Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,543 detections
Filters
Last updated
All Time
Detection languages
2,478
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,456
11,839
5,877
5,156
4,865
4,543
Platforms
3,841
1,049
473
39
29
Products / Services
1,835
1,138
211
183
171
MITRE Techniques
1,604
1,423
1,300
749
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
This rule detects the creation or loading of a .sys file (kernel driver) within the Windows Fonts directory by a non-standard loader. This behavior is suspicious as the Fonts directory is not a typical location for kernel drivers, and the use of common command-line interpreters (cmd, powershell, pwsh, rundll32, regsvr32) or other executables to stage or load such files indicates potential malicious activity, possibly related to defense evasion or persistence.
Detects the payload replicating itself to the C$ or ADMIN$ shares of remote hosts via SMB. This rule specifically looks for file creation events where the folder path matches a common internal IP address range followed by either 'ADMIN$' or 'C$'.
Identifies the payload establishing reboot persistence by writing a .plist to the user's ~/Library/LaunchAgents directory and activating it using 'launchctl load'.
Detects the widespread creation of the specific !readme_medusa!.txt ransom note or its HTML variant across directories, indicating a Medusa ransomware operation.
Identifies the AMOS stealer validating and redirecting the captured plain-text macOS password into a hidden .pass file.
Detects archive utilities extracting an LNK (shortcut) file directly to disk, specifically in Downloads or Temp folders, which is a common initial access vector preceding script execution.
Detects the loader deliberately dropping marker files when it identifies an analysis environment. This rule specifically looks for the creation of files named "vm.txt", "Debugger.txt", or "01_detect_analisse_process.txt", which are known indicators of malware attempting to detect virtualized or debugging environments.
Detects the dropping of reverse proxy binaries (like Ngrok or Cloudflare tunnel daemons) by PowerShell, which could be used to expose internal Terminal Services to the internet. This activity is often associated with phishing campaigns targeting Terminal Servers.
Correlates the execution of a recently dropped LNK file that triggers cmd.exe or powershell.exe, deliberately bypassing Mark-of-the-Web (MOTW) warnings.
Detects various indicators of SharkLoader activity, including the deployment of decoy MSI files, execution of suspicious masqueraded processes, use of double-extension files, and the creation of malicious DLL components in specific AppData subdirectories.
Detects techniques used to extract the Active Directory database (NTDS.dit) for credential dumping. This includes the use of native Windows utilities like ntdsutil.exe, vssadmin.exe, and diskshadow.exe to create volume shadow copies, as well as the identification of ntds.dit files being created or accessed in non-standard locations.
This rule detects the execution of SharkLoader components, specifically identifying unauthorized SystemSettings.exe processes attempting to load malicious DLLs (e.g., SystemSettings.dll, DscCoreR.mui, SyncRes.dat) from locations outside of the legitimate C:\Windows\ImmersiveControlPanel\ directory. It also tracks the creation or modification of these payload files in common persistence directories like AppData or ProgramData.
Detects file creation and execution patterns associated with SharkLoader malware. The rule monitors for the staging of malicious DLLs, encrypted beacon payloads, and API hooks in specific AppData subdirectories ('xwreg' and 'xgdf'), as well as the execution of 'SystemSettings.exe' from non-standard locations, which mimics legitimate Windows system processes to achieve persistence and evasion.
Detects DLL hijacking behavior where the legitimate Windows SystemSettings.exe is moved or copied to a non-standard directory and paired with a malicious SystemSettings.dll in the same folder, commonly associated with the SharkLoader malware.
Detects the creation of files with specific filenames (e.g. SystemSettings.dll, DscCoreR.mui, SyncRes.dat) within anomalous AppData subdirectories 'xwreg' or 'xgdf', followed by the execution of a process from those same directories within a 5-minute window. This behavior is indicative of SharkLoader malware staging its components and initiating execution.
Detects scenarios where 7-Zip (7z.exe or 7zG.exe) extracts an executable file to a user-writable directory (such as Downloads, Temp, or AppData), potentially stripping the Mark-of-the-Web (MOTW) identifier. The rule specifically tracks instances where such an extracted file is subsequently launched by the shell or Windows explorer within 5 minutes of extraction.
Detects the creation of files with a '.vile' extension within the Google Chrome extensions directory. This path is commonly used for installing extensions, and files with unconventional or obfuscated extensions in this directory may indicate the installation of malicious or unauthorized browser extensions.
Detects indicators of VILE ransomware activity, specifically identifying attempts to suppress Event Tracing for Windows (ETW) via NtTraceEvent patching, alongside execution of low-level NT syscalls and the presence of identified VILE-associated artifact files (e.g., .ico, .zip, .json).
Detects Pay2Key ransomware activity involving the extraction of suspicious DLLs into the Avast installation directory and the subsequent loading of these unsigned/unauthorized DLLs by legitimate Avast processes. This rule covers the file creation of known malicious DLL names, the use of 7za.exe for extraction into the directory, and the process module load events for unsigned DLLs within the Avast scope.
Detects PyInstaller unpacking dropping highly randomized compiled Python bytecode (.pyc) indicative of hidden malware loaders.
Detects the use of 7za.exe, executed from temporary 7ZipSfx directories, to extract encrypted data (data2.bin) into the Avast Software directory. This activity is indicative of the Pay2Key ransomware attempting to perform DLL sideloading by dropping a malicious DLL, such as powrprof.dll, into a legitimate application folder to hijack execution flow.
Page 150 of 217