Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,683
9,759
6,695
4,421
3,750
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
This rule detects the execution of Windows Explorer (explorer.exe) with specific command-line arguments involving a factory initialization sequence and an embedding flag. This command line pattern is typically associated with shell object manipulation or specific COM object instantiation, which may be leveraged for process injection or hiding malicious activity.
Detects Microsoft Edge being launched in a headless state with remote debugging enabled, hidden window dimensions, and a specific temporary user data directory naming convention. This pattern is characteristic of the TWINLOOT technique, where an adversary controls a headless browser via the Chrome DevTools Protocol (CDP) to conduct C2 communications and data exfiltration through legitimate Microsoft Graph API endpoints, effectively blending malicious traffic with normal browser activity.
Detects the execution of a binary named 'calc-mapping.bin' (either by image file path or command line arguments) where the parent process is 'node'. This pattern is indicative of a Node.js application spawning an unusual or potentially malicious binary.
This is about the article "Attacking SAM and Extracting Hashes With 7z" from Hackers Arise: https://hackers-arise.com/digital-forensics-attacking-sam-and-extracting-hashes-with-7z/
This query detects instances of 7-Zip executing with elevated administrator privileges on Windows endpoints while filtering out routine background noise. It begins by capturing both live and backfilled process creation telemetry (ProcessRollup2 and SyntheticProcessRollup2) and uses a case-insensitive regular expression to identify any standard 7-Zip executable, including the command-line, GUI, and file manager binaries (7z.exe, 7za.exe, 7zg.exe, or 7zFM.exe). To pinpoint administrative activity, it filters exclusively for processes with a high integrity level decimal of 12288, indicating the binary was elevated via UAC ("Run as administrator"). It then reduces false positives by excluding automated service accounts ending in svc, Active Directory machine accounts ending in $, and the built-in SYSTEM identity. Finally, it formats the remaining high-fidelity events into a structured table displaying the timestamp, executable path, username, integrity level, and full command-line arguments for quick triage.
This query detects instances of 7-Zip executing with elevated administrator privileges on Windows endpoints while filtering out routine background noise. It begins by capturing both live and backfilled process creation telemetry (ProcessRollup2 and SyntheticProcessRollup2) and uses a case-insensitive regular expression to identify any standard 7-Zip executable, including the command-line, GUI, and file manager binaries (7z.exe, 7za.exe, 7zg.exe, or 7zFM.exe). To pinpoint administrative activity, it filters exclusively for processes with a high integrity level decimal of 12288, indicating the binary was elevated via UAC ("Run as administrator"). It then reduces false positives by excluding automated service accounts ending in svc, Active Directory machine accounts ending in $, and the built-in SYSTEM identity. Finally, it formats the remaining high-fidelity events into a structured table displaying the timestamp, executable path, username, integrity level, and full command-line arguments for quick triage.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
This rule detects installation, file activity, or registry configuration changes associated with the 'bright-save-feed@tabtools.org' browser extension identifier. Such identifiers are commonly associated with malicious browser add-ons or potentially unwanted programs (PUPs) that may be used for browser session hijacking, unauthorized content injection, or persistent access.
The following analytic detects WerMgr.exe (Windows Error Reporting) spawning a child process running at SYSTEM integrity level.
WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children.
In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell.
If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.
WerMgr.exe normally runs at the integrity level of the reporting user or as a background SYSTEM-owned service that does not launch interactive children.
In the ShieldBreak exploit, WerMgr.exe is manually triggered via the QueueReporting scheduled task and loads an attacker-planted phantom DLL (phoneinfo.dll), which then spawns an elevated shell.
If confirmed malicious, this activity indicates successful local privilege escalation to SYSTEM.
