Detection rules

Explore published rules with transparent provenance, licensing, and ATT&CK mappings.

11,450
detections

Search detections

Filters

Showing 30 of 11,450

Nslookup PowerShell Download Cradle - ProcessCreation

Detects suspicious powershell download cradle using nslookup. This cradle uses nslookup to extract payloads from DNS records

T1071.004

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 15, 2026

MediumSigmaHQ

EVTX Created In Uncommon Location

Detects the creation of new files with the ".evtx" extension in non-common or non-standard location. This could indicate tampering with default EVTX locations in order to evade security controls or simply exfiltration of event log to search for sensitive information within. Note that backup software and legitimate administrator might perform similar actions during troubleshooting.

T1685.001

Written by: D3F7A5105Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 15, 2026

HighSigmaHQ

Exchange PowerShell Cmdlet History Deleted

Detects the deletion of the Exchange PowerShell cmdlet History logs which may indicate an attempt to destroy forensic evidence

T1070

Written by: Nasreddine Bencherchali (Nextron Systems)Attributed by SigmaHQ
Licence: Detection Rule License 1.1
Published: Oct 15, 2026

InformationalSplunk security content

Unusual HTTP Request Method

The following analytic detects Zeek HTTP requests using methods outside a configurable allowlist of standard and commonly used HTTP methods. Unusual methods can indicate protocol abuse, exploitation attempts, or command-and-control traffic. Review the method, source, destination, and URI to assess the activity.

T1071.001T1190

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Unusual SSH Client Banner

The following analytic detects SSH connections presenting client banners that do not match known, common SSH client software by leveraging Zeek ssh logs. Unusual or unknown SSH client banners may indicate custom tooling, offensive frameworks, tunneling utilities, or malware using SSH for command-and-control or lateral movement.

T1021.004T1572

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

HTTP POST Request with Encoded Payload

The following analytic detects HTTP POST requests containing heavily encoded data in the post body, specifically looking for sequences of hex-encoded bytes or base64-encoded strings. It leverages Zeek HTTP logs to identify POST requests where the body contains eight or more consecutive hex escape sequences or sixteen or more consecutive base64 character groups.

T1071.001T1132.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows Wermgr Alternate Data Stream in Temp Dir

The following analytic detects the wermgr.exe process creating an alternate stream in the temp directory. It leverages Sysmon EventID 15 to identify these actions. This activity is significant because wermgr.exe is typically associated with error reporting, not file creation. Such activity is significant as it may indicate RoguePlanet malware, which creates an alternate stream in the temp directory to execute malicious code.

T1564.004

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows Non-System Process Querying Definition Update

Detects DNS queries to definitionupdates.microsoft.com or the go.microsoft.com fwlink redirect used for WD update downloads, when the querying process is not a Windows system component. BlueHammer utilizes these definition updates as part of its exploit chain.

T1068T1071.001

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows NirSoft Utilities

The following analytic identifies the execution of commonly used NirSoft utilities on Windows systems. This activity is significant for a SOC because NirSoft utilities, while legitimate, can be used by adversaries for malicious purposes like credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further system compromise.

T1588.002

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows NirSoft Tool Bundle File Created

The following analytic detects the creation of files associated with the NirSoft tool bundles on Windows endpoints. NirSoft is a well-known provider of free, portable utilities that can be used for various system and network tasks. However, threat actors often leverage these tools for malicious purposes, such as credential harvesting, network reconnaissance, and data exfiltration.

T1588.002

Written by: Nasreddine BencherchaliAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Windows Cloud Files Filter Loaded by Uncommon Process

The following analytic detects "cldapi.dll" being loaded by a process not associated with legitimate cloud sync activity. The Windows Cloud Files API (cldapi.dll) is abused by several local privilege escalation exploits.

T1543.003

Written by: Raven TaitAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

Windows NirSoft AdvancedRun

The following analytic detects the execution of AdvancedRun.exe, a tool with capabilities similar to remote administration programs like PsExec. It identifies the process by its name or original file name and flags common command-line arguments. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and command-line telemetry. Monitoring this activity is crucial as AdvancedRun can be used for remote code execution and configuration-based automation.

