Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects anomalous activity originating from AutoGen Studio AI agents, specifically identifying attempts to abuse loopback trust boundaries via MCP (Model Context Protocol) WebSocket requests to localhost (ports 8080/8081) or the execution of suspicious child processes commonly used for command-line interference, indicative of AI agent compromise or attacker-controlled MCP command injection.
Detects instances where the Exchange Server IIS worker process (w3wp.exe) spawns unexpected child processes like PowerShell, pwsh, or cmd, often indicating exploitation of vulnerabilities such as ProxyNotShell (CVE-2022-41040 and CVE-2022-41082) where an attacker leverages Exchange backend processes for arbitrary command execution.
This rule monitors for the execution of native Windows utilities (vssadmin.exe, ntdsutil.exe, diskshadow.exe, esentutl.exe) commonly abused by attackers to create volume shadow copies or access the NTDS.dit file for credential dumping or system recovery inhibition.
Detects the execution of PowerShell from explorer.exe (the Windows Shell) involving commands that access the clipboard, which is a common indicator of the ClickFix social engineering attack technique. In this scenario, users are deceived into copying and pasting malicious commands into the Run dialog.
Detects the creation of scheduled tasks using schtasks.exe that exhibit indicators associated with StrikeShark SharkLoader or Cobalt Strike persistence. Indicators include task actions that reference rundll32 with a DLL, execution from user-writable directories (AppData, ProgramData, Temp), the use of base64-encoded command lines, or specific task names mimicking OneDrive updates.
This rule detects the use of standard Windows administrative utilities (vssadmin, wmic, bcdedit) to delete volume shadow copies or modify boot configuration settings to disable recovery features. This behavior is a common indicator of ransomware or destructive malware activity attempting to prevent system restoration after data encryption or destruction.
Detects the execution of 'net.exe' or 'net1.exe' to create a new user account with a prefix indicative of potential persistence or backdooring (rage_master_). The rule further filters for executions originating from suspicious directories such as \Temp\, \Users\Public\, or \ProgramData\, which are common staging areas for malicious binaries.
Detects the creation of a Windows scheduled task using 'schtasks.exe' that triggers on system startup or login, while simultaneously referencing specific keywords ('RageGuard', 'win_guard_', 'RageCore_') in the command line, suggesting the persistence of a specific malicious utility.
Detects outbound network connections to port 8084 initiated by processes originating from suspicious directories such as AppData, Temp, or ProgramData. This behavior is indicative of VSHELL RAT leveraging WebSocket-based C2 communication, a technique observed in UNC5221 SNOWLIGHT campaigns.
Detects behavior associated with TrymeLocker ransomware, specifically the removal of critical Windows components like cmd.exe. The rule monitors for the sequence of taking file ownership using takeown.exe, modifying file permissions with icacls.exe to grant full access, and subsequent deletion of the file using del commands. It also identifies Sysmon file deletion events targeting cmd.exe within system directories by non-system processes.
Detects VLC media player crash conditions or suspicious child process creation immediately following the processing of VP9-encoded video files (.webm, .mkv). This behavior is indicative of potential memory corruption exploitation, such as the vlc-vp9-reschange-crash-poc, which aims to leverage malformed resolution change events for application instability or code execution.
This rule detects the execution of a process named 'wusvc.exe' that is masquerading as the legitimate Windows Update Service. The detection logic identifies instances where the executable is located outside of the standard Windows System32 or SysWOW64 directories and is not spawned by a legitimate parent process (svchost.exe or services.exe), which is indicative of the SNOWLIGHT dropper associated with the UNC5221 threat actor.
This rule detects the use of native Windows utilities to inhibit system recovery capabilities. It monitors for the execution of 'wbadmin.exe' to delete the backup catalog and 'bcdedit.exe' to disable automatic boot recovery or ignore boot failures, which are common tactics used by ransomware and other malware to prevent system restoration after data destruction.
This rule detects activities associated with the VILE ransomware, specifically the creation of file staging artifacts (vile_user_files.zip), execution of associated binaries, and network communication with Gofile.io infrastructure used for exfiltration.
Detects the loading or execution of the Grixba infostealer payload 'inf_g.dll' or processes executing from the known Grixba RDP drop path located at 'C:\Users\Public\Music\'. Grixba malware, associated with the Play ransomware group, often disguises its components to appear like legitimate software (e.g., SentinelOne). The rule filters out legitimate module loads occurring from authorized SentinelOne installation paths to reduce noise.
Detects the execution of a malicious file disguised as 'wusvc.exe' originating from the user Downloads folder. The rule also monitors for suspicious network connections from this process to a known C2 IP address and detects potential defensive evasion techniques such as memory protection changes (PAGE_EXECUTE_READWRITE) used for syscall stub patching or AMSI bypass in non-Microsoft signed versions of this process.
Detects the execution of notepad.exe where the command line arguments reference a file path located in 'C:\temp\' and include a filename typical of ransomware notes, such as 'HowToRestoreFiles.txt'. This behavior is characteristic of ransomware displaying instructions to the victim after file encryption.
Detects execution and activity associated with the Grixba infostealer (often linked to Play Ransomware / Jumpy Pisces operations). The rule monitors for the execution of 'GT_NET.exe' from suspicious locations like 'C:\Users\Public\Music\', the loading or creation of the 'inf_g.dll' modular payload, and identifies a specific known Grixba v3 SHA-256 hash.
Detects various phases of the Grixba infostealer infection lifecycle, including persistence via file drops in public user directories, malicious DLL/payload creation, reconnaissance data exfiltration, security software tampering (Windows Defender, AMSI, WLDP), and event log clearing via wevtutil.
This rule detects potential ransomware activity by monitoring for the deliberate inhibition of Windows system recovery features (via vssadmin, wmic, or bcdedit) and the subsequent staging of archived data in public user directories.
Detects the loader using the native Windows curl.exe to retrieve a ZIP archive containing the RMM components, bypassing PowerShell execution policies. This rule specifically looks for curl.exe executing with command-line arguments that indicate an output file ending in '.zip' and a URL, followed by a file creation event for a '.zip' file.
Page 425 of 976