Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects cmd.exe spawned from CrystalX-style temp executable lineage.
Detects instances where the Node.js executable (node.exe) spawns common command shells or scripting interpreters such as cmd.exe, powershell.exe, pwsh.exe, or wscript.exe. This behavior is often indicative of Node.js-based applications being used as a staging point for command execution, a common pattern in post-exploitation or the usage of malicious npm packages.
This rule detects the coordinated execution of multiple Windows command-line utilities (vssadmin, wbadmin, and bcdedit) within a short time frame (60 seconds). These tools are frequently used by ransomware and other malware to delete volume shadow copies, clear backup catalogs, and disable system recovery features, effectively preventing the restoration of the system after a damaging event.
This rule detects scenarios where a new local user account is created on a Windows system during off-hours (between 7 PM and 7 AM), followed by the execution of known remote access tools within a 30-minute window of that account creation. This combination is often indicative of unauthorized persistent access establishment.
Detects instances where the Node.js executable (node.exe) spawns common command shells or scripting interpreters such as cmd.exe, powershell.exe, pwsh.exe, or wscript.exe. This behavior is often indicative of Node.js-based applications being used as a staging point for command execution, a common pattern in post-exploitation or the usage of malicious npm packages.
This rule detects potential internal network reconnaissance activities by monitoring for either mass execution of network discovery commands (such as 'net view' or 'net share') targeting multiple unique hosts within a 5-minute window, or by monitoring for mass outbound network connections to port 445 (SMB) across multiple unique destination hosts within the same timeframe. This behavior is indicative of an attacker attempting to map available network shares or identify reachable systems for lateral movement.
Detects a potential User Account Control (UAC) bypass by correlating registry value updates in the 'ms-settings' class with the subsequent execution of auto-elevating Windows binaries (fodhelper.exe, computerdefaults.exe, or sdclt.exe) from suspicious locations such as AppData or Temp directories.
Detects unauthorized processes, such as shells, scripting engines, or command-line utilities, that attempt to display or access environment variables containing sensitive cloud credential patterns (e.g., AWS_ACCESS, API_KEY). This behavior often indicates an attempt to steal cloud provider credentials from the host environment.
Detects activity associated with the BRICKSTORM threat actor, including known malicious ELF binary execution, unauthorized file path utilization, and suspicious DNS-over-HTTPS (DoH) network traffic directed to public DNS resolvers.
This rule detects potential malicious activity associated with the 'CadenceOptimizer' service and related 'agt.dll' library. It monitors for the creation or modification of Windows Registry keys for persistence, the creation or loading of a specific DLL in the 'ProgramData\CorsairUtil' directory, and the injection of code into 'svchost.exe' via 'Brn_Agent' command line arguments.
Detects instances where an unusual process (not a standard image viewer or web browser) reads a .png file and subsequently triggers a new process within a 5-minute window. This behavior is indicative of potential steganographic exploitation or hiding malicious code within image files, where a hidden payload is read and then executed.
Detects behavior associated with the Glove Stealer malware, specifically the disabling or modification of Windows Defender, the use of UAC auto-elevate binaries (fodhelper.exe, computerdefaults.exe) initiated by non-standard processes, and unauthorized modifications to Windows Defender registry keys.
Detects a privilege escalation technique that exploits the Windows Error Reporting (WER) 'QueueReporting' scheduled task. An attacker leverages the Task Scheduler COM API to trigger this task, causing 'wermgr.exe' to execute as SYSTEM from an attacker-controlled directory (often via directory junction redirection), subsequently spawning shell processes.
Detects the use of common Windows system administration tools (cmd, powershell, net, sc, taskkill, wmic) to stop, delete, or terminate known backup software agents. This behavior is highly characteristic of ransomware or destructive attacks attempting to inhibit system recovery by destroying backup infrastructure.
This rule detects potentially malicious activity involving the Windows Error Reporting service (wermgr.exe). It monitors for two primary conditions: 1) Execution of wermgr.exe from a location other than the standard System32 directory, indicating potential binary masquerading. 2) wermgr.exe spawning common command-line shells (cmd, powershell, etc.) while running under the SYSTEM account, which is indicative of potential task abuse or privilege escalation.
Detects process hollowing targeting the legitimate dBpoweramp process (NeuroManag.exe) to inject and execute Vidar v2.1 malware. The rule identifies the creation of a NeuroManag.exe process followed by an anomalous module load event where a random .tmp file from the user's Temp directory is mapped into that process, a pattern indicative of NtMapViewOfSection-based process injection.
This rule detects the execution of known Vidar or SnappyClient loader processes (NeuroManag.exe or VirtualAr.exe) followed by repeated network connections to specific C2 infrastructure IP addresses or common dead-drop resolver services such as Telegram, Steam, or specific attacker-controlled domains. The rule identifies suspicious beaconing behavior following the process launch, indicating active command and control communication.
Detects the execution of a PyInstaller-compiled payload associated with the Yuta/Glove Stealer campaign. The rule monitors for processes launching from temporary _MEI* extraction directories within %APPDATA% or %TEMP%, and specifically identifies the winupdate.exe payload within .cache subdirectories.
Detects malicious scheduled task activity attributed to the Payouts King threat actor. The rule monitors for the creation, execution, and deletion of tasks using specific naming conventions ('Mozilla\UpdateTask', 'Mozilla\ElevateTask') or patterns (e.g., /ru SYSTEM, /sc ONSTART) executed by non-standard parent processes.
Detects multiple host enumeration techniques indicative of pre-encryption discovery activity. The rule monitors for the sequential or combined use of tasklist.exe, PowerShell Get-Process, cmd dir /s, and findstr.exe on a single host within a 30-minute window, which is a common behavior pattern for various ransomware strains.
Detects instances where the LINE messaging application (LINE.exe) initiates child processes commonly associated with malware delivery, such as command-line shells, script interpreters, and archive utilities. This pattern is often indicative of TA4922 activity, which leverages themed lures (HR, payroll, tax) delivered via the platform to execute malicious payloads.
Page 442 of 976