Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects an unsigned or unrecognized process performing read or modification operations on multiple types of credential stores (SSH keys, cloud CLI configurations, and environment variable files) within a short time frame. This behavior is indicative of credential harvesting or unauthorized looting of secrets from a developer workstation, similar to techniques used by stealer malware.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
A non-browser process pivoting through the browser's CDP loopback debug port, so the RAT's own traffic never leaves 127.0.0.1. Tightened to exclude known developer tooling and browser automation frameworks (VS Code debugger, Chrome DevTools frontend, Selenium/Puppeteer/Playwright drivers) that legitimately attach to the local CDP debug port.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
This rule detects rundll32.exe attempting to access the memory of common web browsers (Chrome, Edge, Firefox, IE). The activity is identified by the presence of 'jangadeiro' in the command line of the rundll32 process, which is a known behavior of the Lampion banking trojan used for browser overlay credential theft.
Detects credential dumping activity targeting the Local Security Authority Subsystem Service (LSASS) process using mimikatz.exe. This rule monitors for the execution of mimikatz.exe, direct process access (OpenProcess/ProcessAccessedLsass) to lsass.exe by mimikatz, and the spawning of lsass.exe by the mimikatz process, as observed in post-exploitation scenarios following initial backdoor access.
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
A non-browser process pivoting through the browser's CDP loopback debug port, so the RAT's own traffic never leaves 127.0.0.1. Tightened to exclude known developer tooling and browser automation frameworks (VS Code debugger, Chrome DevTools frontend, Selenium/Puppeteer/Playwright drivers) that legitimately attach to the local CDP debug port.
Detects suspicious activity associated with credential stealers where an unsigned or unrecognized process accesses MetaMask or Exodus wallet vault/seed files, performs process injection into legitimate browser/wallet binaries, or attempts to utilize DPAPI (CryptUnprotectData) or PBKDF2 for wallet credential decryption.
Detects enabling of WDigest credential caching (UseLogonCredential=1) in the registry, followed within 6 hours by execution of common credential dumping tools (procdump, Mimikatz, NanoDump, taskmgr + LSASS/MiniDump/comsvcs) on the same host. This pattern is a strong indicator of post-exploitation credential access in high-tempo ransomware operations like Medusa (Storm-1175).
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
Detects the JC-46 AsyncRAT technique chain where the malware opens winlogon.exe's process token, duplicates it into an impersonation token, calls ImpersonateLoggedOnUser, enables SE_DEBUG_NAME via AdjustTokenPrivileges to reach SYSTEM context, then uses CNG (NCryptOpenStorageProvider/NCryptOpenKey/NCryptDecrypt) and BCrypt AES-GCM (BCryptOpenAlgorithmProvider) APIs to unwrap Chromium v96+ App-Bound Encryption keys.
A non-browser process pivoting through the browser's CDP loopback debug port, so the RAT's own traffic never leaves 127.0.0.1. Tightened to exclude known developer tooling and browser automation frameworks (VS Code debugger, Chrome DevTools frontend, Selenium/Puppeteer/Playwright drivers) that legitimately attach to the local CDP debug port.
Detects creation of a hardcoded mutex object used by the WLDR C2 implant to enforce single-instance execution and prevent duplicate agent processes.
Detects the execution of Mimikatz or the use of specific command-line arguments (e.g., sekurlsa::logonpasswords) known for extracting sensitive credentials from the Local Security Authority Subsystem Service (LSASS) process memory. The rule monitors both process creation command lines and raw process memory read operations targeted at lsass.exe.
Detects process injection attempts leveraging Asynchronous Procedure Calls (APC) by monitoring process access events for a characteristic API call sequence involving VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and CreateRemoteThread, commonly associated with the Starland RAT.
Detects process injection attempts leveraging Asynchronous Procedure Calls (APC) by monitoring process access events for a characteristic API call sequence involving VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and CreateRemoteThread, commonly associated with the Starland RAT.
This rule monitors for processes attempting to access the memory of the Local Security Authority Subsystem Service (LSASS) with permissions (PROCESS_VM_READ and PROCESS_QUERY_INFORMATION) typically required for credential dumping. It filters out processes that have historically performed this action in the last 30 days to reduce noise and highlight potentially malicious or anomalous activity.
Detects potential anonymization attempts by identifying systems that connect to the Tor network check service followed closely by processes accessing local machine identifiers, such as machine-id or board serial numbers. This behavior may indicate an actor attempting to verify anonymity or fingerprint a host while routing traffic through Tor.
Detects process injection attempts leveraging Asynchronous Procedure Calls (APC) by monitoring process access events for a characteristic API call sequence involving VirtualAllocEx, WriteProcessMemory, QueueUserAPC, and CreateRemoteThread, commonly associated with the Starland RAT.
Page 11 of 32