Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of PowerShell to modify Microsoft Defender (MpPreference) settings by adding specific directories or files to the exclusion list. This behavior is frequently associated with adversaries attempting to evade security detection by ensuring malicious tools, staged payloads, or persistent files remain unscanned by the antivirus engine.
This rule detects potentially unauthorized network communication with AI platforms (OpenAI, Anthropic, Gemini) or Telegram from hosts executing suspicious processes or tools, such as 'frpc' (Fast Reverse Proxy), 'liblocal-service.so', or processes interacting with Android Debug Bridge (adb) utilities. This behavior often suggests the use of automated tools, remote tunneling, or interaction with AI models for post-exploitation tasks, such as code generation for malicious scripts or C2 activity.
Detects the execution of PowerShell commands using 'Add-MpPreference -ExclusionPath' initiated by the CRUDEEXCLUDE Delphi utility. This behavior is associated with threat actors staging directories for the deployment of HEAVYGRAM/SHADEGENES payloads.
Detects the execution of known malicious loader files associated with the MovieReaper campaign. The rule identifies processes based on specific MD5 hashes, or by detecting obfuscated naming conventions where an executable file is disguised as a movie file by appending excessive padding or specific descriptors to the filename, often used to bypass user suspicion when distributed via torrent repositories.
Detects a suspicious sequence of PowerShell commands associated with HEAVYGRAM-related droppers. The rule identifies processes that attempt to bypass security protections by adding Windows Defender exclusion paths, followed by registry-based persistence mechanisms (Run keys) that target common malicious executables such as RuntimeSSH.exe or winappx.exe.
Detects a suspicious execution chain where wscript.exe spawns an encoded PowerShell process to download files from Vultr Object Storage. The rule specifically monitors for the download of decoy files (e.g., .pptx, .zip) followed by the execution of a file named RuntimeSSH.exe, which is associated with the HEAVYGRAM malware implant.
Detects instances where a Visual Studio Code (VS Code) extension host process launches potentially suspicious child processes, specifically command-line tools like cmd.exe, powershell.exe, or calc.exe, within 30 seconds of the extension host starting.
This rule detects potentially malicious activity originating from code editors (VS Code, Electron-based applications) spawning suspicious child processes (cmd.exe, powershell.exe, calc.exe) or the creation of a specific suspicious file 'EXTINSTALL_PWNED.txt' in the 'Users\Public' directory.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
This rule detects potentially malicious activity by monitoring the execution of Python interpreters or specific suspicious executable names from within the C:\ProgramData directory. The detection logic focuses on processes launching from directories associated with configuration or data storage folders, often used by malware for staging or execution to avoid detection. It specifically flags Python execution involving certain suspicious file or argument strings, and the launch of named executables (e.g., RuntimeSSH.exe, smqdservice.exe) located in specific ProgramData subdirectories.
Detects instances where suspicious or potentially non-standard processes (e.g., winappx.exe, MsCache.exe) or Python scripts running from specific ProgramData subdirectories spawn cmd.exe with a /c command line argument. This pattern is often indicative of persistence mechanisms, lateral movement, or malicious script execution.
This rule monitors endpoint network events, file operations, and process executions for known malicious indicators (domains and file hashes) associated with Kremlin activity. It detects connections to suspicious remote domains and the existence or execution of specific malicious file hashes.
Detects execution of the JITTERLY Linux backdoor masquerading as 'configd' (with its -nodel fallback flag) and/or beaconing to its hardcoded C2 domain (s2.981666.xyz:8082), matching Red Heron's observed tradecraft.
Detects HEAVYGRAM/CRUDEEXCLUDE persistence via Run-key registry writes or reg.exe command-line adds, scoped to payloads staged in AppData/ProgramData/Temp/Public/Downloads and excluding legitimate Program Files/System32 targets to reduce false positives from normal software autorun entries.
Detects HEAVYGRAM/CRUDEEXCLUDE persistence via Run-key registry writes or reg.exe command-line adds, scoped to payloads staged in AppData/ProgramData/Temp/Public/Downloads and excluding legitimate Program Files/System32 targets to reduce false positives from normal software autorun entries.
IOC hunt for the HEAVYGRAM/CRUDEEXCLUDE campaign: matches known SHA256 file hashes (first-stage malware, implant, RAR/ZIP artefacts) via DeviceFileEvents and DeviceProcessEvents, plus known-malicious domains/staging infrastructure by parsed hostname across network connections, process command lines, and file origin URLs.
Detects the use of legitimate Windows administrative utilities (vssadmin.exe, wmic.exe, wbadmin.exe) to delete volume shadow copies or backup catalogs. This behavior is a common tactic employed by ransomware actors to inhibit system recovery and prevent restoration of encrypted data.
Detects lateral movement activities involving the use of WMIC to remotely create processes or Schtasks to remotely create scheduled tasks. These techniques are often used by threat actors, including those associated with DragonForce and CRPx0 ransomware, to propagate across a network by executing commands on remote systems.
Detects the execution of PowerShell encoded commands that result in the installation of known remote monitoring and management (RMM) software. This pattern is indicative of attackers, specifically those associated with Ransom Busters or similar affiliates, establishing persistent remote access to compromised systems.
Detects the execution of the SoftPerfect Network Scanner tool (netscan.exe), which is often used by adversaries for reconnaissance to identify active hosts, open ports, and services within a network.
Detects the execution of PowerShell or Rundll32 processes with command-line arguments that reference Anti-Malware Scan Interface (AMSI) components. This is a common indicator of an attempt to bypass or disable AMSI to facilitate the execution of malicious scripts or payloads.
Page 194 of 977