Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects WMI queries targeting Win32_DiskDrive or references to physical drives, a technique used by the GigaWiper malware for disk enumeration prior to destructive actions.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects execution of QuarksDumpLocalHash, a tool used to extract local account password hashes directly from the SAM registry hive. This activity is indicative of credential dumping for offline password cracking.
Detects execution of the GigaWiper destructive backdoor by identifying internal Go function symbols and specific buffer size constants (0xA00000) used during raw disk overwrite operations.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects unauthorized modification of file permissions (using icacls), transfer of ownership (using takeown), or deletion (using del) of critical Windows boot-related files such as ntoskrnl.exe, winload.exe, and bootmgr. This activity is indicative of a potential attempt to destroy system boot stability, inhibit recovery, or prepare a host for secondary stage impacts.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects WMI queries targeting Win32_DiskDrive or references to physical drives, a technique used by the GigaWiper malware for disk enumeration prior to destructive actions.
Detects the execution of the McUploader component associated with the GigaWiper malware, which is used for file staging and exfiltration.
Detects the use of the GigaWiper malware's internal GRATProcessManagerMain module to perform process manipulation operations, such as creating, suspending, resuming, or killing processes, via command-line arguments.
Detects instances of 'RuntimeBroker.exe' executing from a directory other than the standard Windows System32 location, specifically when the command line includes a known cryptocurrency wallet address string. This behavior is indicative of potential masquerading or malicious activity where a legitimate Windows system binary name is abused to execute unauthorized commands or facilitate cryptocurrency-related tasks.
Detects process command lines using curl to query the Azure Instance Metadata Service (IMDS) endpoint (169.254.169.254) for OAuth tokens. This behavior is indicative of an attacker attempting to leverage an Azure Managed Identity associated with a compromised virtual machine to obtain temporary security tokens for unauthorized access to other Azure resources.
This rule detects instances of the 'su' utility being executed in a manner inconsistent with normal system administration patterns. By filtering out common, expected parent processes (such as login shells, terminal multiplexers, or established system services) and identifying 'su' command-line execution or shell commands attempting to invoke it, the rule flags potentially malicious privilege escalation attempts, such as those exploiting local vulnerabilities.
Detects Node.js processes executing with command-line arguments containing potential GitHub personal access tokens (PAT) or secrets while simultaneously initiating a network connection to the GitHub API. This behavior is indicative of potential credential abuse or automated exfiltration of sensitive tokens.
This rule detects discovery of domain controllers in an Active Directory environment. It monitors for the use of 'nltest.exe' with the '/dclist' argument and specific PowerShell cmdlets or methods used to identify domain controllers, such as 'Get-ADDomainController', '[System.Net.Dns]::GetHostEntry', or querying '$env:LOGONSERVER'.
Detects the use of the 'dscl' utility on macOS with the '-authonly' flag. This command is often used by adversaries or for unauthorized scripts to verify credentials against the local directory service without requiring a full login session, which is a common indicator of credential testing or brute-force attempts.
Detects the execution of the 'encrypter-linux-x86' binary on Linux systems, specifically looking for command-line arguments indicative of file encryption activity (-e or --esxi). This binary name is frequently associated with ransomware targeting virtualized environments.
Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) as a child process of the NVIDIA system runtime (nvidia-sysruntime.exe). This pattern is associated with LabubaRAT, where the legitimate NVIDIA process is abused to launch WebView2 for command-and-control (C2) communication and data exfiltration.
Detects the use of GDI functions (GetDC, CreateCompatibleBitmap, BitBlt, GetDIBits) combined with suspicious base64 encoding activity by a process masquerading as an NVIDIA binary (nvidia-sysruntime.exe). This behavior is indicative of screen capture and exfiltration attempts typical of the LabubaRAT implant.
Detects the execution of binaries (exe, dll, msi) or scripts via rundll32/msiexec from the user's Local AppData Temp directory. This behavior is commonly associated with staging and executing secondary payloads by malware such as the Starland RAT, which frequently drops and runs its payloads from these locations to evade detection.
Page 327 of 977