Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of QEMU binaries (qemu-system-x86_64, qemu-img, qemu-system-i386, qemu-system-aarch64) when launched from parent processes that are not standard virtualization or emulation management tools. This can indicate the use of QEMU for malicious purposes, such as unauthorized virtual machine execution, persistence, or secondary staging on a compromised host.
This rule monitors for processes that establish a network connection to specific Cloudflare IP address ranges (104.21.0.0/16 and 172.67.0.0/16) within a 5-minute window. This can be indicative of communication with command and control infrastructure, proxies, or content delivery networks used by adversaries.
This rule detects a sequence of events where specific potentially malicious parent processes spawn child processes (WizardDa42.exe or AlphVector.exe spawning NeuroManag.exe or VirtualAr.exe). Following this, the child process is observed loading a .tmp file from the AppData Local Temp directory, followed shortly by the loading of ntdll.dll. This pattern is often indicative of process injection or hollowed process behavior where a payload is dropped as a temporary file and subsequently executed or reflected in memory.
Detects potential User Account Control (UAC) bypass attempts using known techniques involving the execution of fodhelper.exe or eventvwr.exe, or by abusing the Mozilla ElevateTask task scheduler configuration.
Detects an executable or file running from a common temporary or user-writable location (e.g., AppData, Temp, ProgramData) that is followed within two hours by a modification to a Windows 'Run' registry key referencing a file in the same suspicious directory structure.
This rule detects processes executing from commonly abused, high-write temporary or user-specific directories (AppData, Temp, ProgramData) that simultaneously initiate network connections to external IP addresses over HTTP/HTTPS ports (80/443). This pattern is frequently indicative of initial stage malware, downloader behavior, or command and control communication originating from non-standard execution paths.
This rule detects processes running from common user-writable directories (AppData, Temp, ProgramData, etc.) that concurrently establish outbound network connections to non-private (non-RFC1918) IP addresses. It explicitly excludes common browsers, accessibility tools, and known Windows system or product-related paths to reduce noise.
Detects the execution of Python interpreters from suspicious or user-writable locations such as Temp, Downloads, or AppData directories. The rule explicitly excludes known legitimate development and coding environments, focusing on potential malicious script execution, often associated with droppers or secondary payloads that are not managed by typical IDEs or development tools.
Detects Python-based execution of system binaries (wmic.exe, reg.exe, tasklist.exe, systeminfo.exe) used for environment reconnaissance, specifically targeting VM and sandbox detection artifacts characteristic of the SilentRunLoader malware.
Detects potential malicious activity including unsigned processes performing cross-process injection into common system processes, suspicious sideloading of 'vulkan-1.dll' from non-standard locations, and execution of unsigned binaries from user-writable directories like Temp, AppData, or ProgramData.
Detects the execution of systeminfo.exe or wmic.exe for hardware and operating system discovery when initiated by a process located in user-writable or temporary directories, such as AppData, Temp, ProgramData, or Downloads. This behavior is characteristic of post-infection reconnaissance by malware loaders or RATs.
Detects instances where critical Windows system processes (svchost.exe or lsass.exe) spawn suspicious child processes. This pattern often indicates process injection or unauthorized activity where an adversary uses these legitimate, high-privileged processes as a parent to execute malicious payloads, bypass security controls, or maintain persistence.
Detects the creation of suspicious scheduled tasks by monitoring Windows Event Logs (EventCode 4698) for task XML content and process creation events (EventCode 1) for the 'schtasks.exe' utility. The rule identifies tasks created in user-writable paths (like AppData or Temp), tasks containing suspicious keywords like 'hidden' or specific Mozilla update patterns, tasks configured to run as SYSTEM, and tasks spawned by non-standard parent processes.
Detects the execution of QEMU binaries or the utilization of .qcow2 disk files. The rule flags these activities as higher risk when they occur within common user-writable or temporary directories, which is a common indicator of unauthorized virtualization usage, staging for side-loading, or attempts to hide malicious artifacts within virtual disks.
This rule detects the execution of suspicious file types (exe, dll, bat, cmd, vbs, js, ps1) originating from common extraction or user-writable locations like Downloads, Temp, or Roaming AppData directories. The rule specifically flags processes spawned by common archive utilities (winrar.exe, 7zFM.exe, 7zG.exe) or Windows Explorer, with an additional risk assessment if the command line arguments suggest recruitment or financial lure themes.
Detects process hollowing behavior indicative of the Atlas RAT loader used by TA4922. The rule monitors for the spawning of svchost.exe or notepad.exe by non-standard parent processes located outside legitimate system directories, which is a common indicator of process injection and masquerading techniques.
Detects potential process injection attempts by Atlas RAT or ValleyRAT malware into system processes such as svchost.exe or explorer.exe. The rule identifies suspicious execution originating from user-writable directories (e.g., Temp, AppData) when spawning these critical processes, which deviates from standard system-based spawning patterns.
Detects a process hollowing technique where legitimate system processes (svchost.exe or notepad.exe) are spawned by non-standard parent processes, followed by suspicious memory manipulation API calls (such as NtUnmapViewOfSection, NtWriteVirtualMemory, or NtResumeThread) from an non-system process, indicative of malicious code injection.
Identifies the execution of wget.exe or curl.exe with command-line flags indicative of file uploads (specifically archives like zip, rar, or 7z), which may be used by adversaries to exfiltrate staged data to remote infrastructure.
Detects the deployment of the IronWorm eBPF kernel rootkit by monitoring for unauthorized bpf() syscalls, specifically when invoked by suspicious parent processes such as npm or shells. The rule tracks the loading of eBPF programs, the usage of tools like bpftool, tc, and ip, and the presence of specific file artifacts and indicators associated with rootkit behavior like hiding PIDs or network sockets.
Detects instances where npm or node processes execute potentially malicious scripts (such as 'tools/setup' or '.github/scripts/precheck') during the package installation lifecycle, specifically when operating within a 'node_modules' context. This is indicative of supply chain attacks where malicious actors inject code into project dependencies.
Page 443 of 976