or user details, ensuring the operation was successful.
This rule detects GlobalProtect VPN login attempts originating from outside of Canada. This can help identify potential unauthorized access or policy violations where users are expected to connect from specific geographic regions.
This detection rule identifies suspicious logins by service accounts on devices they haven't accessed in the last 14 days. This behavior could indicate a compromised service account being used for lateral movement within the environment. Service accounts typically have a static set of devices they authenticate to, making deviations easier to spot compared to user accounts. However, some service accounts (e.g., MDI service accounts) are known to dynamically log into devices, which may require environment-specific fine-tuning to reduce false positives.
This rule audits the state of service accounts in the environment by counting total, enabled, and disabled service accounts. This helps in identifying unused or stale service accounts, ensuring only necessary service accounts are active to reduce the attack surface, and supporting compliance and security posture assessments.
Page 283 of 401