Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of PowerShell (powershell.exe) spawned by the Windows Command Shell (cmd.exe) where the command originated from user-writable directories such as Downloads, Temp, or AppData\Local\Temp. This pattern is commonly associated with the execution of downloaded payloads or malicious scripts.
Detects the use of the 'reg.exe' utility to export or save sensitive Windows Registry hives (SAM, SECURITY, SYSTEM) within a short timeframe on a single host. This pattern of credential dumping from the Registry is characteristic of INCRansom activity and other credential harvesting techniques.
This rule detects the dumping of sensitive Windows Registry hives (SECURITY, SAM, and SYSTEM) using tools like reg.exe, esentutl.exe, regedit.exe, or by leveraging Volume Shadow Copy services (vssadmin/diskshadow). These hives are targeted by attackers for credential access, specifically to extract LSA secrets, local account hashes, and bootkeys required to decrypt credentials offline. The rule calculates a risk score based on the combination of hives dumped, the method used, the output destination, and the parent process context, flagging 'complete' dumps (SAM+SECURITY+SYSTEM) as critical.
Detects attempts to tamper with Windows security services and configurations. The rule identifies PowerShell commands used to add Windows Defender exclusions or disable real-time protection, as well as command-line utilities like sc.exe and net.exe used to stop security, antivirus, or EDR services. This behavior is indicative of defense evasion.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to query system manufacturer or model information. This behavior is commonly employed by malware as an anti-virtualization or anti-sandbox technique to identify if it is running in a virtual machine environment by checking for known hypervisor-related strings in hardware identifiers.
Detects modifications to the Windows Registry where the 'EnableLUA' value is set to 0, which effectively disables User Account Control (UAC). This action is often performed by attackers to evade security prompts and maintain higher integrity levels during execution.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. UNC6692 ("Snow Flurries") impersonates IT helpdesk over Teams, lures victims to a fake "Mailbox Repair Utility" page, and delivers a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects instances where a Unix shell (sh, bash, dash, ash) is spawned by or initiated from the 'ff-agent' process. This pattern often indicates malicious script execution or administrative activity associated with the agent's environment, potentially signaling post-exploitation activity or unauthorized command execution.
This rule detects the silent installation of AnyDesk with persistence enabled via the '--start-with-win' flag. This behavior is indicative of unauthorized remote access tool deployment, often used for establishing persistent command and control.
Detects pythonw.exe or python.exe process execution running under the WDAGUtilityAccount user context, which Starland RAT checks against its hardcoded sandbox-account blacklist before continuing execution. Observing this account name paired with the Python runtime used by the RAT's loader chain is a strong indicator of the malware executing (or attempting to execute) inside a sandboxed analysis environment.
Detects Python scripts initiating standard Linux system discovery commands such as id, uname, hostname, ifconfig, ip, or ps. This pattern is commonly used by adversaries for post-exploitation reconnaissance to profile the host environment.
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Detects the execution of rundll32.exe with specific suspicious DLLs (drx_curator.dll, etwhost.dll) and specific function names or paths. This pattern is indicative of potential malicious activity where legitimate binaries are leveraged to execute code, often associated with modular loaders or malicious payloads.
Detects the execution of PowerShell with the '-enc' parameter, indicating base64 encoded input, coupled with either hidden window execution flags or known network download cmdlets. This pattern is commonly used by adversaries to execute obfuscated, second-stage malicious payloads while minimizing visibility on the endpoint. Legitimate administrative activities (e.g., those performed by SCCM or MSIExec) are excluded to reduce false positives.
Detects instances where a Java process (java.exe/java) spawns common network utilities such as FTP, SFTP, or Netcat. This activity is often associated with exploitation of Java-based applications, potentially indicating post-exploitation behavior such as data exfiltration or manual command and control communication.
Detects instances where a process named 'svchost.exe' is executed from common temporary file paths, which is characteristic of malware attempting to masquerade as the legitimate Windows Service Host process.
Detects attempts to inhibit system recovery by deleting Volume Shadow Copies using native Windows utilities (vssadmin, wmic, diskshadow) or modifying boot configuration to disable recovery settings (bcdedit), as well as unauthorized modifications to the FilesNotToSnapshot registry key.
This rule detects potential automated data exfiltration or staging behavior by identifying the concurrent execution of email-related processes and vector database memory modification commands (insert/upsert) within a 5-minute window on the same host. This combination may indicate an attacker extracting data from email systems and injecting it into a local vector memory store, likely for subsequent LLM-based analysis or exfiltration.
Correlates multiple suspicious behavioral patterns characteristic of the 'ClickFix' attack chain. The rule detects techniques such as PowerShell execution via RunMRU or Windows Terminal, CAPTCHA-lure download cradles, hidden-window PowerShell execution, fileless AES/TripleDES runspace payloads, COM hijacking, and suspicious LOLBin usage. The detection logic uses a 1-hour sliding window to aggregate these patterns on a per-device basis, assigning a higher confidence score as more stages of the attack chain are observed.
Detects the use of PowerShell to execute WMI queries against the Win32_ComputerSystem class to identify domain membership information. This is a common discovery technique used by attackers to profile the environment and understand network context.
Page 334 of 977