Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects instances where the Dllhost.exe (COM Surrogate) process writes executable files, scripts, or library files to common temporary or public directories. This behavior is often associated with COM hijacking, lateral movement, or malicious payload staging by adversaries.
Detects instances where DllHost.exe creates executable or script files within common writable directories such as Users, ProgramData, or Windows\Temp. This behavior is often indicative of an adversary staging malicious payloads or scripts to facilitate further execution.
Detects instances of the 'smbd' process executing from non-standard locations or initiating network connections on ports other than the default SMB ports (139, 445), which may indicate a rogue service, masquerading, or network pivoting activity.
This rule detects two potentially malicious activities: the execution of 'fltMC.exe' from a 'Temp' directory, which is a known masquerading technique for the legitimate Windows filter manager utility, and the creation of an executable file within the 'C:\ProgramData\Windows Multimedia\ROG\' directory, which is a common path used by threat actors to stage malicious binaries.
This rule detects potential malicious activity involving the 'wusvc.exe' executable. It flags instances where 'wusvc.exe' is executed from the user's Downloads folder or other non-standard paths, particularly when the file size is abnormally small (less than 100KB), which is indicative of masquerading or a dropper payload. The rule also checks for a known malicious file hash associated with the Snowlight dropper.
This rule detects the execution of specific utilities (e.g., 7zip components, socket modules) originating from a non-standard directory named 'AppData\Roaming\Traiolx Custom Utils'. This pathing pattern is indicative of potential malware staging or the execution of custom tooling in an attempt to masquerade as legitimate software.
This rule detects the extraction of a file from an archive (RAR) using 7-Zip utilities, followed by the execution of a file (exe, dll, js, etc.) from the Temp or Downloads directory within 120 seconds. This pattern is commonly observed during the execution phase of a malicious payload delivered via archives.
Detects evidence of the MYRA Linux RAT executing payloads filelessly from memory using memfd_create and fexecve. The rule flags suspicious processes masquerading as systemd-userdbd, particularly when spawned from Node.js environments or associated with malicious packages like apintergrationpost or .libcache.so artifacts.
Detects a multi-stage in-memory .NET DLL loader chain where an executable from AppData\Roaming mimics legitimate software (TuglaInsaatci) to load malicious DLLs ('Optimax.dll' and 'System Optimizer Ultimate.dll') entirely in memory. This behavior is indicative of the FortiBleed steganographic loader campaign, which aims to evade disk-based security controls.
Detects potential DLL hijacking persistence by identifying modifications to registry values containing executable or library files that point to locations outside standard Windows system directories (System32 or SysWow64), subsequently joined with the execution of legitimate binary proxies known to be abused for side-loading like rundll32.exe or regsvcs.exe.
Detects the execution of 'HFY.exe' correlated with the presence of specific DLLs (e.g., data.dll, EPPlus.dll) characteristic of a trojanized Chinese telecom management utility. This behavior is indicative of the BeepRAT infection chain, where malicious binaries are executed from archives containing secondary dependencies.
This rule detects potential malicious activity where the 7-Zip utility spawns executable files or scripts. It monitors for child processes such as .exe, .js, .vbs, .ps1, or .bat files being executed from common user-writable directories (e.g., Downloads, Temp, Desktop). This pattern is often indicative of an adversary using a legitimate archive tool to extract and execute a malicious payload delivered via phishing or other initial access methods.
Detects malicious msimg32.dll files associated with the Bumblebee loader by identifying unique, randomized, dictionary-derived strings within the PE file version resource metadata. These strings serve as a known signature for Bumblebee builders, often used to trojanize MSI installers.
This rule identifies the execution or presence of a specific malicious installer executable (MD5 87603EA025623B19954E460ADD532048) that is known to be reused and renamed across multiple campaigns to masquerade as legitimate software installers.
Detects PowerShell scripts that contain custom bit-reversal and XOR decoding routines used to deobfuscate an embedded byte blob, followed by the reflective loading of that blob into memory as a .NET assembly using [Reflection.Assembly]::Load. This behavior is associated with loaders like cap.ps1 used to deploy RATs such as AsyncRAT.
Detects a malicious PNG file used by the Ousaban VBS downloader that embeds a ZIP archive containing a payload named 'SysMain.exe' appended after the PNG IEND chunk.
This rule monitors for file creations and process executions associated with known proof-of-concept (PoC) artifacts for CVE-2026-55200 (a pre-authentication remote code execution vulnerability in libssh2). It also identifies suspicious child processes spawned from common SSH-related binaries, which may indicate successful exploitation or the execution of malicious payloads.
Detects potential DLL hijacking persistence by identifying modifications to registry values containing executable or library files that point to locations outside standard Windows system directories (System32 or SysWow64), subsequently joined with the execution of legitimate binary proxies known to be abused for side-loading like rundll32.exe or regsvcs.exe.
Detects a potential exploitation chain where 7-Zip is used to extract files from a RAR5 archive in a way that strips Mark-of-the-Web (MOTW) NTFS alternate data streams. The rule specifically monitors for 7z.exe launching with a .rar archive in the command line followed by the execution of potentially malicious files (executables, scripts, etc.) from user-writable directories shortly after.
This rule detects potentially malicious process behavior on Linux systems. It triggers on two conditions: 1) Masquerading of the 'systemd-userdbd' process by detecting processes named 'systemd-userdbd' that do not originate from the legitimate system path. 2) Fileless execution by detecting process image paths that contain 'memfd:', which is commonly associated with loading malicious binaries directly from anonymous memory to evade disk-based detection.
Detects the execution of a specific malicious executable (COU_ITR-1_to_4_AY2026-27.exe) identified as part of the Operation DragonReturn spearphishing campaign. The campaign impersonates the Indian Income Tax Department to lure users into executing the file.
Page 64 of 80