Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,482 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,168
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,482
11,866
5,884
5,164
4,867
Platforms
18,085
3,046
1,506
124
104
Products / Services
5,725
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects modifications to Windows Registry Run keys associated with the persistence mechanism of Millenium RAT, specifically looking for indicators such as the 'Liu5GgJiKiKqe2Qs' folder or suspicious 'MsEdgeUpdate' entries pointing to executable files in the AppData directory.
This rule monitors for the creation or modification of Windows Registry Run/RunOnce keys by executables residing in non-standard, user-writable directories (e.g., AppData, Temp, Downloads). It triggers when an initiating process performs this action while using masquerading names (matching common system binaries), using suspicious lure-themed naming, or when the run key value points to AppData for a file lacking version metadata, which are patterns observed in Millenium RAT activity.
Detects anomalous PowerShell process execution by monitoring for indicators of obfuscation, use of download cradles, and execution from suspicious parent processes. This detection specifically aligns with techniques associated with the Millenium RAT C++ v4.x stagers, flagging processes that exhibit multiple risk indicators simultaneously.
Detects evidence of UAC bypass via ShellExecuteExW runas elevation from medium-integrity processes located in user-writable paths, followed by the creation of a persistent 'MixedSvc' service using sc.exe, as observed in the Operation DragonReturn campaign involving DcRAT.
Detects anomalous use of WMI queries or the wmic.exe utility to gather system or antivirus configuration information from suspicious paths (e.g., Temp, AppData) or when executed by unexpected processes. This pattern often indicates early-stage discovery by malicious software.
Detects potential DcRAT activity characterized by a process spawning under a svchost.exe parent, subsequent loading of GDI display libraries for screen capturing, and outbound network communication on non-standard ports, which indicates data exfiltration.
Correlates a successful Fortinet SSL VPN session with nltest, net, Get-AD*, AdFind, ldapsearch, WinRS, or WMIC discovery commands for the same account within forty-five minutes. This behavior can indicate an attacker establishing initial access via VPN and then performing internal reconnaissance.
Detects Chrome launch with specific crash recovery evasion flags indicative of FlutterShell.
Detects the execution of known Windows privilege escalation tools commonly referred to as 'potato' exploits (e.g., JuicyPotato, SweetPotato, PrintSpoofer). These tools typically exploit service account misconfigurations or Windows APIs to achieve local privilege escalation to SYSTEM.
Detects the execution of the dllhost.exe process with command-line arguments referencing .cpl files or the 'COpenControlPanel' string. This behavior is indicative of potential malicious activity where attackers use Control Panel files (which are essentially DLLs) to proxy code execution, potentially to bypass security controls or masquerade as legitimate system activity.
Detects instances where the Windows Installer (msiexec.exe) initiates potentially suspicious child processes such as cmd.exe, rundll32.exe, or 7z.exe, particularly when these executions involve paths commonly associated with staging or executing malicious payloads, such as the AppData directory, temporary folders, or MSI installer subdirectories.
Detects the use of 7-Zip (7z.exe) to archive files named 'data.dat' or files within the 'Traiolx Custom Utils' directory, when initiated by command-line interpreters like cmd.exe or the Windows Installer (msiexec.exe). This pattern is often indicative of data staging or collection activities prior to exfiltration.
This rule monitors for suspicious activity associated with LegionLoader malware, specifically tracking files and processes interacting with the 'Traiolx Custom Utils' directory. It triggers on the staging of '_socket.pyd', execution of Python interpreters from this directory, and associated C2 communication attempts with the domain 'birdeemusic.com'.
Detects instances where msiexec.exe or related processes modify sensitive Windows Registry keys often associated with security settings, Internet Explorer configuration, or system identification. This behavior may indicate an attempt to tamper with security controls or prepare for further malicious activity.
Detects Python scripts or interpreters executing network connections while residing in or interacting with non-standard, potentially suspicious directories or domains. This rule specifically monitors for Python processes (python.exe, pythonw.exe) associated with 'Traiolx Custom Utils', paths within 'AppData\Roaming\python', or network interactions with 'birdeemusic.com' and a specific hardcoded IP address, which are indicative of potential beaconing or command and control activity.
Detects activity associated with a specific phishing campaign distributing 'Distribution Settlement Agreement' PDF lures. The rule monitors for file creation or execution of files matching this naming pattern, as well as network connection attempts to domains identified as related to the threat actors: 'gasparinutrition.com' and 'gappssmtp.com'.
Detects the execution of batch (.bat/.cmd) scripts located within the AppData\Roaming directory via cmd.exe. This behavior is indicative of LegionLoader multi-stage infection chains, particularly when initiated by msiexec.exe. Legitimate software update processes are excluded to minimize false positives.
This rule detects potentially malicious modifications to registry keys associated with Internet Explorer, Windows Internet Settings, or Windows NT configuration. It specifically looks for activity involving processes running from suspicious locations (e.g., AppData) or common abuse vectors like cmd.exe and msiexec.exe that perform these registry changes repeatedly, which may indicate persistence mechanisms or defense evasion.
Detects instances of rundll32.exe being spawned by msiexec.exe or cmd.exe where the command line arguments involve loading DLLs from AppData paths, specific libraries like normaliz.dll or 7z.dll, or paths associated with LegionLoader staging activity. This behavior is indicative of malware loaders attempting to execute secondary payloads from writable user directories.
Detects Amadey loader executing its credential-theft plugin (cred.dll) via rundll32.exe with the Main export, triggered by Amadey backdoor command 0x15 after downloading cred.dll from the C2 /Plugins/ path.
Detects the use of administrative utilities such as vssadmin.exe, wmic.exe, and wbadmin.exe to delete volume shadow copies or backup catalogs. This behavior is a common indicator of ransomware attempting to inhibit system recovery prior to encryption.
Page 464 of 976