Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,864
5,883
5,163
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of 'HFY.exe', which serves as the dropper for the BeepRAT malware. This dropper is typically distributed within a trojanized archive containing legitimate-looking DLLs, such as 'data.dll' (a disguised SQLite database), 'EPPlus.dll', and 'NPOI.dll'. The rule triggers when 'HFY.exe' is executed outside of standard program installation directories.
Detects the execution of BeepRAT, a RAT derived from DcRAT, which utilizes heavy obfuscation of class names and Base64-encoded strings that are decoded at runtime. The rule monitors command-line arguments for specific obfuscated identifier patterns and encoded strings associated with the malware's operation, while excluding files located in standard Windows or Program Files directories.
Detects reconnaissance and C2 registration activity associated with the BeepRAT (DcRAT-derived) malware. The rule correlates registry queries, process execution (e.g., wmic, whoami, systeminfo), and file system activity related to the TCC loader chain, specifically focusing on how the implant gathers system hardware and user information to construct a unique client ID for command and control.
This rule detects potentially malicious activity involving the AnyDesk remote access tool by monitoring for abnormal child process spawning, such as command shells (cmd, powershell, etc.), and suspicious DLL loading behavior from non-standard directories. These activities are common indicators of an adversary using remote desktop software for command and control or post-exploitation execution.
This rule detects instances where OpenVPN-related processes (OpenVPNConnect.exe, openvpn.exe, or openvpnserv.exe) spawn known command-line interpreters or execute scripts containing specific markers related to OpenVPN connectivity and script execution. This behavior is indicative of potential command injection or post-exploitation activity leveraging VPN service privileges.
This rule detects instances where ImageMagick tools (magick.exe, convert.exe, mogrify.exe, identify.exe) launch Ghostscript (gswin64c.exe) from non-standard directory locations while passing specific flags (-dQUIET, -dSAFER, -dBATCH, -dNOPAUSE) that are frequently associated with exploitation payloads (e.g., ImageTragick).
Detects unauthorized access to the LSASS process memory, a common technique for credential harvesting. The rule monitors for the execution of 'procdump.exe' or 'rundll32.exe' with parameters specifically aimed at creating a memory dump of 'lsass.exe', behaviors commonly associated with the SystemBC post-exploitation framework.
Detects instances where the SimpleHelp RMM agent process initiates a command interpreter or scripting process. This behavior is often indicative of post-exploitation activity, specifically unauthorized script or command execution delivered via a remote support session.
Detects potential local privilege escalation (LPE) attempts targeting the AnyDesk adprinterpipe named pipe. The rule monitors for the execution of known malicious indicators, unauthorized access to the adprinterpipe, AnyDesk spawning unexpected processes as SYSTEM, and the creation of services by AnyDesk child processes.
Detects macOS Terminal (bash/zsh) retrieving loader.sh or payload.applescript directly from the ClickFix attacker infrastructure.
Detects a post-compromise reconnaissance burst associated with BeepRAT, where a process running from a suspicious directory (AppData, Temp, or ProgramData) executes five or more system discovery commands within a 60-second window, following the creation of a scheduled task on the same host.
Detects the BeepRAT malware using the Tiny C Compiler (tcc.exe) to execute shellcode directly from memory. The rule identifies TCC execution from non-standard directories (specifically within %LOCALAPPDATA%\TCC) using specific flags (-nostdlib -run), and correlates this activity with the creation of an elevated scheduled task named 'WindowsUpdateTempFileCleanUp' used for persistence.
Detects when Minecraft-related clients (e.g., Lunar Client, generic Java Minecraft) launch suspicious child processes such as command-line utilities (cmd.exe, powershell.exe, curl.exe) often associated with malicious post-exploitation activity or credential harvesting.
Detects instances where the AnyDesk remote support application spawns suspicious child processes or administrative utilities. This rule specifically alerts on AnyDesk launching interpreters such as PowerShell, CMD, WScript, or utility binaries like dllhost, regsvr32, mshta, and rundll32, or when processes are executed in the context of the SYSTEM account (UserSid S-1-5-18). Such behavior is a common indicator of unauthorized remote access or post-exploitation activity.
This rule monitors for the execution of the RustDesk remote access tool and specifically tracks any child processes spawned by it. Detecting child processes spawned by legitimate remote access tools like RustDesk is a high-fidelity signal for identifying post-compromise activity, such as command execution or lateral movement.
This rule detects the extraction of a file from an archive (RAR) using 7-Zip utilities, followed by the execution of a file (exe, dll, js, etc.) from the Temp or Downloads directory within 120 seconds. This pattern is commonly observed during the execution phase of a malicious payload delivered via archives.
Detects anomalous child process creation from PHP-FPM or PHP web worker processes. This is indicative of exploitation activity, specifically targeting vulnerabilities in PHP environments where deserialization or memory access (e.g., ASLR bypass via /proc/self/maps) leads to unauthorized code execution and subsequent command-line tool usage.
Detects anomalous activity associated with the 'SmartWindow' browser exploitation technique, specifically: Firefox communicating with the local SmartWindow PoC C2 API on port 8765, Firefox spawning unexpected child processes, or unauthorized processes accessing Firefox's 'places.sqlite' database to harvest browsing history or private session data.
Detects suspicious behavior originating from OpenVPN processes, including spawning command-line interpreters (cmd, powershell, etc.), utilization of server-pushed configuration directives that trigger script execution (e.g., up, down, or route-up hooks), and the creation of scripts or executables within temporary directories.
Detects Node.js processes executing with suspicious command-line arguments that include specific file extensions (.woff, .woff2, .svg, .jpeg, .png, .dict) or known suspicious file names associated with potential malicious activity or obfuscation.
Detects execution of common discovery utilities (whoami, ipconfig, net, etc.) by the suspicious process 'MediumInstStart.exe', often indicative of an adversary performing reconnaissance after initial access or persistence.
Page 466 of 976