Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
665 detections
Filters
Last updated
All Time
Detection languages
257
174
86
76
36
Contributors
214
130
63
53
33
Categories
20,440
11,814
5,871
5,145
4,864
665
Platforms
641
26
7
3
2
Products / Services
317
186
85
32
25
MITRE Techniques
365
233
219
210
197
CVEs
2
2
2
2
1
IDS Classtypes
1
IDS Protocols
1
Detects PHP processes reading both /proc/self/maps and /proc/self/mem within a short time window. This activity is indicative of an Address Space Layout Randomization (ASLR) bypass technique, specifically associated with exploits attempting to compute memory offsets for sensitive functions (e.g., zend_execute_internal, zif_system) to facilitate Remote Code Execution (RCE).
This rule detects potential privilege escalation activity associated with the abuse of CTFMON related objects (named pipes, symlinks, junctions) which may be used in conjunction with high-privilege operations (like SeDebugPrivilege or SeImpersonatePrivilege) to elevate access to SYSTEM. It correlates access events for CTF objects by processes (other than the legitimate ctfmon.exe) with subsequent sensitive privilege assignments within a short time window.
This rule detects various methods used to extract credentials protected by the Windows Data Protection API (DPAPI). It covers multiple vectors, including Mimikatz DPAPI module usage, unauthorized loading of the dpapi.dll library, suspicious access to browser or WiFi credential stores, and cross-process memory access to the LSASS process to extract DPAPI master keys.
This rule detects potential keylogging activity by identifying either low-level Windows keyboard hooks initiated by suspicious processes or the creation of suspicious log files in user-writable directories by unsigned processes. It filters out common, trusted browser processes and signed Microsoft binaries to reduce noise.
Detects Node.js processes accessing common shell history files (e.g., .bash_history, .zsh_history, PowerShell history). Such behavior is often indicative of credential harvesting or post-exploitation reconnaissance activity, specifically where a Node.js runtime environment is being leveraged to read sensitive user activity logs.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects suspicious inter-process communication via named pipes and cross-process thread injection targeting known sideloading host processes, specifically associated with the SPECTRALVIPER threat activity.
This rule detects common web application processes (such as nginx, python, node, etc.) accessing the /proc/[pid]/environ file, which contains environment variables that may include sensitive information like credentials or configuration secrets. The rule correlates this access with subsequent external network connections initiated by the same process, which is highly indicative of data exfiltration after sensitive information has been retrieved.
Detects techniques associated with the SharkLoader malware (StrikeShark campaign) that bypass loader locks via self-injection. It monitors Sysmon Event ID 8 (CreateRemoteThread) for suspicious self-injection from specific staging directories (\xwreg\ or \xgdf\) and Sysmon Event ID 10 (ProcessAccess) for instances where these binaries open themselves with full access rights to manipulate the loader lock prior to Cobalt Strike delivery.
Detects instances where a process launch exhibits PPID spoofing (where the reported parent PID does not match the actual creator PID) followed by that spoofed process attempting to access high-privileged system processes such as lsass.exe, services.exe, or winlogon.exe within a two-minute window. This behavior is indicative of privilege escalation attempts.
Detects processes that install a low-level keyboard hook (WH_KEYBOARD_LL) and are simultaneously involved in suspicious activity, such as network connections to non-private IP addresses and file writes to typical temporary directories (e.g., C:\Windows\Temp, C:\Users\Public). This behavior is characteristic of keylogging activity and subsequent data exfiltration or staging.
Detects unsigned or non-Microsoft processes attempting to access sensitive system process memory (lsass.exe, winlogon.exe, services.exe) or processes attempting to enable SeDebugPrivilege, which are common indicators of credential dumping or process injection attempts.
This rule detects activities associated with VILE ransomware, focusing on unsigned Go-based binaries. It flags processes performing cross-process operations, creating specific file artifacts (e.g., vile_deadlines.json, vile_Decryptor), or invoking direct NT system calls such as NtCreateWaitCompletionPacket to evade EDR hooks.
This rule detects unauthorized attempts by non-browser processes to access sensitive browser-related files (Login Data, Cookies, Web Data, etc.) or interact with browser processes to extract secrets. It monitors for Sysmon Event IDs 10 (ProcessAccess), 11 (FileCreate), 7 (ImageLoad), and 1 (ProcessCreate) where a suspicious process (often located in temporary or user profile directories) attempts to read or interact with known browser credential storage paths.
The rule detects potential credential dumping activities by monitoring for the execution of Mimikatz or the use of its specific command-line arguments (e.g., sekurlsa::logonpasswords, /ntlm:). It also monitors for suspicious, unauthorized processes attempting to open a handle to the LSASS process to access its memory, a common technique for dumping credentials.
Detects unauthorized or suspicious processes attempting to open a handle to the Local Security Authority Subsystem Service (lsass.exe) with access rights required for memory reading, such as PROCESS_VM_READ or PROCESS_QUERY_INFORMATION. This behavior is a common prerequisite for credential dumping techniques like Minidump or direct memory extraction used by malicious tools.
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
This rule detects potential privilege escalation activity associated with the abuse of CTFMON related objects (named pipes, symlinks, junctions) which may be used in conjunction with high-privilege operations (like SeDebugPrivilege or SeImpersonatePrivilege) to elevate access to SYSTEM. It correlates access events for CTF objects by processes (other than the legitimate ctfmon.exe) with subsequent sensitive privilege assignments within a short time window.
Detects multiple indicators of process injection into svchost.exe including suspicious process access rights, remote thread creation, unexpected loading of .NET CLR modules, and the subsequent spawning of suspicious child processes. The rule aggregates these signals to identify potential fileless execution or persistence mechanisms within a legitimate system process.
This rule detects two scenarios on Linux systems: 1. A non-root process interacting with a root process (e.g., cross-process communication where the source is non-root and the target is root). 2. Any process (excluding root) exhibiting indicators related to 'AF_ALG' or 'splice', or mentioning 'CVE-2026-31431' in its name or description. These indicators are often associated with privilege escalation attempts or kernel exploits.
Detects sideloaded Android applications that simultaneously initiate screen capture via the MediaProjection API and audio recording via the RECORD_AUDIO permission. This activity is consistent with surveillance capabilities of the Ghazwa spyware used by the APT36 threat actor.
Page 14 of 32