Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,253 detections
Filters
Last updated
All Time
Detection languages
1,543
1,191
352
288
225
Contributors
792
520
494
349
298
Categories
1,711
1,489
400
382
376
Platforms
3,052
528
334
314
254
Products / Services
779
648
634
283
238
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
4,253
CVEs
6
6
6
5
5
IDS Classtypes
75
63
37
23
9
IDS Protocols
127
66
6
4
4
Detects the execution of Process Hacker, a tool used to view and manipulate processes and other low-level system options. Detection is based on binary metadata such as image path, original filename, description, product name, and known file hashes (MD5, SHA1, SHA256, IMPHASH). Threat actors have been known to abuse older, vulnerable versions of Process Hacker to manipulate system processes.
Detects the execution of PCHunter, a powerful system utility similar to Process Hacker, which can be used to view and manipulate processes, kernel options, and other low-level system aspects. Its use by unauthorized personnel can indicate malicious activity, system reconnaissance, or attempts to tamper with system internals.
Detects the execution of System Informer, a legitimate but powerful task manager tool that can be used to view and manipulate processes, kernel options, and other low-level operations. Its capabilities make it a potential tool for adversaries to gain system information, escalate privileges, or evade defenses.
Detects password policy discovery commands
Yara rule that detects CyberVolk ransomware.
Detects usage of system utilities such as "find", "tree", "findmnt", etc, to discover files, directories and network shares.
Detects suspicious use of PCHunter, a tool like Process Hacker to view and manipulate processes, kernel options and other low level stuff
Detects file access requests to the Windows Sysvol Policies Share by processes that are not commonly expected to interact with these files. This could indicate an adversary attempting to discover or exploit Group Policy Preferences for credential access or other malicious purposes.
This rule detects the execution of the `system_profiler` utility on macOS when specific data types are requested. These data types (SPApplicationsDataType, SPHardwareDataType, SPNetworkDataType, SPUSBDataType) have been observed in use by threat actors and malware for system information discovery and potentially for defense evasion by checking for virtualization software. The `system_profiler` command provides detailed hardware and software configuration information about the system.
Detects the use of `csrutil` with the `status` argument to view the System Integrity Protection (SIP) status on macOS. This activity is often observed in post-exploitation scenarios where an adversary is attempting to understand the system's security posture, specifically whether SIP is enabled or disabled, which could impact their ability to perform certain actions like modifying system files or injecting code.
This rule detects the use of the `ioreg` command-line utility on macOS, which is used to display I/O Kit registry information. Adversaries often use `ioreg` for system information discovery, particularly to identify virtualization environments (e.g., VirtualBox, VMware, Parallels) or other system details like serial numbers or USB device information. The rule specifically looks for executions of `ioreg` combined with common arguments and keywords used for such discovery, either directly or through shell commands involving `grep`.
Detects when the `csrutil` command is used with the `disable` argument to turn off System Integrity Protection (SIP) on macOS. This action is often performed in post-exploitation scenarios by adversaries to gain greater control over the system or to bypass security mechanisms.
This rule detects the execution of the 'sw_vers' command-line utility on macOS systems when specific arguments are used to query system information. The arguments monitored include '-buildVersion', '-productName', and '-productVersion', which are commonly used for system information discovery.
Detects the use of the WMI command-line (WMIC) utility to identify and display various system information, including OS, CPU, GPU, and disk drive names; memory capacity; display resolution; and baseboard, BIOS, and GPU driver products/versions. Some of these commands were used by Aurora Stealer in late 2022/early 2023.
Detects the use of csrutil to disable the Configure System Integrity Protection (SIP). This technique is used in post-exploit scenarios.
Detects the use of csrutil to view the Configure System Integrity Protection (SIP) status. This technique is used in post-exploit scenarios.
Detects the use of "ioreg" which will show I/O Kit registry information.
This process is used for system information discovery.
It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.
This process is used for system information discovery.
It has been observed in-the-wild by calling this process directly or using bash and grep to look for specific strings.
Detects the use of "sw_vers" for system information discovery
This YARA rule detects the Cicada3301 ransomware by identifying specific byte patterns (signatures) within executable files. The rule looks for distinct code sequences related to enumerating valid drives, recursively collecting files, and encrypting files. It includes multiple parts for file collection and two versions of file encryption routines, indicating a robust detection mechanism for different variants or stages of the ransomware's operation. The presence of these patterns strongly suggests the file is a Cicada3301 ransomware sample.
Detects command-line keywords indicative of the execution of the WinPwn tool, which is used for Windows and Active Directory reconnaissance and exploitation. This rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' in the command line.
Detects scriptblock text keywords indicative of potential usage of the tool WinPwn. WinPwn is a tool for Windows and Active Directory reconnaissance and exploitation. The rule specifically looks for 'Offline_Winpwn', 'WinPwn ', 'WinPwn.exe', or 'WinPwn.ps1' within PowerShell script block logs.
Page 182 of 203