Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
Detects the execution of the Bun JavaScript runtime invoking 'index.js' as part of an npm lifecycle event (such as preinstall). This pattern is commonly used in supply chain attacks to execute arbitrary code during the installation of malicious packages.
Detects the use of 'curl.exe' to download a file named 'msgbox.exe' to the local temporary directory, specifically when triggered by 'cmd.exe' originating from 'chrome.exe'. This pattern is indicative of a browser-based delivery mechanism initiating a secondary malicious download.
Detects behavioral indicators consistent with local privilege escalation targeting Windows ALPC subsystem vulnerabilities (CVE-2026-85880). The rule correlates: 1) Unsigned or low-prevalence processes loading sensitive ALPC-related DLLs (rpcss.dll, ntdll.dll), 2) Subsequent crashes or restarts of critical ALPC-handling system components (lsass.exe, RPCSS, wuauserv), and 3) The generation of a new SYSTEM-level process by a parent that was not previously running as SYSTEM within a short temporal window.
Detects the use of PowerShell, pwsh, or cmd to execute the 'Add-MpPreference' command with the '-ExclusionPath' parameter, specifically targeting common directories like Telegram Desktop or specific system directories. This activity suggests an attempt to bypass security scanning by excluding known malicious locations or folders from Microsoft Defender's real-time monitoring.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
This rule detects the execution of a process named 'WhatssApp.exe' from a non-standard location ('C:\ProgramData\Drivers\Whatsapp\'), which is indicative of masquerading. It further correlates this activity with the prior termination of the legitimate 'whatsapp.exe' process within a 30-minute window, a pattern often associated with 'WhatsappCheker' or similar malicious tools designed to hijack legitimate application sessions.
This rule detects the execution of a process named 'WhatssApp.exe' from a non-standard location ('C:\ProgramData\Drivers\Whatsapp\'), which is indicative of masquerading. It further correlates this activity with the prior termination of the legitimate 'whatsapp.exe' process within a 30-minute window, a pattern often associated with 'WhatsappCheker' or similar malicious tools designed to hijack legitimate application sessions.
This rule detects the execution of a process named 'WhatssApp.exe' from a non-standard location ('C:\ProgramData\Drivers\Whatsapp\'), which is indicative of masquerading. It further correlates this activity with the prior termination of the legitimate 'whatsapp.exe' process within a 30-minute window, a pattern often associated with 'WhatsappCheker' or similar malicious tools designed to hijack legitimate application sessions.
Detects instances where suspicious or potentially non-standard processes (e.g., winappx.exe, MsCache.exe) or Python scripts running from specific ProgramData subdirectories spawn cmd.exe with a /c command line argument. This pattern is often indicative of persistence mechanisms, lateral movement, or malicious script execution.
This rule monitors endpoint network events, file operations, and process executions for known malicious indicators (domains and file hashes) associated with Kremlin activity. It detects connections to suspicious remote domains and the existence or execution of specific malicious file hashes.
This rule monitors endpoint network events, file operations, and process executions for known malicious indicators (domains and file hashes) associated with Kremlin activity. It detects connections to suspicious remote domains and the existence or execution of specific malicious file hashes.
This rule detects the execution of the SentinelOne memory scanner process (SentinelMemoryScanner.exe) or the loading of the associated SentinelOne core library (SentinelAgentCore.dll) from a directory path outside of the standard SentinelOne installation locations (Program Files\SentinelOne or Program Files (x86)\SentinelOne). This behavior is indicative of potential masquerading or tampering where an adversary attempts to execute a renamed or moved security tool to bypass policy or evade detection.
Detects instances where the VLC Media Player process (vlc.exe) acts as the parent to common LOLBAS (Living Off the Land Binary and Script) executables such as cmd.exe, powershell.exe, and others. This pattern is often indicative of exploitation attempts or malicious activity where a compromised or trojanized application triggers secondary payloads.
Detects potential exploitation of a CrowdStrike Falcon remediation process vulnerability ('FalconFlank'). The rule identifies either direct execution of the PoC binary or the suspicious combination of a CrowdStrike remediation process loading an unsigned or untrusted DLL from a user-writable path followed by the same process spawning a command shell in the SYSTEM context within 15 minutes.
This rule detects the sequence of an external file download over HTTP, followed by the immediate creation and execution of an executable file (.exe, .dll, .scr) on the endpoint. It specifically filters out common system installers (e.g., msiexec.exe, trustedinstaller.exe) to reduce noise, focusing on potentially malicious payloads delivered via network channels.
Detects process creation events containing command-line arguments indicative of an OAuth 2.0 device code flow, commonly used in consent phishing or device code phishing attacks to hijack account access via a malicious OAuth application registration.
Detects the execution of known malicious files associated with the BlueDelta threat group, specifically the HOOKEDGE and HEADLACE malware families, using a curated list of SHA-256 file hashes. Additionally, the rule monitors for the execution of scripts with GUID-based filenames, a common tactic for temporal or staged file deployment.
Detects the use of .NET reflection assembly loading techniques (e.g., Assembly.Load, [Reflection.Assembly]::Load) within the command line arguments of known LOLBAS (Living Off the Land Binary and Script) processes. This behavior is frequently associated with fileless malware execution or the loading of malicious assemblies directly into the memory space of trusted Windows binaries.
Detects the creation or registration of scheduled tasks that masquerade as Google Chrome updates but point to non-standard executable paths. This is a common technique used by malware to establish persistence by mimicking legitimate software update tasks.
Detects the creation of scheduled tasks that contain the string 'Google Chrome Update' in the command line, but are not associated with the legitimate GoogleUpdate.exe binary. This is a common technique used by malware to establish persistence by masquerading as a legitimate update process.
Page 212 of 977