Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
696 detections
Filters
Last updated
All Time
Detection languages
332
134
106
55
25
Contributors
115
100
66
62
55
Categories
136
129
107
104
84
Platforms
324
178
85
83
80
Products / Services
134
112
104
52
47
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
696
CVEs
2
2
2
2
1
IDS Classtypes
48
29
11
7
6
IDS Protocols
66
20
11
6
3
Detects a specific command line argument sequence used by the SNAKE malware during its installation phase, as detailed in a CISA report. The rule looks for a process creation event where the command line contains two specific arguments: the first is a 64-character hexadecimal string (assumed to be a SHA-256 hash), and the second is at least a 16-character hexadecimal string (assumed to be part of an AES initialization vector).
Detects the creation of a specific file named 'Comadmin.dat' in the 'C:\Windows\System32\Com\' directory, which is identified as a kernel driver file indicator for the SNAKE malware. This rule aims to identify the presence of this known malicious file.
Detects the installation of the Azure Hybrid Connection Manager service by monitoring registry modifications. This service can be used to allow remote code execution from Azure functions, potentially as a method for adversaries to establish persistence or facilitate further access.
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process. This activity is indicative of potential SNAKE malware persistence, as documented by the NSA and CISA. The rule specifically looks for file creations where the target filename starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe', while excluding processes originating from standard Windows system directories to reduce false positives.
Detects the execution of some potentially unwanted tools such as PsExec, Procdump, etc. (part of the Sysinternals suite) via the creation of the "accepteula" registry key. This key is created when a Sysinternals tool is run for the first time and the End User License Agreement (EULA) is accepted.
Detects the creation of specific executable files, 'jpsetup.exe' or 'jpinst.exe', which have been identified by CISA as indicators of SNAKE malware installation. The rule specifically looks for these filenames in the 'Image' field (process executable path) and excludes cases where the 'CommandLine' is empty or null, or explicitly matches the executable name, to reduce false positives.
This rule detects specific filenames, 'jpsetup.exe' and 'jpinst.exe', when they appear as the target filename in file events. These filenames have been associated with the SNAKE malware, as detailed in a CISA report. The rule aims to identify potential installations or presence of this malware on Windows systems.
Detects the execution of the PurpleSharp adversary simulation tool by looking for specific image paths, original filenames, or command-line arguments associated with the tool. This rule helps identify when an adversary simulation or red team exercise involving PurpleSharp is being conducted on a system.
Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n', which is a known indicator of SNAKE malware activity as described by CISA. This specific registry key is used by SNAKE malware for covert storage.
Detects the execution of SysInternals DebugView when its executable name has been renamed from the original 'Dbgview.exe'. This can indicate an attempt to evade detection or obscure the use of the tool by an adversary.
Detects when a non-Sysinternals tool attempts to set the 'EulaAccepted' registry key for a Sysinternals tool. This behavior is indicative of an adversary attempting to use renamed Sysinternals tools to evade detection, as the 'EulaAccepted' key is typically set by the legitimate Sysinternals tool upon its first execution.
Detects the execution of a Sysinternals Tool via the creation of the "EulaAccepted" registry key. Many Sysinternals tools create this key upon first execution to signify acceptance of the End User License Agreement (EULA). This can be an indicator of Sysinternals tools being used on a system, which are often leveraged by adversaries for various post-exploitation activities.
Detects the creation of the "accepteula" registry key by Sysinternals tools that have been renamed. This behavior is suspicious because legitimate Sysinternals tools typically create this key with their original executable names. Adversaries often rename tools to evade detection, and this rule specifically looks for instances where the EULA acceptance key is created by an executable whose name does not match the expected Sysinternals tool name.
Detects the keyboard preload installation with a suspicious keyboard layout, e.g. Chinese, Iranian or Vietnamese layout load in user session on systems maintained by US staff only
Detects relevant ClamAV messages
Detects specific patterns found after a successful ProxyLogon exploitation in relation to a Commandlet invocation of Set-OabVirtualDirectory
Windows Update Error
Sigma
Detects Windows update errors including installation failures and connection issues. Defenders should observe this in case critical update KBs aren't installed.
Detects the creation of diagcab file, which could be caused by some legitimate installer or is a sign of exploitation (review the filename and its location)
Detects creation of ".vhd"/".vhdx" files by browser processes.
Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.
Malware can use mountable Virtual Hard Disk ".vhd" files to encapsulate payloads and evade security controls.
Detects the execution of the PurpleSharp adversary simulation tool
Detects the use of the lesser known remote execution tool named CsExec a PsExec alternative
Page 33 of 34