Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,483 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,483
11,867
5,885
5,168
4,867
Platforms
18,085
3,047
1,506
124
104
Products / Services
5,726
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,574
3,458
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the deletion of volume shadow copies using standard Windows utilities vssadmin.exe or wmic.exe. This activity is a common indicator of ransomware or other destructive attacks attempting to inhibit system recovery.
Detects execution of common Windows utilities used by adversaries post-encryption to hinder system recovery and clear forensic evidence. This includes disabling the Windows Recovery Environment (ReAgentC), wiping disk free space (Cipher), clearing DNS caches, and clearing Windows Event Logs via Wevtutil or PowerShell.
This rule detects potential malicious activity where a non-browser process downloads a specific payload file from a suspicious domain ('easyllms.xyz') and is subsequently linked to process activity involving the discovery of system or user information (e.g., GetComputerNameA, GetUserNameA). This pattern is characteristic of a dropper or stage-one malware attempting to profile the compromised host.
Detects usage of Crowdstrike Real Time Response (RTR) to execute a "runscript" command.
This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.
This can be used by malicious actors with access to the Crowdstrike Dashboard to execute commands on remote managed hosts.
This rule identifies potential infections associated with the MacSync malware family by matching process, file, and network indicators (hashes, malicious domains, and specific payload URLs) against endpoint telemetry. It monitors for execution of known malicious binaries, file creation events, and communication with identified command-and-control infrastructure.
Detects the execution of known, signed legitimate binaries (COTFileReadApp.exe or DeElevate64.exe) from user-writable directories, such as %LOCALAPPDATA%\Programs\. This behavior is a common indicator of DLL sideloading, where adversaries utilize a trusted, signed application to execute malicious code by placing a malicious DLL in the same directory as the executable.
Detects the 'ClickFix' social engineering pattern where an adversary tricks a user into using the Windows Run dialog (explorer.exe) to execute msiexec.exe, downloading and installing a remote MSI package. This is frequently associated with malware delivery, such as Psychedelic Stealer, where users are prompted to copy and paste malicious commands under the guise of fake error messages or CAPTCHAs.
Detects sophisticated in-memory loader activity characterized by a sequence of events: process module loads involving AMSI patching (amsi.dll), fresh ntdll.dll remapping to bypass EDR hooks, and the enumeration of hypervisor-related drivers or services, often associated with advanced payload execution chains like ClickFix.
Detects the execution of PowerShell commands that reflectively load .NET assemblies into memory, followed immediately by a process injection event targeting Chromium-based browsers (e.g., chrome.exe) or Firefox. This behavior is highly characteristic of credential harvesting tools like BoundSiphon, which injects code into browser processes to decrypt and extract App-Bound encryption keys.
Detects installation of new certificate on the system which attackers may use to avoid warnings when connecting to controlled web servers or C2s
This rule detects instances where the WMI Provider Host process (wmiprvse.exe) initiates a child process. While WMI is a legitimate administrative tool, it is frequently abused by attackers for lateral movement, remote code execution, and persistent event subscriptions. Monitoring for child processes spawned by wmiprvse.exe can highlight potentially malicious activity triggered via WMI.
This rule detects persistence mechanisms involving the creation or modification of Windows Registry Run keys, the creation of scheduled tasks, or the execution of specific binaries (COTFileReadApp.exe, DeElevate64.exe) associated with potentially unauthorized activity, specifically tracking strings related to 'Canon Configuration Reader' or 'Stardock DeElevation Tool'.
This rule detects suspicious PowerShell command-line activity that uses '-ExecutionPolicy Bypass' in conjunction with network-fetching cmdlets like 'Invoke-RestMethod' or 'irm' to download files to a temporary directory, followed by potential script execution. This pattern is commonly used by adversaries for stage-1 payload delivery and fileless execution.
Detects the CARBONATO botnet's XMRig cryptocurrency miner attempting to hide its presence on Linux hosts by masquerading as the systemd-logind binary or by spoofing kernel thread names such as [kworker/u2:0] in process command-line arguments.
Detects persistence mechanisms associated with the CARBONATO botnet. The rule identifies two primary behaviors: the execution of a hidden watchdog binary '/usr/local/bin/.docker-network-monitor' by the cron daemon, and the use of 'chattr +i' to make this watchdog binary immutable, preventing deletion or modification.
Detects a suspected anti-debugging and anti-instrumentation sequence on Android devices. This rule identifies instances where 'getprop' is used to query system properties related to device security (ro.debuggable, ro.secure) followed shortly by a local network probe to the standard Frida instrumentation server port (27042). This combination is indicative of malware gating its execution to ensure it is not running within a controlled or debugged environment.
Detects msiexec.exe initiating network connections to or executing packages from endpoints containing 'capher.php' and token parameters. This behavior is associated with the 'ClickFix' delivery chain, where adversaries use malicious websites or scripts to trick users into downloading and executing installer files.
Detects the execution of the DEL command via cmd.exe spawned by sqlservr.exe, specifically targeting batch scripts, executables, or text files located within AppData or ServiceProfiles paths. This behavior is indicative of post-exploitation activity where an attacker removes staging artifacts used during lateral movement or persistence phases to hide their tracks after using xp_cmdshell.
This rule detects instances where the SQL Server process (sqlservr.exe) spawns cmd.exe or powershell.exe as child processes. This behavior is strongly associated with the abuse of the 'xp_cmdshell' stored procedure, which allows SQL Server to execute operating system commands. This is a common post-exploitation technique used by attackers to execute commands or scripts following successful unauthorized access or brute-force attacks on MSSQL instances.
Detects the execution of binaries using the '-i -c <batch_file>' command-line argument pattern, which is characteristic of the NetworkServiceExploit tool used for token impersonation and privilege escalation. This rule specifically monitors for this pattern when spawned by processes like sqlservr.exe, commonly seen in exploitation chains involving xp_cmdshell.
Detects post-compromise activity associated with the NeedyMantis group, specifically the staging of a legitimate binary alongside a malicious DLL and a paired archive, followed by the execution of the legitimate binary to trigger DLL side-loading. This activity is typically preceded by Impacket-style remote command execution (e.g., wmiexec, smbexec, atexec).
Page 51 of 976