Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,615 detections
Filters
Last updated
All Time
Detection languages
1,725
690
266
214
190
Contributors
985
505
494
256
209
Categories
814
787
730
629
473
Platforms
2,071
629
488
459
346
Products / Services
769
666
527
195
185
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
3,615
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Yara rule that detects WeaselStore infostealer.
This rule detects PowerShell scripts attempting to perform keylogging. It specifically looks for the string 'Get-Keystrokes' which is often associated with keylogging scripts, or a combination of 'Get-ProcAddress user32.dll GetAsyncKeyState' and 'Get-ProcAddress user32.dll GetForegroundWindow' which are API calls commonly used in PowerShell keyloggers to capture keyboard input and determine the active window.
Detects chromium-based browsers starting in headless and debugging mode while pointing to a user profile. This behavior can be indicative of data exfiltration, specifically cookie stealing, or remote control of the browser.
Detects usage of the Windows RPC library Encrypting File System Remote Protocol (MS-EFSRPC). Variations of this RPC are used within the attack referred to as PetitPotam. The usage of this RPC function should be rare if ever used at all. Thus, any usage of this function is uncommon enough that it should warrant further investigation to determine if it is legitimate. View surrounding logs (within a few minutes before and after) from the Source IP to determine if it is legitimate. Logs from the Source IP would include dce_rpc, smb_mapping, smb_files, rdp, ntlm, kerberos, etc.
This rule detects attempts to enable auditing of TTY input on Linux systems by monitoring modifications to PAM (Pluggable Authentication Modules) configuration files. Specifically, it looks for changes to '/etc/pam.d/system-auth' and '/etc/pam.d/password-auth' in conjunction with TTY-related audit events. This activity could indicate an adversary attempting to implement keylogging functionality using the pam_tty_audit module to capture user input.
This rule detects the execution of various hack tools and scripts commonly used for SMB relay attacks and privilege escalation on Windows systems. It specifically looks for process creations or command-line arguments associated with tools like PetitPotam, RottenPotato, HotPotato, JuicyPotato, Responder, ntlmrelayx, and smbrelayx, as well as PowerShell scripts like Invoke-Tater and Invoke-PetitPotam. The rule aims to identify attempts to exploit NTLM relay vulnerabilities to gain elevated privileges or access credentials.
Detects the execution of various compiled Windows binaries from the Impacket toolset. This rule identifies the tools based on their filenames or partial filenames, which could lead to false positives due to legitimate software having similar names or adversaries renaming the tools. Impacket is a collection of Python classes for working with network protocols, often used by adversaries for lateral movement, credential access, and execution.
Detects PowerShell scripts that make use of the "Compress-Archive" cmdlet in order to compress folders and files. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
This rule detects logon events (EventID 4624) with LogonType 3 (network logon) where the TargetUserName is 'ANONYMOUS LOGON' and the WorkstationName is '-' (indicating a local system or unknown workstation). Additionally, the source IP address must be a loopback address ('127.0.0.1' or '::1'). This specific combination of characteristics is indicative of a RottenPotato-like attack pattern, which exploits local NTLM relay vulnerabilities to escalate privileges.
Detects attempts to discover files with setuid/setgid capabilities using the 'getcap' command. This activity is often a precursor to privilege escalation on Linux systems, as adversaries search for binaries that can be abused to gain higher privileges.
Detects network connections to the InterPlanetary File System (IPFS) where the URI contains a pattern indicative of an email address. This behavior is associated with recent phishing campaigns that leverage IPFS to host credential harvesting webpages, attempting to collect user credentials.
Detects the loading of the WinDivert driver, which is a powerful user-mode package for Windows capable of capturing, sniffing, modifying, blocking, and re-injecting network traffic. This driver can be used by adversaries for network sniffing, credential access, and defense evasion techniques.
Detects potential data exfiltration activity associated with the 'Shai-Hulud' NPM package attack. This rule specifically looks for the execution of 'curl' with command-line arguments indicating data being sent ('-d') to a known malicious webhook.site URL.
Detects the configuration of a new ISATAP router on a Windows host. While ISATAP is a legitimate Microsoft technology for IPv6 transition, unexpected or unauthorized ISATAP router configurations could indicate a potential IPv6 DNS Takeover attack using tools like mitm6. In such attacks, adversaries advertise themselves as DHCPv6 servers and set malicious ISATAP routers to intercept traffic. This detection should be correlated with network baselines and known legitimate ISATAP deployments in your environment.
Detects command line parameters used by ADCSPwn, a tool designed to escalate privileges in an Active Directory network. This tool achieves privilege escalation by coercing authentication from machine accounts and relaying it to the certificate service.
Detects the presence of a base64-encoded signature ("UWhRC....AAYBAAAA") in the command line, which corresponds to a marshaled CREDENTIAL_TARGET_INFORMATION structure. This pattern is a strong indicator of a Kerberos coercion attack, where adversaries manipulate DNS records to spoof Service Principal Names (SPNs) and redirect authentication requests, potentially exploiting vulnerabilities like CVE-2025-33073. The rule aims to identify attempts to add spoofed SPNs to DNS records or check for their presence using commands like `nslookup`.
Detects activity associated with the APT31 (ZIRCONIUM) threat group, specifically focusing on credential dumping using ldifde, lateral movement attempts involving copying tools like procdump64.exe, netsess.exe, and 7za.exe to remote shares, and archiving data. This rule is based on observations described in the Crowdstrike 2019 Global Threat Report.
The rule `MAL_GOLANG_STEALER_QBIT` is designed to detect the Qbit Stealer malware by identifying specific branding strings, setup configurations, and error messages commonly found within its binaries. The rule looks for strings like "qBit Stealer", "TRIAL VERSION - 24 Hour Access", "Stolen Folder Name:", "Max File Size(MB):", "Targeted File Extensions:", "[+] Logged into Mega", "[+] Loaded configJs", "Failed to load configJs", "Failed to archive files", "Failed to upload files", and "Failed to get file info". It also specifies a file size range between 7MB and 9MB. The rule `HUNT_QBIT_STEALER_DEV` aims to detect other software potentially created by the same author (n1k714i) by looking for developer-related strings such as "qbit@hitler.rocks", "n1k7l4i", "N1k7", and "CrabCat".
Detects the creation of the 'shai-hulud-workflow.yml' file, which is associated with the Shai Hulud worm. This worm targets the NPM supply chain and is designed to exfiltrate GitHub secrets. The rule specifically looks for the creation of this file within the '.github/workflows/' directory.
The following analytic identifies suspicious PowerShell execution using Script Block Logging (EventCode 4104). It leverages specific patterns and keywords within the ScriptBlockText field to detect potentially malicious activities. This detection is significant for SOC analysts as PowerShell is commonly used by attackers for various malicious purposes, including code execution, privilege escalation, and persistence. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, exfiltrate data, or maintain long-term access to the compromised system, posing a severe threat to the organization's security.
This rule detects attempts to capture user credentials on macOS by leveraging the `osascript` utility to display system dialog prompts. It specifically looks for `osascript` executions that include commands to 'display dialog' with keywords commonly associated with credential requests, such as 'admin', 'password', 'authenticate', or 'credentials'. This technique can be used by adversaries to present seemingly legitimate pop-ups to trick users into entering their credentials.
Page 138 of 173