Detects the execution of the Cortex XDR agent administration tool (Cytool) with the 'protect disable' command line argument. This indicates an attempt to manually disable the security agent's protective features on an endpoint, which is a common technique used by adversaries to impair security controls.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
Detects the execution of native binaries, the creation/modification of Node-API (.node) files, or the loading of .node modules from Visual Studio Code extensions directories. This behavior is indicative of malicious VS Code extensions attempting to execute arbitrary native code for reconnaissance, persistence, or exfiltration.
The following analytic detects the use of net.exe or net1.exe to configure the Windows maximum password age policy as unlimited.
It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and identifies executions of the `net accounts` command using the `/maxpwage:unlimited` option.
When specified, Windows configures the maximum password age with an unlimited value, effectively preventing passwords governed by the affected password policy from expiring.
This behavior is significant because an adversary may modify password expiration settings to weaken credential security controls and maintain access to compromised accounts for an extended period.
If confirmed malicious, this activity may indicate an attempt to establish or maintain persistence by preventing expected password rotation from invalidating credentials under the affected password policy.
It leverages process creation telemetry from Endpoint Detection and Response (EDR) agents and identifies executions of the `net accounts` command using the `/maxpwage:unlimited` option.
When specified, Windows configures the maximum password age with an unlimited value, effectively preventing passwords governed by the affected password policy from expiring.
This behavior is significant because an adversary may modify password expiration settings to weaken credential security controls and maintain access to compromised accounts for an extended period.
If confirmed malicious, this activity may indicate an attempt to establish or maintain persistence by preventing expected password rotation from invalidating credentials under the affected password policy.
The following analytic detects the execution of the 'rmdir' command with '/s' and '/q' options to delete files and directory trees. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and process metadata. This activity is significant as it may indicate malware attempting to remove traces or components during cleanup operations. If confirmed malicious, this behavior could allow attackers to eliminate forensic evidence, hinder incident response efforts, and maintain persistence by removing indicators of compromise.
The following analytic identifies a suspicious instance of wermgr.exe spawning a child process unrelated to error or fault handling. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process relationships and command-line executions. This activity is significant as it can indicate Qakbot malware, which injects malicious code into wermgr.exe to evade detection and execute malicious actions. If confirmed malicious, this behavior could allow an attacker to conduct reconnaissance, execute arbitrary code, and persist within the network, posing a severe security risk.
Detects the RedSun privilege escalation exploit delivering a SYSTEM-level shell to the attacker's session.
RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
RedSun replaces the legitimate TieringEngineService.exe with a malicious binary, which launches a process as SYSTEM, usually some sort of shell or shell spawner (conhost.exe, cmd.exe, PowerShell, etc.) in the attacker's active session.
Detects the presence of API strings and function names in EDR telemetry associated with the LxBaseRAT keylogging module. The rule monitors for the usage of low-level keyboard hooks (WH_KEYBOARD_LL) and state polling functions (GetAsyncKeyState, GetKeyboardState) commonly used by malicious software to capture user input.
Cortex Agent Exception Rule Created
Cortex XDR
Detects the creation of a new exception rule within the Cortex endpoint agent management configuration. Exception rules can be used to exclude specific files, processes, or behaviors from security prevention policies, potentially leading to a reduction in defensive coverage.
Detects screen-recording or AI voice-transcription applications (iTop Screen Recorder, Krisp, Caption.Ed) running within 60 minutes of an active videoconferencing session, consistent with PurpleDelta operators recording or transcribing interviews or meetings to generate scripted answers.
Detects use of dscl -authonly to programmatically validate a user-supplied password against the local directory, a technique used by infostealers like AmnesiaStealer to confirm the captured credential is correct before using it to unlock the login keychain and escalate access to protected data.
Cortex Broker VM Collection Error
Cortex XDR
Detects error-classified data collection audit events associated with designated Cortex Broker VMs, identifying collection failures that may interrupt or degrade data ingestion.
This rule detects attempts to disable, stop, or uninstall various security products, including antivirus and EDR solutions, by monitoring command-line activity for administrative utilities like sc.exe, net.exe, wmic.exe, and PowerShell.
Page 29 of 100