Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of nvidia-sysruntime.exe, a process name used by LabubaRAT for host reconnaissance. The detection relies on identifying this specific filename, which in the context of the malware is often unsigned or associated with malicious activity as opposed to legitimate NVIDIA Container Toolkit components.
Detects the execution of nvidia-sysruntime.exe, a process name used by LabubaRAT for host reconnaissance. The detection relies on identifying this specific filename, which in the context of the malware is often unsigned or associated with malicious activity as opposed to legitimate NVIDIA Container Toolkit components.
Detects the use of the Windows 'attrib.exe' utility to hide a file named 'svehost.exe' within the 'AppData\Windows' directory. This behavior is indicative of an adversary attempting to conceal malicious artifacts or persistence mechanisms from the user and basic system exploration tools.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects the execution of the xattr command with the '-cr' flags on macOS. This combination is commonly used to recursively remove the com.apple.quarantine extended attribute from files and directories, which effectively bypasses macOS Gatekeeper security checks for downloaded applications or files.
Detects repeated execution of 'defaults read' or 'du -sh' commands within a one-hour window. These commands are commonly used for system information and file directory discovery, which may indicate reconnaissance activity by an attacker.
Detects Docker CLI execution attempting to bind mount sensitive host system directories (e.g., Windows, ProgramData) into a container. This technique is often used as a container escape vector to gain unauthorized access to host files and escalate privileges to SYSTEM.
Detects the creation of a crontab entry configured to execute a Python one-liner that performs a network connection to a specific remote IP address on port 4444. This behavior is indicative of a persistence mechanism and a C2 (Command and Control) beaconing attempt.
Detects potential discovery of sensitive information (secrets) within container images by monitoring for the usage of 'dive' targeting private Azure Container Registry images or the use of 'docker inspect' to extract 'Config.Env' combined with 'grep' for the term 'secret'. This activity is often associated with reconnaissance for credential harvesting in containerized environments.
Detects the manual execution of an Azure Container Registry (ACR) task using the 'az acr task run' command. This could indicate an adversary attempting to leverage ACR build capabilities to execute malicious build steps, pull images, or perform unauthorized automation tasks within the container registry environment.
Detects the use of 'docker login' commands targeting an Azure Container Registry (.azurecr.io) that include a password passed as a plaintext argument via the '-p' or '--password' flags. This practice exposes credentials in process command-line arguments, which may be visible to other users on the system or logged by security tools.
This rule detects the LabubaRAT malware utilizing the 'nvidia-sysruntime.exe' process to spawn 'cmd.exe' or 'powershell.exe' for command-and-control tasking. It monitors process creation events to identify suspicious parent-child relationships where the NVIDIA system runtime binary is used to invoke command shells with specific command-line arguments, typical of RAT shell tasking behaviors.
Detects the creation or modification of persistence mechanisms (Windows Registry Run/RunOnce keys, Cron jobs, Systemd services, and macOS LaunchAgents/LaunchDaemons) that specifically reference Java executables or .jar files. This pattern is consistent with cross-platform malware such as QuimaRAT attempting to maintain persistence.
Detects the use of 'regedit.exe' with the '/s' flag to perform a silent import of a registry file. This behavior is often used by adversaries to modify system configurations, establish persistence, or perform other registry-based attacks without user interaction. This specific rule includes a check for a hardcoded path 'C:\Windows\System32\hello.reg', suggesting targeted activity.
Detects the execution of the Windows shutdown utility with arguments to force an immediate system reboot. This behavior is commonly observed during the final stages of ransomware attacks, such as NoEscape, to force the system into a state where encrypted files are finalized or to disrupt user access.
Detects the use of WMIC to rename a local administrator account to 'NO ESCAPE'. This behavior is associated with the NoEscape ransomware, which renames the built-in administrator account to 'NO ESCAPE' as part of its post-compromise activity.
Detects instances where PowerShell is executed with common bypass flags by a process masquerading as or spawned by 'svchost.exe' located in non-standard system directories, specifically targeting executions originating from user-writable temporary locations.
This rule detects the execution of 'node.exe' or 'node' processes that involve specific JavaScript files ('dist/setup.js' or 'dist/intro.js') within the command line arguments or file paths. Such patterns are indicative of potential malicious activity, often associated with the deployment of unauthorized scripts or secondary payloads in a node.js environment.
Detects the execution chain associated with the CrySome RAT, which terminates common web browsers (Chrome, Edge, Brave), drops a malicious DLL ('abe_decrypt.dll') into a temporary directory, and subsequently restarts the browser to facilitate credential theft.
Detects node.exe processes fetching remote content from specific IPFS dead-drop domains where the executing process does not write a corresponding script file to disk. This behavior is indicative of a fileless execution pattern where a 'caller.js' script fetches a payload and executes it directly in memory using the JavaScript Function constructor, bypassing traditional on-disk detection mechanisms.
Detects ClickFix-style social engineering attacks where users are coerced into pasting and executing malicious commands (PowerShell/mshta) via the Windows Run dialog (explorer.exe), or instances where PowerShell processes spawned from the Run dialog perform network communication over suspicious ports commonly associated with this campaign.
Page 333 of 977