Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
278 detections
Filters
Last updated
All Time
Detection languages
202
34
14
11
6
Contributors
86
73
31
29
11
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
257
19
18
13
7
Products / Services
190
63
33
19
19
MITRE Techniques
116
71
56
41
41
CVEs
5
5
5
5
5
This rule detects potential defense evasion activity identified by SentinelOne as call stack spoofing. The rule triggers when behavioral indicator tags related to spoofed call stacks, thread execution masking, or suspicious indicators involving RtlUserThreadStart, BaseThreadInitThunk, or kernel32.dll are detected, suggesting an attempt to hide malicious thread execution from security monitoring tools.
Detects instances of process call stack spoofing, specifically techniques like SparroWocky (hooking CreateThread to report fake start addresses such as AnimateWindow) or SilentMoonwalk (forged call stacks masking API call origins as RtlUserThreadStart or BaseThreadInitThunk) used to evade EDR behavioral monitoring.
Detects obfuscated PowerShell commands bypassing execution policy to download or execute 'configuration.ps1' or communicate with known malicious infrastructure associated with the ClickFix campaign. The rule specifically looks for caret-based obfuscation, bypass switches, and known IOCs in the command line.
Detects a specific credential-harvesting sequence associated with the RatHat malware. This behavior involves an initial malicious overlay drawn over a targeted application to harvest credentials, followed by a secondary fake 'install failed' overlay masquerading as Google Play within a short timeframe (1 hour), occurring when a user attempts to uninstall the malicious application.
This rule detects the presence of unauthorized WebView or HTML overlay windows rendered on top of active banking applications on Android devices. This behavior is indicative of credential-theft malware, such as banking trojans, which use overlays to capture user input, including banking credentials, while masking their activity over legitimate finance-related applications.
This rule detects potentially malicious Android activity targeting financial and messaging applications (WeChat, Alipay). It monitors for suspicious app installation, abuse of Android accessibility services, and unauthorized overlay window activity which are common techniques used by banking trojans for credential theft and unauthorized transaction interception.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
This rule monitors for known malicious file hashes, IP addresses, C2 domains, and specific URL markers associated with identified threat activity. It consolidates multiple detection vectors including file activity, process execution, network connections, and DNS queries to identify compromised devices communicating with attacker-controlled infrastructure.
Detects in-memory tampering of the EtwEventWrite function within ntdll.dll, a technique commonly used by malware and loaders to disable Event Tracing for Windows (ETW) telemetry to avoid detection by security products.
Detects a suspicious sequence of activity involving persistence via Registry Run keys (specifically targeting SMQDService or winappx entries) followed by modifications to Microsoft Defender configuration (adding exclusions via PowerShell) within a two-hour window on the same device.
Detects anomalous thread execution call stacks indicative of the SparroWocky anti-forensic evasion technique. This method involves spoofing thread start addresses and call stacks by injecting or manually manipulating stack frames to include legitimate-looking system functions (e.g., BaseFlushAppcompatCacheWorker, BaseCheckVDMp) alongside malicious execution patterns involving NtDelayExecution and SleepEx to hide the true origin of code execution.
This rule detects potential indicators of compromise related to the 'ATodaPotencia' campaign by monitoring email URL logs, process command-line arguments, and general device events for the string 'ATodaPotencia'. The rule searches across multiple data sources to identify where this specific handle or artifact appears within an environment.
This rule monitors for the presence of files matching a known list of malicious SHA256 hashes on devices. It correlates these file events with process creation events occurring on the same device within a 10-minute window, identifying potential execution of malicious binaries or artifacts.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
Detects in-memory modification of the ntdll.dll module to patch EtwEventWrite or EtwEventWriteFull functions, a technique used by adversaries to evade Windows event tracing and suppress telemetry. The rule specifically targets activities originating from w3wp.exe, consistent with behavior observed in IIS-hosted deployments like GhostContainer.
This rule detects attempts by an IIS worker process (w3wp.exe) to tamper with or disable the Antimalware Scan Interface (AMSI) by monitoring for specific non-standard provider registrations or scan buffer patching events. This activity often indicates an attacker attempting to bypass security scanning within a web-based application process.
Detects the execution of known GoCaracal malware samples, identified by specific file hashes or staging file paths, occurring in conjunction with low-level keyboard hook installations using SetWindowsHookEx. This behavior is indicative of active keylogging activity.
This rule monitors for indicators of code execution anomalies commonly associated with process injection, ROP (Return-Oriented Programming) chains, or memory manipulation. It specifically looks for spoofed call stacks, return address validation failures, suspicious API usage in common thread initialization routines, and ROP gadgets within critical modules like kernel32.dll.
Detects ClickFix-style activity where a web browser or common application launcher spawns a terminal or PowerShell process to execute obfuscated, copied, or piped commands. This behavior often indicates a social engineering attack where a user is tricked into manually executing a malicious command script.
Page 5 of 14