Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects attempts to bypass User Account Control (UAC) by invoking the CMSTPLUA COM interface (CLSID: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}). This technique allows an attacker to execute processes with elevated privileges by leveraging the auto-elevation property of this COM object, often using the 'Elevation:Administrator!new' moniker.
Detects instances where notepad.exe is executed with a security context (AccountName) that differs from the initiating process's account (InitiatingProcessAccountName). This pattern is consistent with the LegacyHive technique, which utilizes CreateProcessWithLogonW to load a target user's registry hive by spawning a suspended process as that user.
Detects a sequence of events indicative of an MSI rollback attack, where an attacker triggers an MSI installer error, modifies the associated .rbs (rollback script) file in the C:\Config.Msi folder using a non-msiexec process, and subsequently executes the modified script (poc.cmd) to achieve unauthorized code execution with elevated privileges.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects the execution of an executable file stored within an NTFS Alternate Data Stream (ADS) on Windows systems. The rule correlates a process launch from a file path containing an ADS colon syntax with the creation of an anomalous file in the Windows Prefetch directory that masquerades as common image or text file types (png, jpg, jpeg, txt, dat). This behavior is characteristic of adversaries attempting to hide malicious binaries in ADS while interfering with or manipulating system forensic artifacts.
Detects the ClickFix execution chain: base64-encoded regsvr32 command pasted into the Windows Run dialog, staging TinyEgg as an OCX payload.
Detects mshta.exe being launched from explorer.exe or cmd.exe with a command line argument pointing to a remote HTTP/HTTPS resource ending in .hta. This pattern is commonly used by adversaries to execute malicious remote HTML applications for initial access or code execution.
Detects ClickFix social engineering used in the TELEPUZ/VIDAR campaign where a user is tricked into executing a PowerShell command that downloads a binary from memshowblob.forum using bypass flags and removes the Zone.Identifier ADS. Part of the CLICKFIX-VIDAR initial access chain delivering TELEPUZ MaaS malware.
Detects procdump execution targeting lsass.exe
Kind of like https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
Kind of like https://github.com/SigmaHQ/sigma/blob/6fe7343bf79306884b05837d5e03bcbcb141ce50/rules/windows/builtin/security/win_security_susp_lsass_dump.yml#L19
Detects the execution of specific OCX files (updater.ocx, chromelevator.ocx, mscom.ocx, koki.ocx, or agent.ocx) using regsvr32.exe from user-writable directories like Temp or AppData, a behavior associated with the TinyEgg/ChonkyChicken/ChromEggscalator malware families.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.
Detects colorcpl.exe being spawned as a suspended injection host by an interpreter dropped to C:\Users\Public\Libraries as part of the TTF Trap campaign, regardless of whether the triggering parent is luajit.exe or AutoIt3.exe. The campaign implements two functionally equivalent injection chains into colorcpl.exe - a LuaJIT-FFI path that resolves kernel32 APIs via FFI/bit libraries and a parallel AutoIt-driven ntdll-unhooking path - both of which launch colorcpl.exe suspended, then perform VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to reconstruct and execute Donut-packed shellcode in its address space. Matching on the Public\Libraries staging path (rather than solely on interpreter name) ensures the rule fires on either trigger path even if the interpreter binary is renamed.
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Detects rundll32 execution where the DLL is located on a remote location (share)
Detects the wp2shell post-exploitation cleanup pattern where a shell spawned by a web server process determines its current working directory, matches it against a wp-content/plugins path using the specific `case "$d" in */wp-content/plugins/*) cd / && rm -rf "$d";; esac` one-liner shape, and recursively deletes that directory to remove the deployed web shell plugin. This is tightened to require the exact case-statement/one-liner construction executed by a shell that is a child of a web server process, rather than any generic recursive delete under wp-content/plugins, which would also fire on legitimate WordPress plugin uninstall hooks that remove their own plugin directory. Absence of the plugin directory afterward should not be treated as evidence the host is clean.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
Page 314 of 977