Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,884
5,164
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects specific DLL sideloading patterns associated with the OceanLotus (APT32) group, specifically involving the SPECTRALVIPER loader. The rule monitors for known masqueraded binaries (e.g., intelaudioservice.exe, genuine.exe) loading suspicious files or executing with specific command-line arguments (e.g., -uiDll, /appmodel) indicative of malicious sideloading and persistence mechanisms.
This rule detects suspicious activity involving 'IntelAudioService.exe' and the potential sideloading of 'DtlCrashCatch.dll'. It flags instances where 'DtlCrashCatch.dll' is loaded as a module or when 'IntelAudioService.exe' is executed with specific command-line arguments (e.g., 'appmodel', 'staterepository', 'service') that may indicate abnormal service behavior or potential sideloading attempts.
Detects the execution of common enumeration and discovery commands (e.g., cmd, powershell, tasklist, net, whoami) when launched by specific background services such as OneDrive Sync or Intel Audio Service. This behavior is atypical for these processes and may indicate process injection or unauthorized activity using legitimate service binaries as a proxy.
Detects potential lateral movement activity associated with the SPECTRALVIPER actor by monitoring OneDrive.Sync.Service.exe for the initiation of named pipe connections. The detection specifically targets anomalous orchestration patterns using the XGU::Feature::Pivot Shadow module and XGU::Pivot::StartLink, which utilize named pipes for inter-process communication across systems.
This rule detects potential lateral movement and privilege escalation activity associated with the SPECTRALVIPER framework. It identifies suspicious process launch events where method names indicative of token manipulation (e.g., StealToken, MakeToken, Impersonate_ThisThread) are present in the command line, or where the OneDrive Sync Service process is used as an indicator of this specific activity.
Detects the creation of a local administrator account or modification of the Administrators group through ConfigurationRemotingServer.exe. This activity is associated with the DSCourier persistence technique, which leverages Windows PowerShell Desired State Configuration (DSC) to maintain unauthorized administrative access.
Detects instances where ConfigurationRemotingServer.exe spawns sc.exe, which is indicative of Windows service creation or modification occurring via WinGet Desired State Configuration (DSC) abuse to establish persistence.
Detects instances where the Windows Subsystem for Linux (WSL2) wsl.exe process is used to execute curl or wget from the Windows host. This technique is often used to stage payloads or download tools from the internet, effectively bypassing Windows-based EDR network monitoring as the network connection occurs within the isolated WSL2 environment.
Detects the execution of child processes by wsl.exe. Attackers may use the Windows Subsystem for Linux (WSL2) to execute code, stage payloads, or initiate network connections within the isolated WSL2 VM environment, potentially bypassing Windows-based endpoint monitoring and network security controls.
This rule detects the execution of Windows Subsystem for Linux (WSL) components, including wsl.exe, wslhost.exe, and wslservice.exe. WSL can be leveraged by adversaries to execute malicious code within a Linux environment on a Windows host, potentially bypassing Windows-specific security controls.
This rule detects activities related to the Windows Subsystem for Linux (WSL2), including the execution of wsl.exe, wslhost.exe, or wslservice.exe, as well as the active presence of the vmmemWSL virtual machine process. Monitoring WSL2 activity is important as adversaries can use the Linux environment to bypass traditional Windows security controls, execute Linux-native tools, or maintain persistence.
Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.
Detects the use of the 'netsh interface portproxy' command to set up a port forwarding rule where the connection address is outside of common private IP ranges. This behavior is frequently associated with attackers establishing persistent network pivots or internal proxies to redirect C2 traffic.
Detects the execution of rundll32.exe or regsvr32.exe as a child process of script interpreters like wscript.exe, cscript.exe, or mshta.exe. The command line parameters often involve potentially malicious paths (e.g., Temp, AppData, ProgramData, Users\Public) or the presence of DLL extensions, indicating potential proxy execution of malicious scripts or side-loaded libraries.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
This rule detects when the Windows Subsystem for Linux (WSL) process (wsl.exe) launches common Windows binaries or scripting engines. This behavior is indicative of potential cross-environment execution, where attackers use the Linux subsystem to bypass Windows-based security controls or to execute malicious payloads, living-off-the-land techniques, or command-and-control activities within the Windows environment.
Detects processes that execute and remain dormant for more than 120 seconds before performing a high volume of file operations (greater than 50) or initiating a high volume of network connections (greater than 20). This pattern is consistent with malware or beaconing implants attempting to evade detection during automated sandbox analysis.
This rule monitors for signs of Atlas RAT activity on Linux systems, including the execution of processes matching known Atlas RAT naming conventions, unauthorized modifications to system persistence mechanisms (systemd or init.d directories) by non-package management utilities, and anomalous outbound network connections originating from sshd or PAM-related processes.
Detects suspicious behavior involving the 'uptime' system utility, including execution from non-standard paths, unexpected outbound network connections, spawning child processes, or replacement of the legitimate /usr/bin/uptime binary. These behaviors are indicative of masquerading or binary hijacking.
Detects instances of the 'smbd' process executing from non-standard locations or initiating network connections on ports other than the default SMB ports (139, 445), which may indicate a rogue service, masquerading, or network pivoting activity.
Detects the execution of known GSocket/GS-Netcat tools or the usage of the 'uptime' command when accompanied by network activity, which may indicate process masquerading.
Page 450 of 976