Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects modifications to Windows Defender exclusion settings by monitoring both PowerShell command lines containing 'Set-MpPreference' with 'ExclusionPath' and direct Registry modifications to the Defender exclusions key. Threat actors commonly use these techniques to bypass security scanning for malicious files or tools placed in the 'C:\ProgramData' directory.
This rule detects potential Local Privilege Escalation (LPE) activity related to a threat dubbed 'Rogue Planet'. It monitors for the creation of temporary files in the local AppData directory with a 'RP_' prefix and the usage of a specific named pipe named 'RoguePlanet'. The rule further isolates suspicious behavior by identifying processes that are not the standard Windows Error Reporting Manager (wermgr.exe) executing from its legitimate path.
Detects PowerShell or WMIC commands used by Starland RAT to gather system hardware identifiers, RAM capacity, and installed antivirus products via CIM/WMI queries during victim profiling.
Detects the execution of binaries (exe, dll, msi) or scripts via rundll32/msiexec from the user's Local AppData Temp directory. This behavior is commonly associated with staging and executing secondary payloads by malware such as the Starland RAT, which frequently drops and runs its payloads from these locations to evade detection.
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
Detects Python process creation where the command line references base64, zlib, and ctypes libraries concurrently. This combination is frequently used by attackers to deobfuscate, decompress, and execute payloads dynamically in memory, often bypassing traditional file-based detection mechanisms.
Detects command-line execution patterns associated with the Starland RAT, specifically focusing on systematic Active Directory and domain environment reconnaissance. The rule triggers on the use of built-in Windows utilities such as WMI queries for system details, command-line enumeration of users and domain controllers (e.g., net user /domain, nltest /dclist), and detailed identity information gathering (e.g., whoami /all).
Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Detects the use of the 'pushd' command in combination with a WebDAV share path utilizing the '@SSL' notation. This technique can be used by attackers to force the connection to a remote WebDAV share, potentially triggering NTLM credential relay or accessing malicious remote resources. The inclusion of 'rundll32' in the condition suggests monitoring for process proxying or exploitation chains often associated with such connections.
System File Execution Location Anomaly
Cortex XDR
Detects common Windows system binaries (e.g., svchost.exe, rundll32.exe, powershell.exe) executing from non-standard, suspicious file paths. This behavior is often indicative of adversaries attempting to masquerade malicious executables by renaming them or placing them in paths to mimic legitimate system processes.
MMC Spawning Windows Shell
Cortex XDR
Detects instances where the Microsoft Management Console (mmc.exe) launches suspicious child processes often associated with adversary activity, such as command shells, scripting engines, or system management utilities. This behavior is frequently used to proxy execution or perform unauthorized system modifications, with the exception of the standard Task Scheduler snap-in.
Detects the execution of bindutil.exe with arguments typically used to establish links or silo configurations, excluding known legitimate parent processes associated with container and virtualization services.
Detects the HelloNet campaign's persistence technique in which itcsrvup64.exe (ViPNet Update System, part of ViPNet Client) sideloads a malicious wtsapi32.dll from the ViPNet Update System directory to execute a payload at OS startup.
Detects the execution of the PsExec service component (psexesvc.exe), which is often used for remote command execution and lateral movement. The rule monitors for the process starting, particularly when it originates from legitimate Windows service management processes like services.exe or wininit.exe.
Detects Node.js processes spawning child Node.js processes where the command line references known IPFS gateways, the 'sync.js' script name, or specific Content Identifiers (CIDs) associated with Miasma malware or related decentralized distribution activity.
Detects various stages of the Armored Likho APT campaign using the BusySnake stealer, including lure archive delivery, NSIS droppers, LNK shortcut abuse, PowerShell-based staging, VBScript persistence, scheduled task creation, reverse SSH tunneling, and exfiltration of browser and communication artifacts.
Detects the creation of a new Windows service where the service binPath points to 'anydesk.exe', optionally accompanied by a system reboot command within one hour of the service creation. This behavior is often associated with the installation or persistent configuration of remote access software.
This rule detects command line execution containing environment variable keys associated with the LabubaRAT malware family (e.g., ZM_ORG, ZM_KEY, ZM_SERVER). These variables are used to configure the malware's communication parameters, polling intervals, and C2 server settings during its execution.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects the execution of 'net use' commands targeting administrative shares (C$ or ADMIN$) on Windows systems. This behavior is frequently associated with lateral movement, where an adversary attempts to connect to remote file shares using administrative credentials to move files or execute malicious payloads.
Page 325 of 977