Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,886
5,169
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects unauthorized network connection enumeration using netstat or direct socket connections originating from fltMC.exe, which is indicative of JFMBackdoor activity. The rule monitors for netstat execution by fltMC.exe, netstat spawned from executables within temporary directories, and suspicious outbound network connections originating directly from fltMC.exe.
Detects the JFMBackdoor utility masquerading as fltMC.exe by executing from a non-standard location (typically %TEMP%) and performing timestomping operations via SetFileTime. This technique is used to manipulate MACE timestamps as an anti-forensic measure.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
Detects the execution of Perl-based SOCKS proxy tunneling activity on Linux systems, as observed in Velvet Ant operations. The rule identifies Perl processes that contain socket/fork/daemonization indicators when spawned by web server processes like Nginx, Apache, or common shells used in CGI contexts, suggesting the exploitation of a web application to establish an internal network pivot.
Detects the execution of known AS-REP Roasting tools or commands (such as GetNPUsers) by suspicious processes or from suspicious paths, indicating an attempt to extract Kerberos TGTs for accounts without preauthentication.
Detects the execution of known NTLM relay and credential harvesting tools such as Responder, Inveigh, and PetitPotam, or suspicious command-line patterns involving the use of 'net use' or common Windows binaries (e.g., powershell.exe, rundll32.exe) to access or force SMB authentication with remote IP addresses.
Detects the execution of Python-based SMB server implementations commonly associated with the Impacket toolset. Impacket is frequently used by attackers to facilitate lateral movement, credential relay, and remote file manipulation.
Detects user-space processes masquerading as critical Linux kernel threads (kworker, kthreadd, ksoftirqd). The rule identifies potential impersonation by monitoring for suspicious parent processes (e.g., shells, interpreters), anomalous parent PIDs (not 1 or 2), or unexpected network socket activity generated by these kernel-named processes.
Detects the creation of files by WScript.exe or CScript.exe in temporary or program directories followed by the subsequent execution of those files by the same scripting host within a 120-second window. The rule specifically looks for evidence of script-based decoding or processing (e.g., via certutil or hidden windows), which is often associated with the multi-stage execution of payloads.
Detects long-running WScript or CScript processes executing script files (ending in .js or .jse) that perform environment enumeration via WMI queries (e.g., Win32_ComputerSystem, Win32_BIOS, Win32_VideoController). This behavior is often indicative of automated sandbox evasion and reconnaissance performed by malicious scripts or droppers.
Detects the execution of PowerShell or pwsh processes launched by wscript or cscript, using hidden window flags and certutil -decode arguments, specifically targeting scripts located in the ProgramData directory. This pattern is frequently observed in malicious file stagers and payload deobfuscation.
Detects the use of the Windows registry utility 'reg.exe' to query sensitive registry keys (SYSTEM, SOFTWARE, RUN keys) when executed by suspicious parent processes commonly used for script execution or living-off-the-land techniques (wscript.exe, cscript.exe, fltMC.exe, mshta.exe). This pattern is often indicative of automated discovery or credential harvesting behaviors.
Detects the creation of a Windows service using the 'sc.exe' utility where the service executable is located in a potentially untrusted directory such as Temp, AppData, ProgramData, Users\Public, or Downloads. This behavior is frequently used by adversaries to establish persistence or execute malicious code with elevated privileges.
This rule detects the execution of common Python-based network relay and exploitation tools such as Impacket's ntlmrelayx, smbserver.py, and PetitPotam. These tools are frequently utilized by adversaries to conduct NTLM relay attacks, perform remote service execution, or facilitate credential dumping.
This rule detects potentially suspicious process activity where unknown or infrequently seen processes spawn common script interpreters such as cmd.exe, powershell.exe, wscript.exe, or others. This behavior often indicates an attempt to execute malicious commands or scripts as part of a post-exploitation or persistence mechanism.
Detects instances where Windows Nearby Sharing related processes (quick_share.exe, NearbyShare.exe, nearby_sharing.exe) spawn command-line interpreters (cmd.exe, powershell.exe). This pattern is anomalous as these utilities are intended for file transfer, not command execution, and could indicate exploitation of these applications to achieve code execution.
Detects potential token manipulation attacks using SMB loopback connections. The rule identifies processes executing with privileges commonly associated with token impersonation (SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege) or running as SYSTEM that are not expected system processes, correlated with an SMB network connection to the local loopback address on port 445.
Detects command-line activity indicative of the PetitPotam exploit or general EFSRPC (Encrypting File System Remote Protocol) coercion attempts. Adversaries use these techniques to force a machine to authenticate against another system (e.g., a domain controller), typically as a precursor to NTLM relay attacks.
Detects the spawning of administrative command-line utilities (cmd.exe, powershell.exe, wscript.exe, certutil.exe, mshta.exe) from processes related to Wyse Management Suite (WMS), Tomcat, or Java. This pattern is often indicative of exploitation of web applications or management services to gain command-line access on the underlying system.
Detects the abuse of MSBuild.exe to execute arbitrary code. The rule monitors for three primary suspicious behaviors: MSBuild spawning suspicious child processes indicative of inline task execution, MSBuild being launched with project file arguments from non-standard or untrusted parents, and MSBuild being launched without a project file (implying piped or inline payload delivery).
Detects instances of rundll32.exe being used to load DLL, OCX, or CPL files from suspicious locations such as user-writable directories (Temp, AppData, Downloads, etc.) or UNC paths. This behavior is indicative of an adversary attempting to execute malicious code using a trusted Windows system binary (LOLBin).
Page 413 of 976