Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
Detects a crash of the "WinRAR.exe" application with a version lower than 6.23, which could indicate an attempted exploitation of CVE-2023-40477. The rule specifically looks for Application Error events (EventID 1000) where the provider is 'Application Error' and the crashing application is 'WinRAR.exe', excluding versions 6.23 and higher.
This rule detects the creation of files with the '.dmp', '.dump', or '.hdmp' extensions. These files are typically memory dumps generated by software during a crash. While often legitimate, memory dumps can contain sensitive information, including credentials, which could be exploited by adversaries. The rule aims to identify instances where such files are created to allow for investigation into the cause of the crash and to ensure no sensitive data is exposed or exfiltrated.
This rule detects when the "System.Drawing.ni.dll" library is loaded by a process. This DLL is often used for graphical operations, including screen capturing. Its loading can indicate an attempt to capture screen content, which is a common technique used by adversaries for reconnaissance or data exfiltration.
Detects when Microsoft Cloud App Security reports suspicious email forwarding rules, such as a user creating an inbox rule to forward copies of all emails to an external address. This activity can indicate an attempt to exfiltrate sensitive information.
This rule detects the use of the 'import' command, part of ImageMagick, to capture screenshots on a Linux system. It specifically looks for executions of 'import' where the arguments indicate a full-screen capture (using '-window root') or a general screenshot saved to a common image file format (PNG, JPG, JPEG). This activity is often associated with adversaries attempting to collect visual information from a compromised system.
Detects the use of the 'xwd' utility to capture screenshots on a Linux system. This rule is particularly relevant for server environments where screenshot utilities are less commonly used by legitimate users, reducing false positives. The detection logic specifically looks for 'xwd' execution with parameters indicating a screen capture, such as '-root' or '-out' followed by a file ending in '.xwd'.
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in suspicious temporary locations often used by malware for exfiltration. Adversaries may compress collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network transfer.
Detects obfuscated PowerShell execution that leverages `clip.exe` to interact with the clipboard. The rule specifically looks for PowerShell module logs (Event ID 4103) where the payload contains `cmd` followed by `/c` or `/r`, then `clip` (with or without `.exe`), and finally a PowerShell command that accesses the clipboard using `[System.Windows.Forms.Clipboard]::SetText` or similar, often with string formatting. This technique is associated with `Invoke-Obfuscation`, a tool used to evade detection.
This rule detects the execution of specific Windows utilities (`tree.com`, `WMIC.exe`, `doskey.exe`, `sc.exe`) when their output is redirected to a temporary file. This behavior is often associated with adversaries collecting system information or reconnaissance data for later exfiltration or analysis, as indicated by the use of `> %TEMP%\` or `> %TMP%\` in the command line.
This rule detects PowerShell commands that use `Get-ChildItem` with `-Recurse` and `-Include` parameters to search for common document and archive file extensions. This behavior is indicative of an adversary attempting to automatically collect sensitive data from a system or network.
This rule detects the use of '.CopyFromScreen' within PowerShell script block text. This API call is commonly used by adversaries to capture screenshots of the desktop, which is a technique for gathering information during an operation. The detection relies on PowerShell Script Block Logging being enabled to capture the script content.
This rule detects when 'credui.dll' or 'wincredui.dll' is loaded by a process that is not commonly associated with these DLLs. Attackers might load these DLLs to interact with Windows Credential Provider functions like 'CredUIPromptForCredentials' or 'CredUnPackAuthenticationBufferW' to prompt users for credentials or extract them.
This rule detects the use of the 'Get-Clipboard' command within PowerShell logs. This command allows an adversary to retrieve the current content of the system clipboard, which could contain sensitive information copied by a user.
Detects the usage of the 'sqlite' or 'sqlite3' binaries to query specific database files associated with Firefox and other Gecko-based browsers, such as 'cookies.sqlite' and 'places.sqlite'. This activity is indicative of potential data stealing, particularly targeting browser history, bookmarks, and session cookies.
Detects the usage of the PowerShell `Set-Mailbox` cmdlet to configure an SMTP forwarding rule for a mailbox. This can be indicative of an adversary setting up automatic email forwarding to an external address for data exfiltration or continued access to communications.
This rule detects PowerShell script blocks that contain keywords associated with collecting local email data, specifically targeting Microsoft Outlook. It looks for script names like 'Get-Inbox.ps1' or the use of Outlook COM objects ('Microsoft.Office.Interop.Outlook', 'Microsoft.Office.Interop.Outlook.olDefaultFolders', '-comobject outlook.application'). This activity is indicative of an adversary attempting to gather sensitive information from a user's local email client.
Detects the execution of "csvde.exe" with the '-f' flag, indicating an attempt to export the Active Directory structure. This tool is often used by adversaries for discovery and collection of domain account information.
Detects obfuscated PowerShell execution leveraging `clip.exe` to retrieve commands from the clipboard. This technique is often used for defense evasion to hide malicious scripts.
Detects PowerShell scripts that utilize the "Compress-Archive" cmdlet to compress folders and files, storing the output in common temporary directories often used by adversaries for data staging prior to exfiltration. This behavior is indicative of an adversary preparing collected data for exfiltration by archiving it to minimize size and make it portable.
Detects the use of `cmd.exe` to launch PowerShell commands that leverage `clip.exe` and the Windows clipboard for obfuscated execution. This technique is often used to evade detection by breaking up malicious payloads or commands.
This rule detects PowerShell commands that perform reconnaissance activities (getting services, child items, or processes) and redirect their output to a file in the temporary directory. This behavior is indicative of an adversary collecting internal system information for potential exfiltration or further analysis.
Page 169 of 173