Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects potential multi-stage loader execution chains where a user mounts an ISO file via Windows Explorer, followed by the execution of LOLBAS binaries (rundll32.exe, regsvr32.exe, or mshta.exe) that exhibit suspicious behavior such as reflective loading or memory allocation commands within a 30-minute window of the ISO mount event.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects unauthorized credential validation attempts on macOS using the 'dscl -authonly' command. The rule identifies instances where suspicious interpreter processes (like bash, zsh, python, or curl) or their derivatives attempt to validate credentials via the Directory Service Command Line tool, while excluding known legitimate system and management processes.
Detects potential Cl0p ransomware activity by correlating the deletion of Volume Shadow Copies or backup catalogs with a subsequent burst of file creation, modification, or renaming activity on the same device. This behavior is indicative of ransomware preparing to encrypt files by inhibiting system recovery, followed by the mass encryption stage, while filtering out known administrative and legitimate software update activity.
Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.
This rule detects activities indicative of Android APK repackaging and the manual injection of the Frida-gadget library to bypass security controls like SSL pinning. It monitors for the use of APK patching tools followed by ADB installation commands, the installation of specific patched APK names, the presence of the Frida-gadget shared library file, and system-level signature mismatch errors from the PackageManager.
Detects rundll32.exe executing a DLL located in a user-profile directory (Users, AppData, or Documents and Settings) shortly after that same DLL file was created or written, consistent with CountLoader's taskType 3 DLL delivery and execution behavior.
Detects scheduled task creation or execution masquerading as GoogleUpdateService or MSEdgeUpdateService with a GUID suffix, combined with anomalous payload indicators such as csvchost.exe, psvchost.exe, App.py, python-3.13.13-embed-amd64.zip, or WakeToRun=$true, associated with the DOUBLECUP loader delivering the DeviceManager RAT.
Detects PowerShell processes launched with encoded command arguments (-enc/-EncodedCommand) alongside reflective .NET assembly loading or ScriptBlock usage from the same process lineage within a 5-minute window, indicative of CountLoader-style in-memory payload execution.
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Detects the creation of kernel-mode driver services associated with the Phantom Mantis EDR-killer (LARVA-368). The rule monitors for registry modifications to service ImagePath values containing 'drv.sys' for services named 'drvsvc' or 'a', and tracks command-line executions of 'sc.exe' attempting to create kernel services with those same names or paths, indicating unauthorized kernel-mode code execution attempts for security software suppression.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
This rule detects the execution of processes associated with G12/G13 EDR-killer tools. These tools are specifically designed to automate the termination of security software, antivirus solutions, and remote management processes, which is a common tactic used by adversaries to evade detection and maintain persistence.
Detects the execution of explorer.exe on an alternate, non-default Windows desktop. This behavior is a common indicator of Hidden VNC (hVNC) attacks where malware creates an isolated, invisible desktop environment to interact with the victim's session remotely and surreptitiously.
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects a command line containing the Cyrillic string 'вшк', a mistyped attempt at the 'dir' command on a Russian keyboard layout, observed as a hands-on-keyboard artifact in STAC4749 intrusions.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects a command line containing the Cyrillic string 'вшк', a mistyped attempt at the 'dir' command on a Russian keyboard layout, observed as a hands-on-keyboard artifact in STAC4749 intrusions.
Detects a browser process (chrome.exe, msedge.exe, firefox.exe, brave.exe) writing a new, previously-unseen executable to a Downloads/Temp/Cache path and then launching that same executable within minutes — the terminal behavior of SourTrade's in-browser malware assembly pipeline, consistent with local execution of the JSCEAL (WeevilProxy) stealer payload.
No description available.
Page 307 of 977