Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects the execution of `sqlcmd.exe` with command-line arguments indicative of database enumeration or backup activities, specifically targeting common system databases and processes. This pattern has been associated with Conti ransomware for dumping database contents.
This rule detects the execution of Gpg4win's GnuPG tool (gpg.exe or gpg2.exe) when it is used to encrypt files. The detection specifically looks for command-line arguments that indicate file encryption ('-c') and the use of a passphrase ('passphrase'). This activity can be indicative of malicious actors encrypting data for exfiltration or to render it inaccessible.
This rule detects the execution of the 'sqlite' or 'sqlite3' binary specifically when it is used to query sensitive data from Chromium-based browser profiles. The detection logic looks for command-line arguments that indicate access to common Chromium user data paths and specific database files containing login data, cookies, web data (credit cards, autofill), history, or bookmarks. This activity is highly indicative of an attempt to steal sensitive user information stored by web browsers.
Detects the creation of a file by WinRAR with a double extension and a space in the filename, specifically targeting the temporary directory. This pattern is indicative of an exploitation attempt related to CVE-2023-38331, a vulnerability in WinRAR that allows for arbitrary code execution through specially crafted archives.
Detects PowerShell scripts that contain references to the .NET `[System.Windows.Input.Keyboard]::IsKeyDown` function, which can be used for keystroke capturing. This function checks if a specified key is pressed, making it a common indicator of potential keylogger activity within PowerShell scripts.
Detects Border Gateway Protocol (BGP) authentication failures, which can indicate attempts to brute force BGP peer authentication. Such attacks aim to manipulate routing information, potentially leading to traffic redirection or denial of service.
This rule detects attempts to export an AWS EC2 instance, specifically when the 'CreateInstanceExportTask' event is logged in AWS CloudTrail. This action can be an indicator of an adversary attempting to exfiltrate data from a compromised EC2 instance by exporting it as a virtual machine image. The rule specifically looks for successful export task creations, filtering out events that contain error messages or codes, or indicate a 'Failure' in the response elements.
Detects attempts to use the built-in 'screencapture' utility to collect screenshots on macOS systems. This utility can be used by adversaries to gather visual information from a compromised system.
This rule detects potentially suspicious command-line arguments used with common data compression tools like 7-Zip and WinRAR. The presence of parameters such as '-p' (password), '-hp' (header password), '-sdel' (secure delete after archiving), '-ta', '-tb', and '-dw' can indicate an adversary's attempt to archive collected data, potentially encrypt it, and then remove the original files to cover their tracks. This behavior is often observed during the collection and staging phases of an attack, prior to exfiltration. The rule includes a filter to reduce false positives by excluding processes launched from standard program file paths.
Detects attempts to collect data stored in the clipboard from users using the 'xclip' tool. This rule is particularly relevant for servers, where legitimate usage of clipboard utilities is less common than on user workstations. The rule specifically looks for the execution of 'xclip' with parameters '-sel', 'clip', and '-o', which are used to output the contents of the clipboard.
Detects the use of the spoolss named pipe over SMB. This can be used to trigger NTLM authentication from machines with the spooler service enabled, often as part of NTLM relay attacks or credential harvesting.
This rule detects attempts by processes to access the microphone and webcam by monitoring specific registry key access events. It looks for EventIDs 4657, 4656, or 4663 associated with registry paths related to the Windows Capability Access Manager's consent store for microphone and webcam access by non-packaged applications. This can indicate an adversary attempting to collect audio or video from the endpoint.
Detects the creation of files with a specific naming pattern '/mail/tmp/[a-zA-Z0-9]{3}[0-9]{3}.tar.gz' which has been observed to be used by the threat actor UNC4841 for staging and exfiltration of email-related data.
This rule detects attempts to collect data from the clipboard on macOS systems by executing the 'osascript' binary with arguments that indicate clipboard interaction. Specifically, it looks for command lines containing 'osascript', ' -e ', and 'clipboard'. This combination suggests an AppleScript or JavaScript for Automation (JXA) command being executed to access clipboard contents.
Detects the execution of the Windows Problem Steps Recorder (psr.exe) with command-line arguments indicating a recording start. Psr.exe is a legitimate utility that can be abused by adversaries to capture screen activity, which is a form of information collection.
Detects attempts to collect data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for the execution of 'xclip' with arguments indicating clipboard selection and output. It is highly recommended for server environments due to the frequent legitimate use of clipboard utilities on user workstations.
Detects the execution of 'curl.exe' with the '-c' flag or '--cookie-jar' option to save cookie data. This activity can be indicative of an attacker attempting to hijack sessions by extracting authentication cookies.
This rule detects the execution of the 'rar.exe' utility with command-line arguments indicating the creation of an archive that is either password-protected ('-hp') or uses a specific compression level ('-m'). This combination of parameters is often associated with malicious activities, such as data exfiltration or staging, where adversaries compress and password-protect data before moving it off a compromised system.
Detects BGP failures which may be indicative of brute force attacks to manipulate routing.
Detects the use of PowerShell to add Exchange snap-ins and potentially export mailbox data. This activity has been observed in attacks by threat groups such as HAFNIUM and APT27, often as part of post-exploitation to collect sensitive information from Exchange servers.
This rule detects the execution of the legitimate tool 'Mouse Lock' based on its product name, company name, or command line arguments. According to Kaspersky's 2020 Incident Response Analyst Report, this tool has been observed being used by adversaries for credential access and data collection in security incidents, making it a potentially unwanted application (PUA) in a security context.
Page 167 of 173