Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
This YARA rule detects the Skuld infostealer by identifying specific byte patterns associated with its functionalities. These functionalities include retrieving the MAC address of the infected system, enumerating files (likely for data collection), taking screenshots, and specifically targeting Discord backup codes. The rule looks for a combination of these distinct code patterns within a PE file (indicated by the MZ header).
Software Inventory by OS
Find Endpoints policies settings via compliance settings in the registry
This rule detects attempts to discover local user accounts and system owner/user information using various Windows command-line utilities. It specifically looks for the execution of `cmd.exe` with `dir \users\` (excluding `rmdir`), `net.exe` or `net1.exe` with `user` (excluding common account management actions), `whoami.exe`, `quser.exe`, `qwinsta.exe`, `wmic.exe` with `useraccount get`, and `cmdkey.exe` with `/l`. These commands are frequently used by adversaries to gain situational awareness about the system's users.
Detects remote RPC calls made by SharpHound, a BloodHound data collector, to enumerate remote connections and local group memberships. This specific rule targets the MS-SRVS protocol (Server Service Remote Protocol) interface UUID 4b324fc8-1670-01d3-1278-5a47bf6ee188 and operation number 12, which is associated with session enumeration.
Endpoint Inventory
Find Mounted ISO files and drive letters
Detects attempts by an identity to enumerate its Kubernetes Role-Based Access Control (RBAC) permissions. This activity is often observed in the early stages of a breach as attackers try to understand their access within a compromised Kubernetes environment. This can be achieved by querying the Kubernetes API server's SelfSubjectRulesReview API, for example, using the "kubectl auth can-i --list" command.
List all devices that are not onboarded
Detects remote RPC calls used by SharpHound to map remote connections and local group membership. This rule specifically targets the MS-WKST protocol (Workstation Service Remote Protocol) interface UUID and operation number associated with SharpHound's reconnaissance activities.
This rule detects attempts to enumerate local system groups on Linux. Adversaries often perform this discovery technique to understand the environment and identify users with elevated permissions. The rule triggers on execution of the 'groups' command or on common file viewing utilities (cat, ed, head, less, more, nano, tail, vi, vim) when they are used to read the '/etc/group' file.
Detects the execution of common text-based file access or inspection utilities to read the content of the '/etc/sudoers' file on Linux systems. This activity is often performed by adversaries to discover users with sudo rights, which can be a precursor to privilege escalation.
This rule detects the execution of SharpView, a .NET port of PowerView, which is a popular PowerShell tool used for Active Directory reconnaissance. The rule specifically looks for the `SharpView.exe` executable or its command-line arguments containing various reconnaissance functions. These functions are commonly used by adversaries to discover information about domain computers, users, groups, trusts, policies, and network shares within an Active Directory environment.
Detects the use of the `sysinfo` system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes. Malware or reconnaissance tools might leverage `sysinfo` to fingerprint the system, gathering data to determine if it's a viable target.
This rule detects the execution of specific 'net group' and 'net localgroup' commands that are commonly used for Active Directory enumeration. These commands are often leveraged by adversaries to discover domain-level groups, local administrator groups, and domain administrator groups, which can help them identify privileged accounts and plan further attacks. The rule is designed to flag multiple occurrences of these commands within a 15-minute window on a single host, as a single execution might be benign, but repeated executions suggest reconnaissance activity. The detection logic specifically looks for 'net localgroup administrators', 'net group /dom', and 'net group Domain Admins /dom', optionally preceded by 'cmd /c'.
This rule detects various network enumeration commands commonly used by adversaries for reconnaissance, as identified in the CISA Living off the Land report. It specifically looks for commands like 'arp -a', 'curl www.ip-api.com', 'dnscmd /enumrecords', 'dnscmd /enumzones', 'ipconfig /all', 'netsh' commands related to firewall and portproxy, and 'netstat -ano'. Additionally, it detects DNS queries for 'www.ip-api.com', which can be indicative of C2 frameworks like Covenant attempting to check for internet connectivity or external IP addresses.
This rule detects outbound network connections to IP addresses that exhibit low prevalence within the monitored environment. Specifically, it flags connections to IPs that have a rolling maximum prevalence of 1 to 3 occurrences over a 10-day period. This behavior can be indicative of command and control (C2) communication, data exfiltration, or other suspicious activities where adversaries might use newly registered or rarely seen infrastructure.
The following analytic identifies the use of cleartext protocols that risk leaking sensitive information. It detects network traffic on legacy protocols such as Telnet (port 23), POP3 (port 110), IMAP (port 143), and non-anonymous FTP (port 21). The detection leverages the Network_Traffic data model to identify TCP traffic on these ports. Monitoring this activity is crucial as it can expose credentials and other sensitive data to interception. If confirmed malicious, attackers could capture authentication details, leading to unauthorized access and potential data breaches.
Detects the execution of host or user discovery utilities such as "whoami", "hostname", "id", "last", "uname", "users", "w", and "who" on Linux systems. Adversaries use these commands to gather information about the system and its users to inform subsequent actions.
This rule detects various system enumeration commands commonly used by adversaries for reconnaissance, as identified in a CISA "Living off the Land" report. The rule looks for the execution of utilities like `wevtutil`, `ldifde.exe`, `reg query`, `systeminfo`, `tasklist`, `whoami`, and `wmic` with specific arguments that indicate system information discovery. While these commands can be benign, their frequent or combined execution on a single host within a 15-minute window (more than 5 distinct command lines) can be indicative of malicious activity.
This rule detects suspicious command-line executions on Windows systems, as identified in a CISA 'Living off the Land' report. The rule looks for specific patterns in process command lines that, while potentially benign in isolation, could indicate reconnaissance, lateral movement, or data staging activities when observed in concert. Examples include the use of 7-Zip for archiving with a password, specific `pcwrun.exe` or `rar.exe` commands, `ping` commands with unusual parameters or output redirection, `dir` commands targeting network shares, `wmic` commands for process creation or `whoami` execution, `net use` commands for IPC shares, `xcopy` for data movement, and PowerShell commands to launch hidden batch files.
Page 168 of 203