Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the Cursor IDE (Cursor.exe) executing a process named git.exe from a file path outside of the standard Git installation directory (typically under Program Files). This behavior is indicative of an attacker placing a malicious git.exe binary within a repository directory to facilitate automatic execution and potential command execution when the folder is opened within the IDE, bypassing standard security trust prompts.
Detects the creation of Windows Scheduled Tasks that follow the 'PythonLauncher-' naming convention, often associated with Starland RAT, using PowerShell commands such as Register-ScheduledTask. The rule monitors for persistence mechanisms configured to run at logon or with highest privileges.
Detects the creation of scheduled tasks using specific, suspicious task names associated with the CURP threat campaign. This rule monitors for 'schtasks.exe' command line executions involving the creation of tasks with names 'brokerhost' or 'net_queue_32', which are identified as indicators of persistent threat activity.
Detects process creation consistent with CVE-2025-33053 exploitation, where a crafted Internet Shortcut (.url) file sets its target to iediagcmd.exe with a WorkingDirectory pointing to a WebDAV DavWWWRoot UNC path, causing iediagcmd.exe to resolve and launch LOLBins (route.exe, ipconfig.exe, netsh.exe, ping.exe) from the attacker-controlled WebDAV share instead of the legitimate System32 directory.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
Detects the execution of a process named 'Fo-Binary.exe', which is commonly associated with loader activity. This rule monitors process creation events to identify the initialization of this specific binary.
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Detects the execution of a process named 'Fo-Binary.exe', which is commonly associated with loader activity. This rule monitors process creation events to identify the initialization of this specific binary.
Detects crontab modifications referencing hw_probe.pyc, the cron-based persistence mechanism used by the mrmustard stealer.
Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.
Detects the specific msaRAT-associated MSI custom action chain where the Bin_lib_EA2AEBC3 embedded binary is extracted and loaded as lib.dll by msiexec.exe, invoked by the CA_Run_EA2AEBC3 custom action calling the DLL's RUN export. Scoped to this named-identifier pattern rather than any generic msiexec-loads-embedded-DLL behavior to reduce false positives from legitimate MSI packages that use custom action DLLs.
Detects the execution of command lines associated with the GigaWiper 'GRATServiceManager' module. This module is used by the GigaWiper destructive backdoor to manage services, likely for persistence or malicious service manipulation.
Detects the use of the GigaWiper malware's internal GRATProcessManagerMain module to perform process manipulation operations, such as creating, suspending, resuming, or killing processes, via command-line arguments.
Detects the use of the GigaWiper malware's internal GRATProcessManagerMain module to perform process manipulation operations, such as creating, suspending, resuming, or killing processes, via command-line arguments.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Detects execution of PowerShell commands that query the Windows SecurityCenter2 WMI namespace for installed AntiVirus products and format the output as JSON. This behavior is indicative of reconnaissance activity by the GigaWiper malware to identify and potentially disable or circumvent security protections.
Hunting rule loosely modeled after Atomic Red Team T1112 test "Disable Windows Task Manager application". No public in-the-wild intel reference available; correlate before alerting.
Detects abuse of comsvcs.dll MiniDump export to dump LSASS or other process memory
for credential access.
for credential access.
Detects credential dumping of the TermService svchost process that can retain plaintext
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects WMI queries targeting Win32_DiskDrive or references to physical drives, a technique used by the GigaWiper malware for disk enumeration prior to destructive actions.
Page 326 of 977