Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects execution or download activity tied to Nimbus Manticore (UNC1549) SEO
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
poisoning campaign delivering trojanized Oracle SQL Developer from getsqldeveloper.com and
related fake Zoom/career portal lures documented alongside Screening Serpens activity.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects the execution of the MinIO Client (mc.exe) on Windows with command-line arguments indicating the interaction with external or arbitrary bucket and endpoint locations. This behavior is indicative of an attacker staging or exfiltrating data to an external S3-compatible cloud storage provider.
Detects the use of rundll32.exe to invoke the MiniDump export function within comsvcs.dll against the lsass.exe process. This technique is commonly used by attackers to dump credential material from memory for offline analysis and credential harvesting.
Detects the execution of mshta.exe with a remote URL containing an .hta file in the command line. This pattern is commonly used by adversaries to proxy execution of malicious scripts via a trusted Windows binary, often initiated by common applications like explorer.exe or cmd.exe.
This rule detects execution chains associated with the Quima RAT loader, specifically monitoring for VBScript-based child processes spawning suspicious command-line activity. This includes the use of certutil.exe to decode payloads, discovery commands like 'where javaw', and the execution of suspicious Java processes with specific arguments or paths indicative of malicious behavior.
Detects the use of the 'pushd' command in combination with a WebDAV share path utilizing the '@SSL' notation. This technique can be used by attackers to force the connection to a remote WebDAV share, potentially triggering NTLM credential relay or accessing malicious remote resources. The inclusion of 'rundll32' in the condition suggests monitoring for process proxying or exploitation chains often associated with such connections.
Detects the installation of Python on Windows systems using various package managers (WinGet, Chocolatey, Scoop), MSI installers, or direct download methods via command-line utilities like PowerShell, curl, or wget.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects the use of the bindutil.exe utility with the --link argument to redirect or interact with amsi.dll. This behavior is indicative of an attempt to bypass or interfere with the Antimalware Scan Interface (AMSI) in Windows, potentially allowing for the execution of malicious scripts or code without detection. The rule includes filters for legitimate processes typically associated with virtualized or containerized environments.
Detects credential dumping activity targeting the Local Security Authority Subsystem Service (LSASS) process using mimikatz.exe. This rule monitors for the execution of mimikatz.exe, direct process access (OpenProcess/ProcessAccessedLsass) to lsass.exe by mimikatz, and the spawning of lsass.exe by the mimikatz process, as observed in post-exploitation scenarios following initial backdoor access.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
Detects the execution of wchelper.exe in conjunction with the reference of a 'wch.zip' file. This behavior is associated with surveillance modules attributed to the Blind Eagle (APT-C-36) threat group, which typically function as spyware to exfiltrate system data.
Detects execution of rundll32.exe where the command line contains a path structured as a GUID, initiated by commonly abused parents such as cmd.exe or explorer.exe. This pattern is often used by malicious payloads to execute code from temporary or obfuscated directories while masquerading as a legitimate Windows process.
This rule monitors for the creation of a scheduled task named 'Autoupdate' that executes a python.exe script. This pattern is commonly used by attackers for persistence mechanisms to ensure their malicious Python scripts run periodically on the host. It correlates both process creation logs for schtasks.exe and security event logs (Event ID 4698) for task creation.
Detects the execution of rundll32.exe from the AppData directory with a specific command-line argument 'jangadeiro'. This behavior is characteristic of the Lampion RAT, which uses rundll32.exe to proxy execution of its malicious DLL component stored within structured subdirectories in the user's AppData folder.
Detects the use of PowerShell to execute the 'Set-MpPreference' command with the 'DisableRealtimeMonitoring' parameter set to true. This technique is commonly used by adversaries to impair Windows Defender security controls and avoid detection during the post-compromise phase.
Detects the execution of PowerShell with bypass execution policy flags originating from the nvidia-sysruntime.exe process. This behavior is associated with the LabubaRAT malware, which leverages this specific parent process to execute malicious PowerShell commands while evading policy restrictions.
Detects the execution of a process named 'AppLaunch.exe' from a directory other than the standard .NET Framework installation paths. Adversaries may masquerade as this legitimate .NET binary to evade detection, as it is a trusted system utility.
Page 320 of 977