Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects two primary indicators of potentially malicious activity involving the Windows Explorer process: 1) Suspicious process parentage, where explorer.exe is spawned by a parent other than the standard winlogon.exe, userinit.exe, or explorer.exe, or where explorer.exe spawns unusual child processes like cmd.exe, powershell.exe, or others. 2) Possible Parent PID (PPID) spoofing, identified by the presence of specific API-related keywords in the command line (e.g., SeImpersonatePrivilege, CreateProcessWithToken) within process creation events.
Detects the execution of cmd.exe spawned by processes running from suspicious directory paths such as %TEMP%\aswerf\, %APPDATA%\xwreg\, or %APPDATA%\xgdf\. These paths are commonly associated with dropper activity or malicious payloads. The rule specifically monitors for command lines containing '.pdf', suggesting the potential opening of a lure document.
This rule detects the creation of scheduled tasks using schtasks.exe that exhibit characteristics associated with the SharkLoader malware. Specifically, it identifies tasks using suspicious names like 'OneDrive Standalone Update Task' or those referencing components dropped in %APPDATA% directories (e.g., \xwreg\, \xgdf\), or tasks masquerading as 'SystemSettings.exe' or 'KasperskyLab' directories.
Detects the use of well-known tools and techniques to dump the memory of the Local Security Authority Subsystem Service (LSASS), which is a common method for harvesting Windows credentials.
This rule detects PowerShell or pwsh processes executing commands that contain the string 'autogenstudio' combined with a base64-encoded or obfuscated command pattern. This behavior is indicative of an adversary attempting to execute obfuscated scripts or payloads associated with the Autogenstudio application or using it as a camouflage.
This rule detects potential malicious activity involving the 'wusvc.exe' executable. It flags instances where 'wusvc.exe' is executed from the user's Downloads folder or other non-standard paths, particularly when the file size is abnormally small (less than 100KB), which is indicative of masquerading or a dropper payload. The rule also checks for a known malicious file hash associated with the Snowlight dropper.
Detects suspicious child processes spawned by an AutoGen Studio agent process. This behavior is indicative of the AutoJack exploit chain, where an attacker leverages an unauthenticated MCP WebSocket endpoint (/api/mcp/ws/) to execute arbitrary OS commands on the host by passing base64-encoded StdioServerParams.
Detects the execution of the FScan tool, used by the StrikeShark threat actor for internal network reconnaissance, port scanning, and host discovery. The rule triggers on common binary names associated with FScan and specific command-line arguments indicative of scanning activity, such as CIDR range targeting and port flags, while excluding other known network utilities.
Detects the unauthorized access or copying of the Active Directory NTDS.dit database file, a common credential harvesting technique. The rule monitors for the execution of ntdsutil.exe or vssadmin.exe with arguments typically used to create shadow copies or extract the NTDS database, specifically when executed by cmd.exe or powershell.exe.
Detects anomalous network communication patterns and file system changes indicative of SoftEther VPN usage, particularly when linked to processes masquerading as VMware or communicating with known malicious C2 infrastructure. The rule monitors for network connections on common SoftEther ports, connections to specific command-and-control IP addresses, and the creation of SoftEther configuration files like 'hamcore.se2' or 'vpn_bridge.config'.
Detects the use of the SharpGPOAbuse tool, typically used for modifying Group Policy Objects for persistence or privilege escalation, in conjunction with rapid Active Directory group enumeration (using net.exe or net1.exe) on the same host within a 5-minute window. This behavior is highly indicative of an adversary performing post-exploitation reconnaissance and privilege escalation activities.
Detects unauthorized inbound WebSocket connections from external (non-private) IP addresses to the AutoGen Studio MCP API endpoint at /api/mcp/ws/ on port 8081, followed by the execution of interpreter processes (autogenstudio, uvicorn, or python) on the same host, indicating a potential exploitation of an origin validation bypass for remote code execution.
This rule detects instances where the Windows Update service (wusvc.exe) loads a module or file while simultaneously initiating a process. This behavior is often associated with process injection or the misuse of legitimate system binaries (LOLBins) to facilitate malicious activities by proxying execution through trusted services.
This rule monitors for the execution of 'wusvc.exe' (a potential disguise for malicious binaries) when performed by users or on hostnames containing keywords associated with security research, sandboxing, or testing such as 'sandbox', 'malware', 'virus', or 'sample'.
Detects the execution of VBScript files containing 'ragecore' in the command line, specifically when launched via wscript.exe or cscript.exe from common staging or persistence directories such as Windows Temp, Users Public, or Startup folders.
Detects file write or delete operations involving cmd.exe by processes potentially associated with the TrymeLocker ransomware, specifically looking for indicators of ownership or permission modification (takeown, icacls) and suspicious file paths.
Detects the use of native Windows utilities (icacls.exe, cacls.exe, takeown.exe) to modify file or directory permissions or ownership in a manner consistent with adversarial activity. This includes granting full permissions to everyone/administrators, or changing ownership of critical system directories (e.g., windows, system32) to standard user accounts. The rule includes logic to filter out known legitimate administrative processes and flags potential suspicious parent processes.
This rule detects the execution of processes named win_guard_*.exe or those residing in directories often used for malicious staging (Users\Public, Windows\Temp, ProgramData). Additionally, it detects when these identified suspicious processes load user32.dll, a common indicator of initiating a low-level keyboard hook (WH_KEYBOARD_LL) often used by keyloggers to capture user input.
This rule detects potential command and control (C2) activity associated with the SNOWLIGHT framework by identifying outbound WebSocket connections over HTTP to a specific known C2 IP (38.60.253.35) and port (8084). It correlates network flow logs (CommonSecurityLog) containing specific HTTP URL parameters (a=w64, t=ws_, p=8084) with EDR process network events (DeviceNetworkEvents) where the Windows Update Service process (wusvc.exe) is the initiator, indicating potential process masquerading or injection.
Detects an unknown/network-active parent process spawning shells used by ArachneC2 interactive shell or exec functionality.
Detects suspicious execution patterns involving Windows file management utilities (takeown.exe, icacls.exe) or the deletion of command-line interpreter binaries through cmd.exe. These patterns are often associated with unauthorized modifications of file permissions or attempts to clear forensic evidence during an intrusion.
Page 456 of 976