Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,313
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the creation or presence of specific artifact files (.ghostlock_authorized and ghostlock_cache.json) associated with the GhostLock proof-of-concept availability weapon. These files are used by the tool to manually authorize locking operations in specific directories and to cache discovered file lists for rapid session re-establishment.
Detects exclusive SMB file handle requests (ShareAccess = 0), which are utilized by the GhostLock denial-of-service technique.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).
Detects outbound network connections from web server processes to steamcommunity.com, which is used by this malware to fetch steganographically encoded C2 payloads from profile comments.
Detects whenever a QoS with throttleRate is created by a Windows Service. This behaviour is normally associated with EDR Supression.
Detects the execution of PowerShell cmdlets used to mount ISO/VHD images. This behavior is a known prerequisite for the RoguePlanet Windows Defender vulnerability exploit, which relies on a race condition triggered during the mounting of an ISO image by a standard user.
Detects the use of the Add-MpPreference PowerShell cmdlet to add the entire C:\ drive or powershell.exe to Microsoft Defender exclusions. This technique is actively used by threat actors to bypass antivirus scanning and ensure the execution of subsequent payloads.
Detects the usage of curl.exe routing traffic through a local SOCKS5 proxy on port 9050, a behavior observed in CryptoBandits malware communicating with a bundled Tor client to hide its Command and Control (C2) destination.
Detects wscript.exe or cscript.exe executing a VBScript that uses MSXML2.XMLHTTP and ADODB.Stream to download a file in chunks (using the Range header) to a temporary or AppData location. This technique is often used by malware to evade detection by downloading payloads in smaller pieces.
Detects the creation or execution of the trepamobq.cmd file, which is associated with the Trepamo banking malware. This detection identifies instances where the trepamobq.cmd script is created in the filesystem or executed, which may indicate a compromise or malicious activity related to banking malware.
Detects rundll32.exe being launched via a start /min command from a script located in the AppData directory, which then loads a non-standard DLL. This behavior is often associated with malware that uses rundll32 to execute malicious code while attempting to minimize visibility by running the process in a minimized window.
Detects WMI queries for installed AntiVirus products executed via scripting interpreters such as wscript.exe, cscript.exe, powershell.exe, or wmic.exe. This behavior may indicate an attempt to gather information about security software on the system, which can be a precursor to evasion or targeted attacks.
Detects the creation of a registry run key named 'Financeiro' under the CurrentVersion\Run path, which is associated with the Ousaban malware. This detection identifies instances where the 'Financeiro' run key is created in the Windows registry, which may indicate a compromise or malicious activity related to Ousaban malware persistence.
Detects the execution of 'tasklist.exe' with command line arguments that enumerate running processes associated with virtualization software, which is indicative of anti-VM behavior commonly observed in QuimaRAT malware. This detection identifies instances where 'tasklist.exe' is used to check for the presence of virtualization environments, which may suggest that the malware is attempting to evade analysis or detection in virtualized environments.
Detects the execution of 'reg.exe' with command line arguments that query registry keys associated with virtualization software, which is indicative of anti-VM behavior commonly observed in QuimaRAT malware. This detection identifies instances where 'reg.exe' is used to check for the presence of virtualization environments, which may suggest that the malware is attempting to evade analysis or detection in virtualized environments.
Detects execution of a trojanized 7-Zip proxyware payload (hero.exe/uphero.exe) from the SysWOW64 directory. This malware is known to be used in targeted attacks and can lead to unauthorized access and data exfiltration.
Detects attempts to identify the domain membership of a system using WMI queries to the Win32_ComputerSystem class. This technique is often employed by attackers to gather information about the network environment and potential targets.
Detects attempts to enumerate DNS zone records using the Get-DnsServerResourceRecord cmdlet. This technique is often employed by attackers to gather information about DNS configurations and potential targets within a network.
Detects attempts to enumerate Active Directory computer objects using the Get-ADComputer cmdlet with wildcard filters. This technique is often employed by attackers to gather information about networked devices and their configurations.
Detects attempts to enumerate Active Directory replication subnets using the Get-ADReplicationSubnet cmdlet. This technique is often employed by attackers to gather information about the network topology and potential targets within a domain.
The rule attempts to find scheduled tasks being created via the "schtasks.exe" binary, when it's parent is "wscript" or "cscript".
Page 11 of 1907