Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,482 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,168
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,482
11,866
5,884
5,164
4,867
Platforms
18,085
3,046
1,506
124
104
Products / Services
5,725
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects command line patterns associated with Cobalt Strike Beacon injection, specifically looking for indicators of 'beacon.dll', 'beacon.exe', or 'injection' strings being executed by suspicious parent processes such as explorer.exe, svchost.exe, or winlogon.exe. This activity is indicative of post-exploitation behavior and potential lateral movement or persistence attempts.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key LoLBin technique used in the CrashFix campaign.
Detects the use of curl.exe to upload files to the temp.sh service while simultaneously passing the resulting temp.sh URL within the User-Agent string to a C2 server. This specific exfiltration and beaconing TTP was observed in the Notepad++ supply chain attack.
Detects instances where the process MpExtMs.exe loads suspicious DLLs (e.g., EndpointDlp.dll, version.dll) or spawns child processes, which is consistent with DLL sideloading patterns associated with the Backdoor.Mistic malware.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Detects suspicious process creations (PowerShell, Cmd, Mshta, Wscript) originating from web browsers, explorer.exe (likely from the Run dialog), or rundll32.exe. This pattern is often associated with social engineering attacks like 'ClickFix' where users are tricked into pasting malicious commands.
This rule detects a suspicious sequence of events: the enablement of Remote Desktop Protocol (RDP) via registry modification, followed by the creation of a new local administrator account with password expiration disabled, potentially accompanied by a netsh firewall rule modification to allow RDP. This combination of actions is highly indicative of an adversary establishing persistent remote access and creating a backdoor account.
This rule detects potential persistence mechanisms and execution associated with Amadey or StealC malware. It identifies the creation of scheduled tasks (`schtasks.exe /create`) targeting suspicious directories or known Amadey/StealC paths, as well as Task Scheduler Event ID 4698 (task created) referencing these paths. Additionally, it looks for direct execution of 'nudwee.exe' (an Amadey component) and shell processes (`cmd.exe`, `powershell.exe`) spawned by scheduled tasks from suspicious locations or referencing Amadey/StealC paths.
This rule detects the execution of 'vaultsvc.exe' or executables starting with 'WindowsVault' and ending with '.exe' from suspicious, non-standard directories such as AppData, ProgramData, or Temp. It also flags execution from any non-system path if not in System32, SysWOW64, or Program Files. A known malicious hash for 'vaultsvc.exe' is specifically identified.
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
Detects the use of reg.exe to add persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. This rule specifically looks for the addition of 'NvmProtocal', 'protocal.cjs', or 'NodePackages' which are associated with a backdoor.
This rule detects the execution or file interaction of known local AI/Large Language Model tools (e.g., Ollama, LM Studio, GPT4All) when initiated by non-interactive system processes (such as services.exe, svchost.exe, or lsass.exe) or under system/network service account contexts. This behavior is indicative of unauthorized local model staging or enumeration within a compromised environment.
Detects instances where 'node.exe' accesses browser extension LevelDB directories (associated with cryptocurrency wallets in Chrome, Edge, or Brave) or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior is indicative of potential malware attempting to exfiltrate sensitive browser data or execute malicious code.
This rule correlates rapid file modifications (potential encryption or mass deletion) with the execution of commands known to inhibit system recovery (e.g., deleting shadow copies or modifying boot recovery settings) and significant outbound network data transfers from the same host. This pattern is characteristic of ransomware deployment.
Detects the use of PowerShell to modify Windows Defender settings by adding the root C:\ directory to the exclusion list. This behavior is indicative of Millenium RAT attempting to evade detection and maintain persistence on a compromised host.
Detects a multi-stage infection chain associated with the TONResolver campaign where PowerShell is used to execute a Node.js-based RAT payload from a non-standard location in AppData\Local\Nodejs. This pattern monitors for the parent-child relationship where PowerShell launches a specific node.exe instance containing JavaScript file execution flags.
This rule identifies indicators of compromise associated with the DragonReturn malware and DcRAT, including malicious file names, suspicious process execution, DNS resolution of known malicious phishing domains, and network communication with documented C2 infrastructure.
Detects Millenium RAT attempting to bypass User Account Control (UAC) by spawning cmd.exe with the 'runas' verb via ShellExecuteExW. The rule specifically looks for cmd.exe processes running in High integrity, spawned from non-standard parent processes, while executing commands such as 'whoami'.
Detects malicious process injection behavior attributed to Operation DragonReturn, where an illegitimate executable named 'Mixed Reality.exe' located within a 'Windows Media Player' directory spawns 'svchost.exe'. This activity is indicative of a DcRAT payload attempting to inject fileless .NET code into a legitimate system process using techniques such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
Detects a suspicious sequence where a non-Microsoft signed process running from a user-writable path (e.g., Temp, AppData) spawns a high-integrity or SYSTEM process, followed immediately by persistence activity (modifying Run keys) or the creation of suspicious services/modification of security preferences.
Detects the use of the Windows Service Control Manager (sc.exe) to create, start, or delete a service named 'MixedSvc'. The rule includes specific checks for binPath configurations, which can be indicative of persistence or privilege escalation attempts using services.
Page 463 of 976