Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects execution of the GigaWiper 'WipeCMain' functionality, characterized by specific command line indicators associated with a multi-pass disk wiping process. This behavior is indicative of destructive wiper malware attempting to render data on system drives irrecoverable.
Detects execution of security utility commands on macOS intended to unlock a login keychain by providing a password via command line arguments. This behavior is indicative of an attempt to programmatically access stored credentials, which may be a precursor to credential theft.
Detects the execution of unusual or unauthorized processes spawned during an 'npm install' operation, specifically those occurring within a 'node_modules' folder context. This behavior is indicative of potential supply chain attacks where a malicious package executes unauthorized code during installation.
Detects the creation of a Windows Shortcut (.lnk) file in the Startup folder using WScript.Shell, often used by the Starland RAT or similar malware to establish persistence. The rule monitors command lines for the combination of WScript.Shell invocation, the CreateShortcut method, and targeting of pythonw.exe or LICENSE.txt files.
Detects instances where runas.exe is used to launch PowerShell and monitors subsequent child processes for suspicious commands or activity, such as credential dumping tools, encoded commands, or access to sensitive browser data locations, which may indicate credential theft or unauthorized lateral movement.
Detects anomalous activity where a single process or actor attempts to stop or reconfigure a large number of system services, specifically targeting backup, database, security, and administrative services. This behavior is highly indicative of ransomware or destructive malware activity attempting to disable defenses and data recovery capabilities.
Detects the execution of the Mimikatz credential dumping tool, either as the initiating process or the action process, indicating potential credential theft attempts.
Detects the download and execution of the malicious v7.msi installer from the domain camorreado.click. This file acts as a loader for the EtherRAT Node.js RAT, often delivered in the context of fake IT support phishing campaigns. The rule monitors both network connection events to the malicious domain and process creation events involving msiexec.exe execution of the specific MSI payload.
Detects instances where a process named 'symantec.exe' is executed from a path other than the standard Symantec installation directories. This behavior is indicative of an attempt to disguise a malicious executable as a legitimate Symantec software component.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects command-line execution patterns associated with the Starland RAT, specifically focusing on systematic Active Directory and domain environment reconnaissance. The rule triggers on the use of built-in Windows utilities such as WMI queries for system details, command-line enumeration of users and domain controllers (e.g., net user /domain, nltest /dclist), and detailed identity information gathering (e.g., whoami /all).
Detects command-line execution patterns associated with the Starland RAT, specifically focusing on systematic Active Directory and domain environment reconnaissance. The rule triggers on the use of built-in Windows utilities such as WMI queries for system details, command-line enumeration of users and domain controllers (e.g., net user /domain, nltest /dclist), and detailed identity information gathering (e.g., whoami /all).
Detects the creation or registration of scheduled tasks involving the suspicious artifact 'SolidPDFPcl2Bmp'. This monitoring covers process executions using schtasks.exe or reg.exe, registry modifications to the Windows Task Scheduler cache, and file drops within the Windows System32 Tasks directory, which are common indicators of persistence establishment via scheduled tasks.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
Detects the installation or network activity associated with the malicious npm packages 'nodemon-sudo' (v3.1.16) and 'tslint-conf' (v7.2.1). These packages use typosquatting or brand impersonation (targeting 'nodemon' and 'pino') by leveraging forged maintainer and author metadata to trick developers into installing them.
Detects the execution of JScript files via wscript.exe where the file name follows the 'wupd_' naming convention. This pattern is characteristic of LabubaRAT, which drops obfuscated or malicious scripts with this prefix to execute them using the Windows Script Host.
Detects the execution of PowerShell with bypass execution policy flags originating from the nvidia-sysruntime.exe process. This behavior is associated with the LabubaRAT malware, which leverages this specific parent process to execute malicious PowerShell commands while evading policy restrictions.
Detects instances where the command shell 'cmd.exe' is launched as a child process of 'nvidia-sysruntime.exe'. This behavior is anomalous as 'nvidia-sysruntime.exe' typically does not spawn command interpreters, suggesting potential masquerading or process hollowing where an attacker is using a disguised malicious binary to execute shell commands.
This rule detects command line execution containing environment variable keys associated with the LabubaRAT malware family (e.g., ZM_ORG, ZM_KEY, ZM_SERVER). These variables are used to configure the malware's communication parameters, polling intervals, and C2 server settings during its execution.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Page 332 of 977