Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects potential persistence mechanisms that mimic or leverage the Microsoft OneDrive update process. This includes the creation or modification of scheduled tasks containing 'OneDrive Update' in the command line using tools like schtasks or PowerShell, as well as modifications to the HKCU OneDrive environment registry key, a behavior associated with the GigaWiper malware.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects processes attempting to enumerate or interact with specific Windows window classes (e.g., 'SysListView32', 'SHELLDLL_DefView', 'Progman') often used by malware like NoEscape ransomware to identify active desktop, taskbar, or explorer UI elements, likely to facilitate data theft or interface manipulation.
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects instances where a 'node.exe' process spawns common reconnaissance utilities (tasklist.exe, wmic.exe, sc.exe) or attempts to access registry keys associated with security software (e.g., CrowdStrike, SentinelOne, Windows Defender). This behavior is indicative of a Node.js-based application potentially being leveraged as a platform for post-exploitation activities, such as environment discovery or tampering with security controls.
This rule monitors for the execution of a specific process file located within the 'ProgramData' directory that matches a known malicious MD5 hash.
This rule detects attempts to interact with the Win32_ShadowCopy WMI class using command lines or event logs that indicate deletion or query activity (e.g., DeleteInstance, ExecQuery, SELECT). This is a common technique used by ransomware to inhibit system recovery by deleting volume shadow copies.
Detects the execution of JScript files via wscript.exe where the file name follows the 'wupd_' naming convention. This pattern is characteristic of LabubaRAT, which drops obfuscated or malicious scripts with this prefix to execute them using the Windows Script Host.
Detects certain command line parameters often used during reconnaissance activity via web shells
Detects the execution of the PsExec service (psexesvc.exe) which is commonly used for remote command execution and lateral movement. This rule monitors for process creation events where psexesvc.exe is spawned by services.exe or wininit.exe, indicative of a remote service installation typically associated with administrative or adversary activity.
This rule detects potentially unauthorized or suspicious developer activity, specifically focusing on the execution of custom scripts like 'temp_auto_push.bat', automated task execution via VS Code 'tasks.json' files, and git commands that bypass security checks using '--no-verify'. These activities may indicate repository tampering, modification of source code integrity, or attempts to automate actions that circumvent established development workflows.
Detects the LuaJIT interpreter (luajit.exe) or the AutoIt3 interpreter (AutoIt3.exe) being used to execute a file with a .ttf, .au3, or .a3x extension from %PUBLIC%\Libraries as a script argument. This technique is used in the TTF Trap campaign where a malicious Lua loader is disguised as a TrueType Font file and passed as a parameter to the dropped LuaJIT 2.1.0-beta3 interpreter, or alternatively executed via AutoIt3 as an equivalent execution vehicle, to evade detection.
This rule monitors process execution events for activity related to known malware families (CryptoLoader, PsStealer, Net.loader, PureRAT) or processes executed from '_MEI' temporary directories. It aggregates events within a 15-minute window per device and user, alerting when two or more distinct processes are identified, which is indicative of malware staging or execution chains.
This rule detects potential reconnaissance activity on macOS by monitoring for the execution of 'system_profiler' to gather system application data or the use of 'grep' to search for process information (ps). Such activity is often associated with initial discovery phases where an adversary gathers information about the target system.
Detects the creation of a Windows Shortcut (.lnk) file in the Startup folder using WScript.Shell, often used by the Starland RAT or similar malware to establish persistence. The rule monitors command lines for the combination of WScript.Shell invocation, the CreateShortcut method, and targeting of pythonw.exe or LICENSE.txt files.
Page 324 of 977