Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects GreenBlood ransomware activity targeting network shares and USB drives. This rule identifies file rename or creation events with specific ransomware extensions (.tgbg, .bak) or ransom note filenames ('READ_ME_TO_RECOVER_FILES.txt'), combined with the use of extended path prefixes (\?\ or \?\UNC\) often employed by ransomware for network/UNC path targeting. The rule aggregates these events and alerts if three or more such files are detected from a single process on a device.
Detects the creation of a file named 'bootTel.dat' directly in the root directory (C:\). This file name and location can be associated with certain malware or suspicious activities, as it's not a typical system file.
This rule detects potential rootkit activity by monitoring for specific DeviceIoControl requests (code 2248E0), the presence of a suspicious file (402.sys) in the ProgramData directory, and specific NamedPipe events (NSecKrnl). These indicators are often associated with kernel-level malicious implants or rootkits attempting to hide their presence or interact with the system at a low level.
Detects the creation of executable files (exe, dll, bat, ps1, vbs, msi, lnk) by common web browsers (Chrome, Firefox, Edge, Internet Explorer) or email clients (Outlook). This activity can indicate a user downloading or receiving a potentially malicious file, which could lead to initial access or further compromise.
Detects various post-exploitation activities associated with the Amadey loader, including the execution of its persistence mechanism (nudwee.exe), dropping and executing secondary payloads in temporary directories, using PowerShell download cradles, creating scheduled tasks for persistence, and silent MSI installations. This rule aims to identify the delivery of secondary payloads like StealC and Lumma Stealer.
This rule detects the presence and execution of the GLASSWORM.WASM TinyGo-compiled WebAssembly loader. It identifies suspicious file creations of .wasm files or known malicious JavaScript shim files within VS Code extension directories, as well as the execution of node.exe loading .wasm files or known malicious JavaScript shims from these paths. Detection is based on specific file names, folder paths, and a known malicious SHA256 hash.
Detects deployment of AppDomainManager hijack assemblies for .NET execution
Detects the deployment of SharkLoader components into suspicious directories (%APPDATA%\xwreg, %APPDATA%\xgdf, or %ProgramData%\KasperskyLab) followed by the execution of SystemSettings.exe from these locations. This rule also tracks the loading of encrypted DLL payloads like DscCoreR.mui or SyncRes.dat by these processes, which is indicative of a DLL sideloading execution chain.
Detects creation of virtual file system containers for hiding malware
Detects malicious installer packages with custom actions for persistence
Detects web shell deployment and subsequent execution activities associated with the StrikeShark threat. The detection covers two primary behaviors: 1) IIS worker processes (w3wp.exe or UMWorkerProcess.exe) spawning suspicious child processes (cmd.exe, powershell.exe, etc.) indicating shell command execution, and 2) IIS worker processes creating potential web shell files (.aspx, .ashx, .asmx, .svc) within sensitive web root directories, including Exchange and SharePoint paths.
Detects potential SharkLoader persistence mechanisms where a registry 'Run' key is modified to execute a file located in AppData or ProgramData, or containing a base64-encoded command. The detection correlates the registry modification with a recent file creation event of the referenced file in the same directory paths on the same host.
Detects activity associated with the SNOWLIGHT malware, specifically the dropping of a malicious executable named 'wusvc.exe' or 'WindowsUpdate' into user-writable directories (Downloads or AppData), followed by the creation of an automatically starting Windows service that executes the dropped file. This rule correlates process creation/service registration events with SCM event 7045 entries.
Detects a game launcher writing a new executable beneath AppData or the user profile, which is unusual for signed platform updates and may represent RokRAT or BirdCall staging. This rule specifically looks for file creation events where the file is an executable (.exe), the path is within a user's AppData, Documents, or Downloads folder, and the creating process is identified as a game, launcher, update, or patch executable.
Detects network communication with known SNOWLIGHT dropper C2 infrastructure (IP 38.60.253.35, port 8084), as well as unauthorized network activity originating from the Windows Update service (wusvc.exe) and suspicious file execution of a known malicious hash associated with this activity.
Detects the execution behavior associated with the VILE ransomware, specifically focusing on the combination of privilege manipulation API usage (e.g., AdjustTokenPrivileges, DuplicateTokenEx) and the creation of known ransomware-related artifacts like configuration files or decoy files.
Detects core indicators of Grixba malware, including the persistence path of GT_NET.exe in the Public Music directory, the loading of the associated malicious CoreScanner module (inf_g.dll), staging of reconnaissance output files, and the use of GT_NET.exe to perform network lateral movement via WMI/WinRM ports.
Detects evidence of libssh2 publickey list heap corruption exploitation, including the presence or execution of known proof-of-concept (PoC) binaries, malicious SSH server connection patterns on port 2228, and suspicious child processes (e.g., cmd.exe, calc.exe) spawned by SSH clients or daemons.
Time-series correlation detecting Pass-The-Hash authentication behavior immediately following the extraction of LSASS memory.
Detects a sequence of reconnaissance commands (whoami, tasklist, systeminfo, netstat) executed by the command prompt and piped to a text file. This specific TTP was used in the Notepad++ supply chain attack to gather system information for exfiltration. The detection is scoped to specific AppData directories to reduce false positives.
Detects STOCKSTAY malware masquerading as an ILSpy installer using malicious MSI files (Copia.msi, DiplomacyEduAI.msi). The rule identifies the execution of a decoy lure URL through a custom OpenUrl MSI action that triggers the spawning of viewer.exe, as well as file activity associated with the installation path '%LOCALAPPDATA%/Programs/SMN/'.
Page 131 of 217