Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
255 detections
Filters
Last updated
All Time
Detection languages
84
82
27
24
11
Contributors
61
56
49
22
20
Categories
20,440
11,814
5,871
5,145
4,864
Platforms
247
9
5
3
2
Products / Services
122
67
19
10
7
MITRE Techniques
110
94
73
65
40
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
6
This rule detects potentially malicious behavior associated with driver and inter-process communication, specifically targeting the creation or interaction with 'C:\ProgramData\402.sys', usage of IOCTL control code '2248E0', or activity involving the 'NSecKrnl' named pipe. These indicators are often associated with rootkit-like persistence or kernel-mode communication used by malware.
Detects the Chromelevator loader, identified as 'drun.exe', performing reflective DLL injection of 'payload.dll' using direct syscalls (NtAllocateVirtualMemory, NtCreateThreadEx) and inter-process communication (IPC) via a named pipe ('__DLL_PIPE_COMPLETION_SIGNAL__'). The rule looks for process creation, remote thread creation, memory protection modifications, file creation/modification of 'payload.dll', and specific named pipe events associated with 'drun.exe'.
Detects the creation of named pipes with names commonly utilized by offensive C2 frameworks such as Cobalt Strike, Metasploit, and Covenant. By monitoring for specific pipe naming patterns created by non-system processes, this rule aims to identify potential post-exploitation activity, C2 beacons, or lateral movement tools.
Detects the use of known named pipes associated with Cobalt Strike post-exploitation frameworks, often used for inter-process communication during beaconing or lateral movement.
This rule detects the creation of named pipes associated with known command-and-control (C2) frameworks, post-exploitation toolkits, and suspicious system activity. By filtering out common legitimate system processes and monitoring for specific pipe patterns (e.g., Cobalt Strike, Metasploit, PsExec, and sensitive RPC endpoints), the rule identifies potential lateral movement, remote execution, and post-exploitation communication channels.
Malvertising loader delivering CastleStealer via malicious Google Ads
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
IoT botnet malware family used for DDoS and proxy infrastructure
Cloud extortion group exploiting exposed credentials and storage
Latin American banking trojan using DLL side-loading and overlay attacks
Ransomware group exploiting edge devices and managed file transfer software
Credential and browser data stealer distributed via OXLOADER campaigns
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Clipboard hijacking malware for cryptocurrency address substitution
macOS malware used by JINX-0164 against cryptocurrency developers
Detects SPECTRALVIPER lateral movement activity utilizing the XGU Pivot Shadow technique. The rule monitors for named pipe creation or connection events involving specific host processes (IntelAudioService.exe and OneDrive.Sync.Services.exe) used to orchestrate inter-instance command and control distribution. It also flags potential sideloading behavior where IntelAudioService.exe is executed from an anomalous path within the user profile.
Detects network activity characteristic of the PsExec tool performing lateral movement. The rule monitors for SMB traffic directed at the ADMIN$ share, specifically looking for the creation or access of the 'PSEXESVC' service binary, combined with the use of the 'svcctl' named pipe, which is used by PsExec to remotely control services.
Detects network activity characteristic of the PsExec tool performing lateral movement. The rule monitors for SMB traffic directed at the ADMIN$ share, specifically looking for the creation or access of the 'PSEXESVC' service binary, combined with the use of the 'svcctl' named pipe, which is used by PsExec to remotely control services.
Detects processes that load .NET runtime assemblies (clr.dll/coreclr.dll) from non-standard paths while concurrently performing named pipe inter-process communication and initiating outbound network connections. This behavior is often indicative of fileless execution, living-off-the-land techniques, or lateral movement where a process is repurposed as a proxy or command-and-control conduit.
Detects the creation of suspicious named pipes by low-privilege processes, which is a technique used by local privilege escalation tools (like PrintSpoofer, RoguePotato, and GodPotato) to intercept and impersonate high-privilege (SYSTEM) tokens.
This rule detects instances where common productivity applications (like Office suite) or web browsers spawn child processes that create system mutexes. This is a common indicator of malicious activity where a benign-looking document or web-based threat launches secondary payloads or persistence mechanisms.
Page 5 of 13