Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects suspicious process patterns indicative of NTDS.DIT exfiltration attempts. This includes the use of specific tools like NTDSDumpEx, PowerShell scripts (e.g., NTDSgrab.ps1), and command-line utilities (ntdsutil.exe, copy command) to access or copy the ntds.dit file. The rule also looks for these activities originating from suspicious image folders like Apache, Tomcat, AppData, Temp, Public, or PerfLogs.
This rule detects commands commonly used on Cisco network devices to collect configuration data, which may contain sensitive information such as credentials. The commands include 'show running-config' to display the current operational configuration, 'show startup-config' to display the configuration loaded at boot, and 'show archive config' which can show archived configurations. An adversary might use these commands to gather information about the network, discover credentials, or understand the device's security posture.
This rule detects the use of Gpg4win (gpg.exe or gpg2.exe) to encrypt or decrypt files. The detection specifically triggers when the command line includes the '-passphrase' argument and the file being operated on is located in suspicious directories such as 'PerfLogs', 'Temp', 'Users\Public', 'Windows\Temp', 'AppData\Local\Temp', or 'AppData\Roaming'. This behavior can indicate an adversary encrypting collected data before exfiltration or using these common staging areas for malicious operations.
Detects an attempt to dump credentials from the VeeamBackup database using sqlcmd.exe by querying the 'VeeamBackup.dbo.Credentials' table. This activity is indicative of an attacker trying to extract sensitive information, potentially for lateral movement or further compromise.
Detects the execution of copy commands or utilities (robocopy, xcopy, cmd copy, PowerShell Copy-Item/Move-Item) targeting or originating from Windows Admin shares (e.g., C$) or the Sysvol folder. This activity can indicate lateral movement, data collection, or exfiltration by an adversary.
Detects potential QakBot activity by identifying specific process execution patterns previously associated with the malware. This includes scenarios where WinRAR executes wscript.exe, command lines containing 'ping.exe -n 6 127.0.0.1 & type', or regsvr32.exe executing from 'C:\ProgramData' with a '.tmp' file.
Detects a command line pattern used by the Conti ransomware group to archive and stage the NTDS.dit database for exfiltration. The rule specifically looks for the execution of '7za.exe' (7-Zip archiver) with a command line that includes '\C$\temp\log.zip', indicating the creation of a zip archive in a temporary location, a common step before exfiltration.
This rule identifies activities related to Google Cloud Platform (GCP) Packet Mirroring. Packet Mirroring allows capturing full network traffic, which can be abused by adversaries to intercept and collect sensitive data from unencrypted internal network communications. The rule specifically looks for various API calls related to the creation, modification, deletion, or listing of Packet Mirroring configurations.
Detects the creation of ".rev" files by WinRAR, which can indicate potential exploitation of CVE-2023-40477. This vulnerability allows for arbitrary code execution. The rule looks for file creation events where the process is either 'explorer.exe' (suggesting extraction via context menu) or 'WinRAR.exe', and the created file has a '.rev' extension. Further investigation for suspicious execution or WinRAR application crashes shortly after such file creation is recommended.
Detects PowerShell scripts attempting to access the default Windows Mail App mailbox data. This activity could indicate an adversary trying to manipulate, exfiltrate, or delete stored emails. The detection specifically looks for the string '\Comms\Unistore\data' within PowerShell script blocks, which points to the location where the Windows Mail App stores its data.
Detects the use of 7-Zip utilities (7z.exe, 7za.exe, and 7zr.exe) to extract password-protected compressed files. This activity can be indicative of an adversary decompressing sensitive data or malware that was archived with a password, potentially as part of collection or staging activities.
Alert when a user has performed an export to a search using 'New-ComplianceSearchAction' with the '-Export' flag. This detection will detect PST export even if the 'eDiscovery search or exported' alert is disabled in the O365. This rule will apply to ExchangePowerShell usage and from the cloud.
Detects attempts to collect image data stored in the clipboard from users using the 'xclip' tool. This rule specifically looks for 'xclip' execution with parameters indicating selection from the clipboard for image data output. It is highly recommended for server environments due to frequent legitimate clipboard utility usage on user workstations.
This rule identifies execution traces indicative of the XCSSET macOS malware. XCSSET is known to spread via Xcode projects and maliciously modify applications. The rule looks for specific command-line patterns involving 'curl' to suspicious URLs, 'osacompile' and 'plutil' interacting with user and group containers, and 'zip' archiving data from user and group containers. These activities suggest potential command and control communication, persistence mechanisms, and data staging/exfiltration by the malware.
This rule detects various keywords associated with data transfer and staging activities on Cisco devices. These activities could indicate an adversary attempting to move data onto the device for further exfiltration or to move data off the device. The keywords include common protocols and commands like 'tftp', 'rcp', 'puts', 'copy', 'configure replace', and 'archive tar', which are often used for file transfers and configuration management on network devices.
Detects obfuscated use of `clip.exe` to execute PowerShell commands. This technique involves leveraging the Windows clipboard utility (`clip.exe`) in conjunction with command-line arguments that include `cmd` and `clipboard]::` to launch PowerShell, often as a method of defense evasion and execution.
Detects the creation of a new service where the service file name contains patterns indicative of using `clip.exe` or similar clipboard-related utilities, often associated with obfuscated PowerShell scripts. This can be a technique used for defense evasion by adversaries.
Detects the obfuscated use of clip.exe to execute PowerShell commands. This technique involves creating a new service that uses 'cmd' and 'clip.exe' in conjunction with PowerShell's clipboard functionality to execute code, often as a method of defense evasion.
Detects suspicious local connections via a named pipe to the AD FS configuration database (Windows Internal Database). This database contains sensitive information used to sign SAML tokens. The rule specifically looks for connections to the '\MICROSOFT##WID\tsql\query' named pipe by processes other than known legitimate AD FS or Windows Internal Database components.
Detects PowerShell scripts that make use of the "Compress-Archive" Cmdlet in order to compress folders and files where the output is stored in a potentially suspicious location that is used often by malware for exfiltration. An adversary might compress data (e.g., sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detects the execution of 7-Zip (7z.exe, 7za.exe, 7zr.exe) to compress files with extensions like '.dmp', '.dump', or '.hdmp'. This activity is often a precursor to data exfiltration, where memory dump files or other sensitive data are compressed for easier transfer.
Page 168 of 173