T1588.002

Written by: Michael HaagAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

Possible Browser Pass View Parameter

The following analytic identifies processes with command-line parameters associated with web browser credential dumping tools, specifically targeting behaviors used by Remcos RAT malware. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions and specific file paths. This activity is significant as it indicates potential credential theft, a common tactic in broader cyber-espionage campaigns.

T1555.003

Written by: Teoderick ContrerasAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Suspicious Prompt Injection Jailbreak

Detects potential prompt injection or jailbreak attempts against Ollama API endpoints by identifying requests with abnormally long response times. Attackers often craft complex, layered prompts designed to bypass AI safety controls, which typically result in extended processing times as the model attempts to parse and respond to these malicious inputs.

T1059T1190

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible RCE via Model Loading

Detects Ollama server errors and failures during model loading operations that may indicate malicious model injection, path traversal attempts, or exploitation of model loading mechanisms to achieve remote code execution. Adversaries may attempt to load specially crafted malicious models or exploit vulnerabilities in the model loading process to execute arbitrary code on the server.

T1190

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible Model Exfiltration Data Leakage

Detects data leakage and exfiltration attempts targeting Ollama model metadata and configuration endpoints. Adversaries repeatedly query /api/show, /api/tags, and /api/v1/models to systematically extract sensitive model information including architecture details, fine-tuning parameters, system paths, Modelfile configurations, and proprietary customizations.

T1048

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Abnormal Service Crash Availability Attack

Detects critical service crashes, fatal errors, and abnormal process terminations in Ollama that may indicate exploitation attempts, resource exhaustion attacks, malicious input triggering unhandled exceptions, or deliberate denial of service attacks designed to disrupt AI model availability and degrade system stability.

T1489

Written by: Rod SotoAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Detection of tools built by NirSoft

The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance.

T1072

Written by: Bhavin PatelAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

Detect Large ICMP Traffic

The following analytic identifies ICMP traffic to external IP addresses with total bytes (sum of bytes in and bytes out) greater than 1,000 bytes. It leverages the Network_Traffic data model to detect large ICMP packet that aren't blocked and are directed toward external networks. We use All_Traffic.bytes in the detection to capture variations in inbound versus outbound traffic sizes, as significant discrepancies or unusually large ICMP exchanges can indicate information smuggling, covert

T1095

Written by: Rico ValdezAttributed by Splunk security contentand 3 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

ASL AWS ECR Container Upload Unknown User

The following analytic detects unauthorized container uploads to AWS Elastic Container Service (ECR) by monitoring AWS CloudTrail events. It identifies instances where a new container is uploaded by a user not previously recognized as authorized.

T1204.003

Written by: Patrick BareissAttributed by Splunk security contentand 1 more author
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumSplunk security content

PingID New MFA Method After Credential Reset

The following analytic identifies the provisioning of a new MFA device shortly after a password reset. It detects this activity by correlating Windows Event Log events for password changes (EventID 4723, 4724) with PingID logs indicating device pairing. This behavior is significant as it may indicate a social engineering attack where a threat actor impersonates a valid user to reset credentials and add a new MFA device.

T1098.005T1556.006T1621

Written by: Steven DickAttributed by Splunk security content
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible Memory Exhaustion Resource Abuse

Identifies high Ollama runner counts and large model buffer allocations as possible resource pressure indicators. Memory values vary with model size and hardware, and these operational logs do not establish malicious intent; validate against host capacity and workload baselines.

T1499

Written by: Rod SotoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Possible API Endpoint Scan Reconnaissance

Detects API reconnaissance and endpoint scanning activity against Ollama servers by identifying sources probing multiple API endpoints within short timeframes, particularly when using HEAD requests or accessing diverse endpoint paths, which indicates systematic enumeration to map the API surface, discover hidden endpoints, or identify vulnerabilities before launching targeted attacks.

