Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,613 detections
Filters
Last updated
All Time
Detection languages
1,725
690
264
214
190
Contributors
985
505
494
256
209
Categories
814
787
728
629
473
Platforms
2,069
629
488
459
346
Products / Services
769
666
525
193
185
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
3,613
CVEs
14
10
5
4
3
IDS Classtypes
73
48
35
10
5
IDS Protocols
119
22
19
10
4
This rule detects the use of 7-Zip to compress and password-protect data, which is a common technique used by adversaries for exfiltration. It specifically looks for the execution of 7-Zip executables (7z.exe, 7zr.exe, 7za.exe) combined with command-line arguments indicating both compression/archiving ('a' or 'u') and password protection ('-p').
This rule detects attempts to coerce NTLM authentication on the Printer Spooler service, which can be used for privilege escalation. Specifically, it looks for `rundll32.exe` executing with command-line arguments related to `davclnt.dll,DavSetCookie` and keywords like `spoolss`, `srvsvc`, or `/print/pipe/`, indicating an NTLM relay attack against the print spooler service.
This rule detects the execution of the Windows built-in SoundRecorder.exe application when it is used with the '/FILE' command-line argument. This specific command-line argument indicates that SoundRecorder is being used to capture audio and save it to a file, which is a common technique used by attackers for audio surveillance.
This rule detects the execution of command-line tools like 'dir' or 'findstr' in conjunction with specific file extensions (e.g., .doc, .pdf, .txt) that are commonly associated with sensitive data or credentials. This behavior indicates an attempt at automated collection of data, potentially for exfiltration or further analysis by an adversary. The rule specifically looks for 'dir' commands with '/b' (bare format) and '/s' (subdirectories) flags, or 'findstr' with '/e' (end of line) and '/si' (case-insensitive search for string in files) flags, targeting common document and text file types.
Detects the execution of the 'Get-Clipboard' PowerShell cmdlet via the command line interface. This cmdlet is used to retrieve the current content of the clipboard, which could be leveraged by adversaries for data collection.
Detects PowerShell scripts that use the "Compress-Archive" Cmdlet to compress folders and files, storing the output in potentially suspicious locations often used by malware for exfiltration. This activity indicates an adversary might be compressing collected data (e.g., sensitive documents) prior to exfiltration to make it portable and minimize network data transfer.
Detects obfuscated PowerShell commands that utilize 'clip.exe' to interact with the clipboard, often as part of an obfuscation technique like those used by Invoke-Obfuscation. The rule specifically looks for patterns where 'echo' is piped to 'clip' and then followed by terms related to 'Clipboard' or 'invoke' with potential character obfuscation.
Detects obfuscated PowerShell scripts that utilize 'clip.exe' to interact with the clipboard, potentially for defense evasion or data manipulation. The rule specifically looks for the pattern 'echo.*clip.*&&.*(Clipboard|i`?n`?v`?o`?k`?)' within PowerShell script block text, indicating an attempt to pipe output to clip.exe and then interact with the clipboard or invoke further commands.
Detects obfuscated PowerShell commands that leverage `clip.exe` to retrieve content from the clipboard for execution. This technique is often used to evade detection by hiding malicious scripts in the clipboard until runtime.
Detects the execution of 'diantz.exe' with command-line arguments indicating the creation of a cabinet (.cab) file and the use of an Alternate Data Stream (ADS). This technique can be used by adversaries to hide malicious data within legitimate files.
Detects attempts to capture audio using PowerShell cmdlets, specifically looking for commands related to the 'WindowsAudioDevice-Powershell-Cmdlet' module or similar audio device manipulation cmdlets. This activity could indicate an adversary attempting to record sensitive conversations or gather information from the compromised system's environment.
This rule detects the use of 'rar.exe' to add files to an archive. Adversaries often compress collected data, such as sensitive documents, before exfiltration to make it more portable and reduce the amount of data transferred over the network. The detection specifically looks for the execution of 'rar.exe' with the 'a' command-line argument, which is used for adding files to an archive.
Detects the execution of WinRAR to compress files with '.dmp', '.dump', or '.hdmp' extensions. This activity could indicate a step in exfiltrating memory dump files or other sensitive dump files.
Detects the execution of 'clip.exe' to copy data to the clipboard. Adversaries may use this utility to collect sensitive information that users have copied within or between applications.
This rule detects the use of WinZip (winzip.exe or winzip64.exe) to compress and password-protect data. This activity is often associated with adversaries preparing data for exfiltration, as it allows them to package and secure collected information. The rule specifically looks for command-line arguments indicating the use of WinZip along with a password option and common archiving flags.
This rule detects the execution of 'diantz.exe' with command-line arguments that indicate both a remote file path (identified by '\\') and the creation of a CAB file (identified by '.cab'). This combination suggests that the 'diantz.exe' utility is being used to download a remote file and compress it into a CAB archive on the local machine. This behavior is often associated with adversaries transferring tools or data into a compromised environment.
An attempt to export an AWS EC2 instance has been detected. A VM Export might indicate an attempt to extract information from an instance.
Detect usage of the "sqlite" binary to query databases in Chromium-based browsers for potential data stealing.
Detects usage of "rar" to add files to an archive for potential compression. An adversary may compress data (e.g. sensitive documents) that is collected prior to exfiltration in order to make it portable and minimize the amount of data sent over the network.
Detect usage of the "sqlite" binary to query databases in Firefox and other Gecko-based browsers for potential data stealing.
Alert on when a user has performed an eDiscovery search or exported a PST file from the search. This PST file usually has sensitive information including email body content
Page 170 of 173