Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects the execution or writing of a file with a specific SHA256 hash associated with the 'GateKeeper' payload. It monitors process creation events, new executable writes, PE file writes, and image loads on Windows platforms to identify the presence and activity of this known malicious file.
---credit to @KQLWizard---
This rule is a CrowdStrike translation from KQL based on @KQLWizard's detection rule: https://detections.ai/rules/019c5143-2be7-765f-9d0b-4d41499ff6d6
This rule is a CrowdStrike translation from KQL based on @KQLWizard's detection rule: https://detections.ai/rules/019c5143-2be7-765f-9d0b-4d41499ff6d6
This searches for instances of Trivy, and communicates to the attacker controller server using the domain name and IP address.
This is to search for the new Click-Fix variant as published by Atos. See article: https://atos.net/en/lp/cybershield/investigating-a-new-click-fix-variant
IOCs used are from Secureworks CTU TIPS: Despair EDR Killer Used in Ransomware Operations
This is to search for the malicious dll loader, dwmapi.dll and the infostealer dll, inspector.dll. This search is from Microsoft's published article, "Storm-2561 users SEO poisoning to distribute fake VPN clients for credential theft". This will look for the two dll files digitally signed from Taiyuan Lihua Near Information Technology Co., Ltd.
This searches for both network and process events. Shows only public IP addresses, and drops any empty IP address field. Enriches the search with any of the three ImageFileNames: SnippingTool.exe, ScreenSketch.exe, and SnipAndSketch.exe, and only where ms-screensketch is in the commandline. The result will be in a table format showing the timestamp, computername, imagefile name, remote IPv4 address, and the commandline.
This rule detects when the Obsidian application (obsidian.exe) spawns common shell or scripting interpreters such as PowerShell, cmd.exe, sh, bash, zsh, or osascript. This activity could indicate malicious code execution originating from a potentially compromised or weaponized Obsidian instance, or an attempt to leverage Obsidian's capabilities for unauthorized command execution. The inclusion of 'osascript' specifically addresses observed macOS attack chains (REF6598).
Adversaries may disable security tools to avoid possible detection of their tools and activities by uninstalling Crowdstrike Falcon
This rule detects the execution of PowerShell commands that utilize .NET's System.Drawing.Bitmap class and the .GetPixel method. This combination is indicative of steganography techniques being used to extract hidden data, often malicious payloads, from image files. This specific pattern has been associated with APT29.
Identifies a process that has successfully modified the /etc/sudoers file. The sudoers file controls which users have administrative privileges and whether they require a password to execute commands as root. Unauthorized changes to this file are a primary method for attackers to gain permanent, passwordless "root" access to a system. This rule correlates the initiator process with the file modification event to identify the source of the change.
This rule detects the creation, modification, or renaming of directories related to the malicious 'plain-crypto-js' npm package within a 'node_modules' folder. This activity is indicative of a supply chain compromise where a legitimate package (Axios) was found to include this malicious dependency.
Looking for certain techniques implementing Unicode selectors for code injection, used in linked research blog.
Therefore, characters that do not render in code editors or during standard code review.
Therefore, characters that do not render in code editors or during standard code review.
Detects CrystalX-style browser clipper behavior when specific command-line patterns (CDP or clipper commands) appear in conjunction with a CrystalX temporary payload lineage. The temporary payload is identified by an executable named 'svc' followed by 3 to 6 digits, located in the user's AppData\Local\Temp directory.
Detects file events related to the 'plain-crypto-js' folder path, which has been associated with the AXIOS supply chain compromise. This rule monitors for any file activity within this specific folder, indicating potential malicious code injection or modification as part of a software supply chain attack.
Detects EtherRAT-related host and network activity using reported artefacts including a known C2 domain (aurineuroth[.]com), a CDN-like beacon URL pattern, the creation of a svchost.log debug file, and various hidden PowerShell commands for system information discovery (AV, domain, MachineGuid, GPU).
This rule detects attempts to delete shadow copies using built-in Windows utilities such as PowerShell, WMIC, or VSSAdmin. The detection specifically looks for command-line arguments containing 'shadow' and 'delete' when executed by these processes. This activity is commonly associated with ransomware or other destructive malware aiming to prevent system recovery.
This rule detects the execution of executables with single-character filenames on Windows systems. Such filenames can be used by adversaries to obfuscate malicious activity, making it harder for users and security tools to identify the true nature of a file. This technique is often employed in malvertising campaigns or other forms of social engineering to trick users into executing seemingly benign files.
This rule detects potential abuse of Microsoft Excel where a process other than Excel itself is launched by Excel. This behavior can be indicative of malicious Excel add-ins (XLLs) or macros executing external code, a common technique used in phishing campaigns and malware delivery. The rule specifically looks for `excel.exe` as the parent process and a different executable (`ImageFileName`) as the child process.
This rule detects the execution of 'DlpUserAgent.exe' from an unusual path, specifically excluding the Windows Defender directory. This executable is often associated with Data Loss Prevention (DLP) software, but its execution outside of expected system directories can indicate potential DLL side-loading or other forms of execution hijacking. The rule looks for process creation events where the image file name or original file name matches 'DlpUserAgent.exe' and the path is not within the Windows Defender directory.
This rule detects the execution or presence of files related to the Xeox Remote Monitoring and Management (RMM) tool. It specifically looks for process creation events where the image file name, original file name, or parent base file name contains 'xeox_' or 'xeox-', or where the image file path includes '\xeox\'. This helps identify the initial execution or persistence mechanisms of the Xeox RMM.
Page 64 of 100