T1595

Written by: Rod SotoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

InformationalSplunk security content

Ollama Excessive API Requests

Detects high Ollama API request volumes from a single client in a short time window. A burst may indicate automated abuse or contribute to resource contention, but GIN access logs do not establish malicious intent or service impact; validate the client and workload against local usage baselines.

T1498

Written by: Rod SotoAttributed by Splunk security contentand 2 more authors
Licence: Apache License 2.0
Published: Oct 14, 2026

MediumMicrosoft Sentinel analytics

WhoisFreaks - parked threat domains

Identifies threat-listed domains that are currently parked and may be used for staging.

T1583

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

WhoisFreaks - newly registered domain seen in threat feed

Identifies newly registered domains that are later observed in WhoisFreaks threat feeds.

T1566T1583

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

WhoisFreaks - high confidence threat domains

Identifies high-confidence malware, phishing, and spam domains from WhoisFreaks threat feeds.

T1071T1566

Licence: MIT License
Published: Oct 14, 2026

LowMicrosoft Sentinel analytics

WhoisFreaks - burst of newly registered domains

Identifies unusually large NRD ingest volume that may indicate bulk registration campaigns.

T1583

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

Silverfort - Lateral movement target discovery

Identifies Silverfort incidents involving bursts of authentications from one host to many other hosts. This behavior may indicate reconnaissance to identify targets for lateral movement.

T1018T1046

Licence: MIT License
Published: Oct 14, 2026

HighMicrosoft Sentinel analytics

Silverfort - UserBruteForce Incident

Identifies Silverfort incidents involving repeated attempts to authenticate to a user account. This behavior may indicate a brute-force attempt to gain unauthorized access.

T1110

Licence: MIT License
Published: Oct 14, 2026

Load more detections

Loading detection rules

Back to results

MediumSplunk security content Michael Haag +1

Windows Cabinet File Extraction Via Expand

Description

Detects usage of expand.exe to extract Microsoft Cabinet (CAB) archives, with emphasis on extractions into `C:\\ProgramData` or similar staging locations. In recent APT37 activity, a CAB payload (e.g., wonder.cab) was expanded into ProgramData prior to persistence and execution. This behavior is a strong signal for ingress tool transfer and staging of payloads.

Detection logic

Detection requirements

Platform: ESXi Linux macOS Network Devices Windows
The rule states no platform. This is derived from the ATT&CK technique it maps to.
Log source category: crowdstrike_processrollup2 sysmon_eventid_1 windows_event_log_security_4688

Known benign triggers

Legitimate software deployment or administrators may use expand.exe for local file extraction. Filter by approved deployment tools, signed parent processes, and sanctioned paths.

MITRE ATT&CK mappings

0 exclusive techniques.This is coverage no other published rule has; it is not this rule's total technique count.

Command and Control

T1105Ingress Tool Transfer 207 detections cover this technique

References

Links the source published beside this detection. Reference is the link the source wrote, unmodified. Class is decided by this catalogue from the host and path, not stated by the source. Cited by counts published detections citing the same resource, including this one, and the sources beneath it count the repositories this catalogue ingests, which is not the same as independent research.
Reference	Class	Cited by
github.com/redcanaryco/atomic-red-team/blob/388942adbd9641f4dfdcf079d7efe9a75ec0ac43/atomics/T1140/T1140.yaml#L304	Detection test	3
www.zscaler.com/blogs/security-research/apt37-targets-windows-rust-backdoor-and-python-loader	Unclassified	Only this detection cites it

From the source

At source: Open at source
Upstream identifier: 4e3e3b8c-6d3a-4b47-9f5a-9e3e0a0a6f2f
Tagged by the source as: APT37 Rustonotto and FadeStealerNetSupport RMM Tool AbuseEndpointendpointSplunk CloudSplunk EnterpriseSplunk Enterprise Securityendpoint

Licence

Published under: Apache License 2.0Read the licence
Attribution: Required
Obtained under: Apache-2.0Read the origin licence

Authorship

Written by: Michael Haag
Splunk
Published: Oct 13, 2026
Version: 2