Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects the creation of scheduled tasks using PowerShell commands that incorporate execution policy bypass and hidden window styling. This pattern is commonly observed in malware loaders and persistence mechanisms to minimize visual indicators during execution.
Detects potential disk wiping activity by identifying the enumeration of physical disk drives via WMI queries combined with command-line arguments indicative of destructive wiping tools, such as functions related to unallocating drives or writing random data.
Detects the execution of XMRig cryptocurrency miner or network connections to known mining pool endpoints associated with XMRig, masquerading as or originating from the legitimate Windows process 'fontdrvhost.exe'. This behavior indicates potential resource hijacking.
Detects the execution of the MinIO Client (mc.exe) on Windows with command-line arguments indicating the interaction with external or arbitrary bucket and endpoint locations. This behavior is indicative of an attacker staging or exfiltrating data to an external S3-compatible cloud storage provider.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
Detects the execution of PowerShell commands containing a specific obfuscated output marker pattern ('|?????|$pwd') associated with the GigaWiper backdoor.
This rule detects the presence of a specific file named 'g11.sys' being loaded or accessed on a system, followed by the execution of 'sc.exe' to register or create a system service involving the same driver file. This pattern is commonly associated with the installation of kernel-mode drivers, which could be part of a rootkit deployment or a 'Bring Your Own Vulnerable Driver' (BYOVD) attack.
Detects anomalous use of WebView2 browser control functionality, specifically focusing on JavaScript 'fetch' requests, 'eval' executions, and 'postMessage' communication patterns that may indicate covert Command and Control (C2) relaying or malicious browser-based exfiltration within a Windows process.
This rule detects the execution of processes containing environment variables prefixed with 'ZM_' (e.g., ZM_SERVER, ZM_ORG, ZM_KEY, ZM_GROUP, ZM_DEVICE_NAME). These specific environment variables are characteristic of the LabubaRAT malware family, which utilizes them for C2 configuration and device identification during process startup.
Detects the execution of specific command-line arguments 'purge_cmd_queue' or 'purge_queue' associated with the GigaWiper malware. This behavior is indicative of a destructive backdoor performing command queue management to disrupt system operations or clear malicious indicators.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
This rule detects execution of specific functions or command-line arguments derived from the GigaWiper / FlockWiper malware family. These functions are associated with destructive activities such as file discovery, sorting, reading, and secure encryption or deletion of files, indicative of a wiper-style attack.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects potential User Account Control (UAC) bypass attempts using the PowerShell 'Start-Process' cmdlet with the 'runAs' verb, which requests administrative privileges for a new process. The rule also includes a specific check for command-line artifacts associated with the 'wipe32' malware campaign, which utilizes this method for privilege escalation.
Detects the execution of GigaWiper malware registry modules. The rule monitors command-line activity for specific binary names associated with the GigaWiper malware family that perform registry modifications, such as key creation or deletion.
Detects the execution of command lines associated with the GigaWiper 'GRATServiceManager' module. This module is used by the GigaWiper destructive backdoor to manage services, likely for persistence or malicious service manipulation.
Detects the execution of a potential file encryption utility that uses command-line flags ('enc'/'dec', '-k'/'-i'/'--keyfile') in conjunction with a 'key.txt' file. This pattern is characteristic of custom encryption tools used by threat actors to encrypt files on a system.
Page 331 of 977