Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,460
11,847
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects unauthorized access attempts to session files and account credentials stored locally by Discord, Telegram, and Steam applications, a behavior consistent with the CastleStealer malware.
This query identifies malicious or suspicious browser extensions by cross-referencing multiple high-fidelity threat intelligence sources, including Socket.dev, OX.Security, Koi.ai, and GitLab.io.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
Detects module loads of suspected malicious DLLs (associated with HijackLoader/CastleLoader or ClickFix campaigns) by signed host processes from non-standard user-writable directories like ProgramData. It also monitors for the execution of known sideloading host binaries (e.g., ssh-add.exe) from suspicious staging directories.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
cipher wipe
YARA
This rule detects the use of the Windows 'cipher.exe' utility with the '/W' flag to wipe free disk space, invoked via a command shell (cmd.exe) within a PowerShell environment. This technique is often used by adversaries to prevent the forensic recovery of deleted files after they have been staged, modified, or exfiltrated, aligning with data destruction or anti-forensic activities.
This query identifies malicious or suspicious browser extensions by cross-referencing multiple high-fidelity threat intelligence sources, including Socket.dev, OX.Security, Koi.ai, and GitLab.io.
Detects file system artifacts indicating installation of the malicious 'ascii-fetcher' VS Code extension (v1.0.0) from the Open VSX marketplace, which bundles the malicious npm dependency '@jaymara/jsononifier' to hide its logic from static analysis.
Detects a specific exploit pattern where a malicious process triggers Microsoft Defender (MsMpEng.exe) to write a quarantine artifact to a user-controlled directory (such as a TEMP subdirectory), which is then immediately overwritten by an unprivileged process. This behavior indicates an attempt to exploit the Defender quarantine pipeline for unauthorized file manipulation or potential privilege escalation.
Detects unauthorized or unprivileged user-mode processes attempting to access files within Volume Shadow Copy paths. This behavior is indicative of reconnaissance or exploit techniques such as those observed in the RoguePlanet framework, where attackers enumerate snapshots to resolve stable file paths for subsequent malicious activity.
This rule monitors for two indicators of potential ransomware activity: first, a surge in file renaming or creation events across multiple directories within a short window, suggesting large-scale encryption; second, the creation of potential ransom note files across multiple directories or devices. It uses Microsoft Defender for Endpoint data to identify these patterns as part of an incident response strategy.
Detects the creation or presence of a file named 'svehost.exe' (a common typo-squat for 'svchost.exe') within the 'C:\Users\Public\AppData\Windows' directory. This behavior is indicative of an adversary attempting to masquerade a malicious executable by mimicking a legitimate Windows service process name and placing it in a non-standard, often-abused location.
Detects file creation, modification, or renaming events within sensitive macOS Application Support directories that mimic core system components such as Finder or Software Update. This behavior is indicative of potential masquerading or persistence techniques where an attacker replaces legitimate application resources with malicious ones.
This rule detects DLL side-loading attempts by identifying signed processes that load unsigned or invalidly signed DLLs from the same directory as the initiating process, specifically excluding standard system directories (System32, SysWOW64, WinSxS) to reduce noise. This behavior is a common technique used by attackers to execute malicious code under the context of a trusted, legitimate application.
This rule detects potentially malicious behavior involving the abuse of legitimate Windows binaries 'certutil.exe' and 'wscript.exe'. It flags specific command-line patterns often associated with deobfuscating, decoding, or staging payloads, such as using certutil to decode files or interact with web caches, and using wscript to execute vbscript from suspicious files like 'Link.ini' or 'Link.dat'.
Detects the trojanized uxtheme.dll (Cavern Agent) dropped to a non-standard path and side-loaded via WinDirStat.exe
Detects the presence of HijackLoader/IDAT Loader payloads disguised as non-PNG files. The rule identifies files containing concatenated PNG IDAT chunks that do not start with a valid PNG magic header, followed by a canonical IEND terminator, characteristic of steganographic data storage used to deploy the HijackLoader toolkit.
Detects the execution of a malicious MSI installer masquerading as a legitimate Microsoft FIXMAPI utility. The rule flags suspicious MSI command lines or the presence of the AICustAct.dll component (associated with Advanced Installer) within paths containing the misspelled publisher 'Microsoft Coporation' or the 'Microsoft FIXMAPI' utility string.
Detects the execution of executable files from user-specific directories (Downloads, Desktop, Temp) that match common naming patterns associated with illicit software, such as cracks, keygens, or pirated tools. This is often an indicator of users attempting to run unauthorized software, which may carry secondary malware.
Detects changes to the Discretionary Access Control List (DACL) of files within the C:\Config.Msi directory by processes other than msiexec.exe or TrustedInstaller.exe. This directory is used by the Windows Installer and unauthorized modifications to its contents or permissions may indicate an attempt to tamper with installation processes or escalate privileges.
Detects the creation of specific file artifacts associated with VILE ransomware in the Windows local temporary directory, indicating potential post-infection activity such as ransom note preparation or file staging.
Page 70 of 139