Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,499 detections
Filters
Last updated
All Time
Detection languages
8,114
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,499
11,881
5,887
5,179
4,868
Platforms
18,094
3,056
1,506
124
104
Products / Services
5,726
4,303
3,716
1,175
958
MITRE Techniques
9,492
7,575
3,460
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule monitors process execution events for the presence of known penetration testing and post-exploitation tools, specifically NetExec (formerly CrackMapExec), nxc, or cme. These tools are frequently used by adversaries for network discovery, lateral movement, and credential harvesting within Active Directory environments.
Detects suspicious use of QEMU virtualization software within an environment, specifically when associated with ConnectWise ScreenConnect. This includes the creation of custom QEMU image files within the ScreenConnect Files directory, the execution of the QEMU binary using those images, the extraction of QEMU archives using 7-Zip, or instances where ScreenConnect processes spawn the QEMU binary directly. This pattern is indicative of unauthorized use of virtual machines to facilitate persistence, lateral movement, or tool staging.
Detects the creation or modification of Windows kernel-mode services using the sc.exe utility when the process is not initiated by the legitimate service control manager (services.exe). This behavior is often associated with the loading of malicious drivers or rootkits, which may attempt to bypass standard service management processes to maintain persistence or elevate privileges.
Detects modifications to Windows boot configuration or registry settings to enable 'testsigning' mode. Enabling testsigning allows for the loading of unsigned drivers or software into the kernel, which is a common technique used by attackers to bypass driver signature enforcement for rootkit or malicious driver deployment.
Detects the execution of wmic.exe with arguments typical for remote process creation, such as using the /node switch to execute commands on remote systems. This behavior is commonly associated with lateral movement or remote administration.
Detects the use of legitimate SSH clients (ssh.exe, plink.exe) to initiate outbound network connections to internal IP ranges on port 22. This activity is consistent with Obsidian Sandstorm lateral movement tactics, where compromised credentials are used to establish SSH tunnels for internal network pivoting.
This rule detects the execution of rclone.exe with command-line arguments indicative of data exfiltration to cloud storage providers (mega.nz, Dropbox, OneDrive) or via SFTP. This behavior is commonly associated with ransomware threat actors, such as those observed in the STAC4713 and STAC3725 campaigns (GOLD ENCOUNTER), who utilize rclone to stage and exfiltrate sensitive data prior to deploying ransomware.
Detects the creation of scheduled tasks that involve QEMU virtualization binaries or virtual disk images. This activity is associated with the GOLD ENCOUNTER threat group and campaigns STAC4713/STAC3725, which utilize QEMU to facilitate persistence and infrastructure defense evasion by maintaining virtualized environments across system reboots.
Detects the BQTLock ransomware distribution chain, where a PyInstaller-packaged loader executable (start.exe) is used to unpack and spawn the primary BQT.exe ransomware payload. The detection monitors for process creation events where start.exe exhibits typical PyInstaller command-line artifacts (e.g., _MEIPASS) and initiates BQT.exe, which is associated with malicious activities including UAC bypass and file encryption.
Detects the UAC bypass technique employed by the BQTLock ransomware, where the registry key 'HKCU\Software\Classes\mscfile\shell\open\command' is hijacked to execute arbitrary binaries such as BQT.exe or malicious scripts via eventvwr.exe, effectively elevating privileges.
Detects the BQTLock (BaqiyatLock) ransomware executing various system and network discovery commands such as systeminfo, ipconfig, and whoami from its main process (BQT.exe). These actions are indicative of pre-encryption reconnaissance used to profile the host environment before malicious file encryption commences.
This rule detects common activity patterns associated with the Havoc C2 framework and general malicious PowerShell usage. It monitors for three primary indicators: VBScript stagers spawning PowerShell processes (e.g., in a Havoc-like delivery chain), PowerShell processes initiating DNS queries to DuckDNS infrastructure, and PowerShell processes performing cross-process memory injection indicative of shellcode execution (e.g., Demon in-memory agent).
Detects the unauthorized installation and service configuration of OpenSSH Server on Windows workstations. This technique is used to establish persistent, redundant backdoor access, as observed in Operation Poisson, where adversaries deploy it to maintain access alongside other tools like Tailscale.
Detects instances of the systemd-userdbd process executing from non-standard file paths or general systemd-related processes launching from world-writable or temporary directories (e.g., /tmp, /dev/shm, /var/tmp, /home). This behavior is often indicative of process masquerading or a persistence mechanism where an adversary attempts to execute a malicious binary by mimicking system service naming conventions.
This rule detects various techniques used by an adversary to clear, truncate, or delete system and audit logs to hide their activity. It monitors for commands targeting Windows Event Logs (wevtutil, Clear-EventLog), Linux system logs (/var/log/ via rm/shred), and journalctl vacuuming, as well as the deletion of .evtx files. It further enriches these detections by identifying if the process was spawned by suspicious parent processes often associated with remote access, lateral movement, or command-and-control activity.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects the execution of known remote access or remote support tools (AnyDesk, ScreenConnect, QuickAssist, or Atera) when the parent process is Microsoft Teams. This behavior may indicate an attempt by an adversary to leverage legitimate remote access software for unauthorized access, potentially following an initial compromise via social engineering or spear-phishing over Teams.
Detects common Windows User Account Control (UAC) bypass techniques involving the execution of auto-elevating binaries, the use of PowerShell to launch processes with explicit 'RunAs' verbs, and unauthorized modifications to registry keys within HKCU\Software\Classes.
Detects the execution of 'conhost.exe' with the '--headless' argument, specifically when initiated by 'pcalua.exe'. This combination has been observed in attacks by the GOLD BLADE threat group for indirect command execution.
Detects the execution of Microsoft Edge via the command shell to open a PDF file. This pattern can be indicative of malicious activity where an attacker attempts to bypass direct execution or leverage a browser vulnerability to open a malicious PDF.
Detects the creation of scheduled tasks that use `schtasks.exe` to execute `rundll32.exe`. This is a common technique used by attackers for persistence and to execute malicious DLLs, often to bypass application whitelisting or other security controls.
Page 365 of 977