Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects suspicious process creation patterns indicative of process hollowing. The rule identifies processes spawned by common script interpreters (powershell.exe, wscript.exe, cscript.exe, conhost.exe) in a suspended state, followed by memory operations involving ntdll.dll and APIs such as NtUnmapViewOfSection or ResumeThread, which are characteristic of hollowing injection techniques.
Detects execution of LausivLoader by identifying suspicious process creation patterns typically associated with process hollowing. This includes a parent process (powershell.exe or conhost.exe) launching a child process in a suspended state (CREATE_SUSPENDED), followed by behavioral indicators of memory manipulation and code replacement.
Detects execution of PowerShell scripts attempting to modify Windows Defender settings by adding directory exclusions (including the C:\ drive) via cmdlets like Add-MpPreference, Set-MpPreference, or WMI/CIM methods, often followed by a forced Group Policy refresh. This pattern is associated with malicious staging activity, including malware loaders like LausivLoader.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy the Active Directory database file (ntds.dit) from the shadow copy. This pattern is commonly used by adversaries to perform offline credential dumping.
This rule monitors for two distinct stages of potential account recovery abuse. First, it detects the execution of suspected Python scripts on an endpoint that contain command-line arguments related to password recovery or authentication codes. Second, it monitors network proxy/web logs for a high volume of API requests to the 'easy4ipcloud.com' domain associated with password reset or device probe endpoints, which may indicate automated credential stuffing or unauthorized device account recovery attempts.
Detects the execution of PowerShell via script interpreters (wscript.exe, cscript.exe) or terminal hosts (conhost.exe) where the command line contains specific environment variable lookups and obfuscated string identifiers. This pattern is commonly associated with malware or malicious payloads attempting to execute PowerShell commands indirectly to evade detection.
This rule detects PowerShell commands that exhibit multi-stage suspicious behavior indicative of fileless malware execution. It monitors for combinations of cryptographic operations (AesManaged), decompression (GZipStream), and reflective assembly loading (System.Reflection.Assembly), which are common tactics used by attackers to decrypt, decompress, and execute malicious payloads directly in memory.
Detects the execution of wscript.exe spawning a child process of powershell.exe where the command line arguments are highly suspicious, including headless mode, encoded commands, and hidden window parameters. This pattern is commonly used by attackers to execute obfuscated malicious scripts while attempting to avoid detection.
Detects the execution or file activity associated with the 'OrionQuests-Setup.exe' installer. This rule monitors both process creation and file system activity to track the presence and usage of this specific installer executable, which may indicate the installation of potentially unauthorized or untrusted software.
Detects the execution of PowerShell with encoded commands or Base64 decoding attempts initiated by common Windows shell applications (explorer, mshta, wscript, cscript) launched from an LNK file. This pattern is commonly associated with malicious LNK shortcuts used as initial access vectors or stage-two downloaders.
Detects instances where wscript.exe spawns conhost.exe with a headless flag, which in turn executes PowerShell with hidden, encoded command-line arguments. This pattern is often indicative of multi-stage malware loaders attempting to obfuscate execution and bypass security monitoring.
Detects the execution of the OnvifUser utility with the -u flag, a technique observed in post-exploitation scenarios on Dahua network video recorder (NVR) devices to dump cached credentials.
Detects the execution of known Jarte-derived host processes (GRrte.exe or Jarte.exe) which are commonly leveraged as side-loading proxies for the PlugX remote access trojan. The rule flags the process initiation as a proxy indicator for the subsequent execution of PlugX's modular payload, which performs system enumeration and process discovery.
Detects the execution of known Jarte-derived host processes (GRrte.exe or Jarte.exe) which are commonly leveraged as side-loading proxies for the PlugX remote access trojan. The rule flags the process initiation as a proxy indicator for the subsequent execution of PlugX's modular payload, which performs system enumeration and process discovery.
Detects the creation of a scheduled task configured to run under the SYSTEM account that executes a command to add a Windows Defender exclusion using Add-MpPreference. This technique is often used to ensure persistence of security exclusions by re-applying them automatically with high privileges, even if an interactive user attempts to remove them.
This rule detects instances where Adobe Acrobat (Acrobat.exe) is launched by an unusual or potentially obfuscated process (GRrte.exe), specifically when loading a PDF file from a temporary user directory. This pattern is indicative of potential malicious document execution where a PDF is used as a delivery mechanism for malware.
This rule detects the execution of processes containing 'OnvifUser' and command line arguments specifying '-u', which is consistent with the usage of ONVIF device discovery tools. ONVIF discovery protocols are used to identify network video transmitters. Unauthorized use of these tools can indicate reconnaissance activity within a network to identify cameras or video surveillance devices.
This rule detects various system events (including process execution and user account creation) that contain the specific string 'p2pwn' in combination with the string 'p2password'. This pattern suggests the activity involves potentially malicious credential testing, hardcoded credential usage, or suspicious account interaction activity.
This rule detects two potentially malicious activities: the addition of exclusions to Windows Defender using reg.exe, which can be used to hide malicious files from security scanning, and the forceful update of Group Policy using gpupdate.exe with /force and /wait:0, which can be used to propagate malicious policy changes or force re-application of settings.
Detects attempts to modify Microsoft Defender settings, such as adding file path exclusions via PowerShell, Registry manipulation, or Scheduled Tasks, as well as disabling Tamper Protection. These actions are commonly used by attackers to evade security monitoring by hiding malicious files or disabling protective features.
This rule detects the opening of a specific PDF file named 'OIC_Invitation_General_Official.pdf' by Adobe Acrobat. The detection logic triggers either when Acrobat processes this file or when the file itself is identified on the system. This pattern has been associated with the delivery of the PlugX remote access tool, often used in targeted spearphishing campaigns.
Page 168 of 977