Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule detects the creation or execution of files that match specific suspicious filenames associated with known malicious activity. It monitors both process creation (Event ID 1) and file creation (Event ID 11) events, targeting filenames such as 'MicrosoftUpdateOneDrive.exe', 'StockMarketView.exe', and various DLL files (e.g., 'ms-lib-math-core.dll'). These files are often masquerading as legitimate system or application components to evade detection.
This rule detects the creation or execution of files that match specific suspicious filenames associated with known malicious activity. It monitors both process creation (Event ID 1) and file creation (Event ID 11) events, targeting filenames such as 'MicrosoftUpdateOneDrive.exe', 'StockMarketView.exe', and various DLL files (e.g., 'ms-lib-math-core.dll'). These files are often masquerading as legitimate system or application components to evade detection.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Detects the execution of SystemSettings.exe from non-standard locations such as %APPDATA% or %PROGRAMDATA%. This behavior is consistent with the SharkLoader malware (observed in the StrikeShark campaign), which uses DLL side-loading of a malicious SystemSettings.dll to facilitate persistence and payload delivery, eventually executing Cobalt Strike.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
Detects instances of PerfWatson2.exe executing from non-standard locations (outside of known Visual Studio directories) or matching known malicious file hashes/versions. This behavior is indicative of masquerading, where a malicious binary attempts to mimic legitimate Microsoft software.
This rule detects the execution of potential trojanized ManageEngine OpManager MSI installer files (ManageEngine-OpManager.msi or opmanager.msi) by msiexec.exe when initiated by processes other than standard system binaries like explorer.exe, svchost.exe, or msiexec.exe itself. This behavior is indicative of an attacker attempting to execute a malicious installer package, which may be part of a supply chain compromise or an attempt to install a malicious payload masquerading as legitimate software.
This rule detects the execution of potential trojanized ManageEngine OpManager MSI installer files (ManageEngine-OpManager.msi or opmanager.msi) by msiexec.exe when initiated by processes other than standard system binaries like explorer.exe, svchost.exe, or msiexec.exe itself. This behavior is indicative of an attacker attempting to execute a malicious installer package, which may be part of a supply chain compromise or an attempt to install a malicious payload masquerading as legitimate software.
Detects the creation of executable files within the C:\ProgramData\ directory initiated by common command-line interpreters (cmd.exe, powershell.exe, wscript.exe, svchost.exe). This pattern is often indicative of the SystemBC backdoor or similar malware attempting to drop its executable payload in a non-standard, persistent location to evade initial detection.
Detects the execution of a malicious npm package ('@withgoogle/stitch-sdk') which uses scope-squatting to impersonate a legitimate library. The rule flags the execution of preinstall scripts that involve references to the malicious exfiltration domain 'stitch-production.org' or the identified maintainer 'maximus-mcmillan', indicating unauthorized credential harvesting.
Detects FleetDeck Go-compiled installer
Detects the final payload stage of LokiBot infostealer, characterized by a 32-bit Windows PE file built with MSVC 2015. The rule identifies specific known malicious file hashes or a structural signature featuring a non-standard PE section named 'x', which is used by the malware to store 3DES-encrypted C2 endpoint addresses.
Detects the execution of malicious .NET assemblies associated with the Turla group's STOCKSTAY malware family. The rule identifies specific file names (ClientMNGR2.exe, GR3.exe) and known SHA256 hashes indicative of these assemblies, which utilize the K1MORPHER string obfuscation technique.
Detects the execution of files with .exe, .msi, or .bat extensions located within the user AppData Roaming directory. This path is frequently abused by malware, droppers, and persistence mechanisms to execute code in a directory that is typically writable by the user without requiring elevated administrative privileges.
Detects the creation of temporary files in Windows Temp or SystemTemp directories that match the naming patterns used by the Windows Installer (MSI) service. These files, often starting with 'MSI' or '~DF' and ending in '.tmp' or '.TMP', are typically legitimate installer artifacts, but suspicious patterns or unexpected execution locations may indicate staging of malicious installers.
Detects suspicious files, modules, or batch scripts executed from or staged within AppData Roaming directories, specifically targeting known patterns such as custom utils folders, DLL sideloading impersonation (e.g., 7z.dll, normaliz.dll), and Python C2 module components.
This rule detects potential BeepRat malware activity by monitoring for specific file names associated with the threat, combined with reconnaissance behaviors. The rule identifies processes performing system information discovery, specifically machine identification (GetHWID), hardware metrics (ProcessorCount, DriveInfo), and cryptographic operations (MD5CryptoServiceProvider) which are commonly used in the initial stages of malware execution to profile target systems.
Detects the execution of HFY.exe, a known component of the BeepRAT malware family, along with the presence of its associated sideloaded or dependency DLL files (e.g., data.dll, SQLite.Interop.dll). The rule monitors both process creation events and file system artifacts indicative of the malware's deployment.
Detects instances where the 7z.exe process launches an executable or script file, often indicative of an adversary bypassing Mark-of-the-Web (MotW) protections by manually extracting malicious payloads from a downloaded archive.
Detects an executable containing numeric argument parsing and Base64 decoding routines used as a staged execution gate. This YARA rule specifically looks for the presence of API calls related to command-line argument parsing (CommandLineToArgvW, atoi, strtoul) and Base64 decoding (CryptStringToBinary) within an executable, which are indicative of malware like Sessiongate.
Detects PNG or BMP image files used as steganographic carriers for hidden PE payloads. This rule specifically looks for PE (Portable Executable) headers (MZ and PE signatures) either appended after the PNG IEND (End of Image) marker or embedded within a high-entropy BMP file, indicating a hidden executable payload. This technique has been observed in multi-stage Remcos RAT loader campaigns.
Page 69 of 80