Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the remote execution of credential dumping activities via the lsassy tool. The rule identifies rundll32.exe being used to load comsvcs.dll for the purpose of creating a full MiniDump of the LSASS process memory. It specifically monitors for these actions occurring within common remote administrative execution contexts, such as SMB services, WMI, scheduled tasks, and DCOM, with output files staged in the Windows\Temp directory.
This rule detects potentially malicious activity related to the cron utility, including the modification of cron-related configuration files and the execution of specific suspicious payloads (e.g., ssync.sh, blacklist). It monitors for file creation, modification, or renaming events within sensitive directories, as well as the spawning of processes by cron daemons using identified suspicious paths or command names.
Detects anomalous process execution patterns indicative of privilege escalation or persistence on Linux systems. Specifically monitors for unexpected root shell access from non-privileged service accounts (e.g., www-data, apache), abuse of sudo for modifying privileged system files via tee, and execution of binaries from world-writable directories such as /tmp or /dev/shm, which is a common behavior during exploit staging.
Detects instances where the Microsoft Defender service (MsMpEng.exe) spawns common system utilities like cmd.exe, powershell.exe, or wscript.exe running with SYSTEM integrity. This is highly anomalous as Defender should generally not be the parent process for these interactive or script execution shells.
Detects the execution of potential stealer malware (such as Yuta or Glove Stealer) packaged as a PyInstaller executable. The detection monitors for the characteristic behavior where the application unpacks its runtime environment into a _MEI* temporary directory and subsequently spawns child processes from that path, or utilizes specific naming conventions like 'winupdate.exe' within temporary or cache directories, common techniques for staging malicious payloads.
Detects Yuta/Glove Stealer malware attempting to establish persistent WMI event subscriptions for keylogging. This is identified by the execution of wmic.exe or PowerShell to register event filters, consumers, or bindings, initiated by suspicious parent processes such as winupdate.exe or processes originating from temporary/staging directories.
Detects the Yuta .NET WPF dropper (SLaunch.exe) writing a PyInstaller-compiled payload (winupdate.exe) to the AppData Roaming .cache directory, followed by the immediate execution of the staged payload from that same location.
Detects the use of legitimate Windows administrative tools and scripts to disable or delete system recovery features, such as Volume Shadow Copies, backup catalogs, or boot recovery options. This behavior is a common indicator of ransomware or destructive malware attempting to prevent system restoration.
This rule detects the use of common Windows utilities and PowerShell commands for process discovery, such as tasklist.exe, wmic.exe, and Get-Process. It also flags execution of command lines containing references to known antivirus, EDR, or security agent process names, which is a common indicator of an adversary attempting to identify or disable security tools.
Detects the execution of known script host binaries (mshta.exe, wscript.exe, cscript.exe) from suspicious user-writable directories (Downloads, Temp, AppData, Desktop). The detection specifically looks for these binaries when spawned by common applications like archive utilities (7-zip, WinRAR, WinZip) or shell interfaces (explorer.exe, cmd.exe, powershell.exe), which is a common pattern for the execution of downloaded or extracted malicious payloads.
Detects the Payouts King malware creating, running, or deleting specific scheduled tasks named \Mozilla\UpdateTask or \Mozilla\ElevateTask, as well as indirect execution of these tasks via cmd.exe redirection.
Detects persistence mechanisms associated with Obsidian Sandstorm activity, including scheduled task creation, registry run key modification, and startup folder file drops initiated by suspicious processes or from non-standard directories like AppData/Temp.
Detects execution of Windows remote assistance tools like Quick Assist, msrdcw, or msra when spawned by unexpected parent processes, or when spawned by Microsoft Teams. This behavior may indicate an adversary abusing legitimate remote access software to maintain persistence, conduct lateral movement, or gain interactive access to a compromised system.
This rule detects post-click execution chains typical of RomulusLoader delivery, specifically identifying when browser or archive applications launch unsigned processes from user-writable directories (e.g., Downloads, Temp), or when a suspicious vulkan-1.dll module is sideloaded from these same directories.
Detects credential harvesting behavior associated with the BQTLock (BaqiyatLock) malware, including the staging of password files in temporary directories, unauthorized access to browser credential stores (e.g., Login Data, key4.db), and the use of system utilities like vaultcmd.exe to interact with the Windows Credential Manager. It also monitors the execution of PyInstaller-packed loaders (BQT.exe or start.exe) from temporary directories.
Detects multiple methods commonly used for defense evasion and credential theft on Windows systems, including: enabling WDigest credential caching via Registry modification, execution of forensic tools (FTK Imager) sometimes repurposed for security tool tampering, disabling Microsoft Defender real-time monitoring or removing exclusions via PowerShell/CMD, and loading known vulnerable kernel drivers associated with BYOVD (Bring Your Own Vulnerable Driver) attacks.
Detects network activity initiated by qemu-system-x86_64.exe to internal subnets using common lateral movement ports (21, 88, 389, 445, 636) or the execution of known tools netbird.exe or cookie_exporter.exe. This rule flags potential virtualization-based lateral movement or unauthorized tool usage.
Detects suspicious modifications to .github/workflows YAML files, unauthorized git commits with backdated timestamps, usage of noreply.github.com bot author names, and git push commands initiated by node.exe. This activity is indicative of the IronWorm malware attempting to manipulate CI/CD pipelines and exfiltrate secrets.
Detects behavior associated with the IronWorm threat, including Tor-based command and control communication by unsigned binaries or Node.js processes, unauthorized DNS resolution of .onion domains, automated npm package management operations by Node.js, and git configuration modifications attempting to impersonate common developer automation identities.
This rule detects instances where npm or node.js processes are used to execute or spawn setup-related binaries or specific GitHub precheck scripts. This behavior is often associated with software deployment, CI/CD pipelines, or potentially malicious automation within development environments.
Detects network connection activity originating from QEMU virtualization processes (qemu-system-x86_64, qemu-system-i386, qemu-system-aarch64) to external (non-private/non-local) IP ranges. This could indicate the use of virtualization tools to facilitate tunneling, proxying, or lateral movement within an environment.
Page 407 of 976