Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,482 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,168
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,482
11,866
5,884
5,164
4,867
Platforms
18,085
3,046
1,506
124
104
Products / Services
5,725
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the creation of scheduled tasks using schtasks.exe that point to the ProgramData directory, which is a common persistence location for malware like SystemBC. The rule excludes common, benign software installers and updaters that frequently use this directory to avoid false positives.
SearchProtocolExecution
YARA-L
Detects execution of processes containing 'search' or 'search-ms' in command line with 'crumb=location' parameter.
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Detects Node.js processes engaging in suspicious behaviors related to supply chain or second-stage attacks. This includes executing scripts from hidden .peer/ directories, accessing specific staging script filenames, and performing DNS requests or network connections to the known malicious domain data-stream.space.
This rule detects the installation and execution of malicious typosquatted npm packages associated with the Polymarket Trap campaign. It monitors for the creation of specific directory names within node_modules, npm install commands referencing these package names, and network activity or DNS lookups to 'log-taker' infrastructure from Node.js processes.
Detects suspicious behavior associated with Remcos RAT, including UAC bypass techniques using ICMLuaUtil, process injection into system binaries, and persistence mechanism creation in the Windows registry.
This rule monitors for suspicious file creation and process execution indicative of the Remcos Remote Access Tool. It specifically looks for the creation of files containing 'keylogger.dat' or 'logs' in the user's AppData directory, as well as the execution of processes with 'remcos.exe' or 'remcos' in the path or command line arguments, signaling potential keylogging or remote control activity.
Detects the compilation or execution of the Exploitarium Nmap IPv6 ExtLen Wrap Proof-of-Concept harness. This detection monitors for the direct execution of known binary names and the g++ compilation process involving these specific source files.
Detects suspicious execution of wmic.exe where the command line contains keywords often associated with enumeration or manipulation of processes and services. This can indicate an adversary using WMI for discovery or execution.
This rule detects the creation of new processes where the command line contains keywords such as 'exploit' or 'vulnerability'. This could indicate an attempt to execute an exploit or leverage a known vulnerability, potentially as part of an attack.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
This rule detects repeated execution of 'maven' or 'gradle' commands on a system within a one-hour window. A high count (5 or more) of these commands from the same account on the same computer within an hour could indicate unusual development activity, automated build processes, or potentially malicious activity related to software supply chain compromise or development environment abuse.
This rule detects repeated execution of commands containing both 'version' and 'control' keywords within the command line. It specifically looks for at least 5 such executions within a one-hour window on the same computer by the same account. This pattern could indicate an adversary attempting to enumerate system or software versions, or interact with version control systems, potentially as part of reconnaissance or privilege escalation.
Detects modification of Windows Registry Run keys that are either explicitly associated with Remcos RAT or involve suspicious process-to-path combinations (non-standard paths being written to by command-line utilities). This rule monitors for indicators of persistent execution via common startup registry keys.
Detects network connections to common IP lookup services (e.g., ip-api.com, ipify.org) initiated by processes often associated with malware, such as Remcos RAT components or hijacked system processes like iexplore.exe. This activity is frequently used by adversaries for reconnaissance or C2 heartbeats to identify the external IP address of a compromised host.
This rule detects anomalous process execution patterns associated with Remcos RAT, specifically monitoring for the spawning of 'rmclient.exe', unauthorized spawning of 'fsutil.exe', or 'svchost.exe' being launched by processes other than system-critical services. These patterns are characteristic of Remcos RAT deploying its watchdog or performing process injection.
Detects Microsoft Office applications (Word, Excel, PowerPoint) and WordPad spawning command-line interpreters (mshta, wscript, cscript, cmd, powershell, pwsh). This behavior is often associated with macro-based malware or malicious document attachments attempting to execute scripts or shell commands to facilitate further infection stages.
This rule detects the execution of processes where the command line contains keywords commonly associated with privilege escalation or gaining administrative privileges, such as 'getadmin' or 'privesc'. It monitors Windows Security Event ID 4688, which logs process creation.
This rule detects the execution of the Remcos Remote Access Trojan (RAT) followed by the creation of a keylogger data file by the same process, within a one-hour timeframe. This pattern indicates an active infection where the RAT is performing credential harvesting through keystroke logging.
Detects Remcos RAT watchdog activity characterized by process injection into system binaries (svchost.exe, rmclient.exe, fsutil.exe) to relaunch the main payload from non-standard directories (AppData, Temp, ProgramData), or a self-resurrection loop where the malware spawns a child process with an identical file path to maintain execution after termination.
Detects the creation or manipulation of the 'troot' root-privileged backdoor account on Cisco Catalyst SD-WAN controllers, associated with the UAT-8616 exploit chain. The rule monitors for direct modification of /etc/passwd or /etc/shadow files, usage of useradd, grep operations on passwd files, and execution of su to the troot account.
Page 459 of 976