Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects the presence of known file hashes associated with Vectra Remote Access Trojan (RAT). The rule monitors both file creation/existence events and process execution events where the SHA256 hash matches the identified indicators of compromise.
This rule detects the potential use of parent process spoofing (PPID spoofing) where a PowerShell process is spawned with 'explorer.exe' as its parent. This technique, often executed via the 'PROC_THREAD_ATTRIBUTE_PARENT_PROCESS' attribute in a 'CreateProcessW' call, is used by adversaries to mask the true origin of the PowerShell process and evade behavioral detection.
Detects the creation of specific mutexes associated with the CHOSEN BRICK malware shortly after establishing persistence via Windows Run registry keys. This behavior indicates a potentially malicious process initializing its single-instance guardrail on a compromised host.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Detects high-volume filesystem activity (exceeding 300 operations in 5 minutes) initiated by 'claude-code' or 'claude' processes. This behavior may indicate an autonomous, patched, or jailbroken AI coding assistant performing mass file operations or reconnaissance without user confirmation.
Identifies instances of Google Chrome running on endpoints with version numbers below the threshold patched for CVE-2026-85046. This detection focuses on specific build numbers (e.g., 152.0.7977.82 for Windows/Linux) to identify potentially vulnerable browser installations in the environment.
Detects the execution or loading of specific components (winfsp-x64.dll, DukeQt.dll) associated with the SparroWocky malware framework, or suspicious image load events lacking a defined module path that typically precede reflective mapping.
Detects instances where a process named 'comet.exe' (or 'comet') accesses sensitive file system locations such as Documents, Desktop, Pictures, or system directories like /etc/ or C:\Windows\. This rule excludes known-legitimate installation and application directories associated with Comet software to reduce noise.
Detects remote thread creation attempts (via CreateRemoteThread or NtCreateThreadEx) where the associated module path is empty or null, which is a common indicator of process injection techniques attempting to execute code without a backing file on disk.
Detects the creation of a 'manifest.json' file within a directory path containing 'Extensions' by common web browsers, followed by an immediate file access event from a non-standard browser location within one hour of the installation. This pattern is indicative of the installation of a potentially malicious or sideloaded browser extension followed by anomalous file activity.
Detects the allocation of executable memory regions (RWX or EXECUTE_READ) that are not backed by a file on disk (i.e., anonymous memory). This behavior is a common indicator of process injection, shellcode execution, or fileless malware techniques where code is injected into a process and executed directly from memory without a corresponding file on disk.
Detects reflective memory mapping and reflective code loading activities consistent with the SparroWocky payload. The rule identifies suspicious memory configurations, specifically executable and writable (RWX) memory regions that are not backed by a corresponding file on disk, often associated with memory-only execution techniques. It also monitors for execution artifacts related to NtMapViewOfSection or reflective loading keywords.
Detects reflective memory mapping and reflective code loading activities consistent with the SparroWocky payload. The rule identifies suspicious memory configurations, specifically executable and writable (RWX) memory regions that are not backed by a corresponding file on disk, often associated with memory-only execution techniques. It also monitors for execution artifacts related to NtMapViewOfSection or reflective loading keywords.
This rule detects the process 'ShieldCrash.exe' accessing or interacting with the Windows ELAM (Early Launch Anti-Malware) configuration directory. ELAM drivers are critical components for secure boot and early malware detection; unauthorized access or manipulation by unknown processes may indicate an attempt to tamper with security tools or evade endpoint protection.
Detects the presence of known file hashes associated with Vectra Remote Access Trojan (RAT). The rule monitors both file creation/existence events and process execution events where the SHA256 hash matches the identified indicators of compromise.
Detects instances where the Windows Search Indexer service process (SearchIndexer.exe) performs suspicious process-related API calls such as memory writes, remote thread creation, or opening processes against common web browser executables (chrome.exe, msedge.exe). This behavior is characteristic of malicious process injection where a legitimate, high-privileged system process is abused to inject code into a browser process.
Detects instances where the Windows Search Indexer service process (SearchIndexer.exe) performs suspicious process-related API calls such as memory writes, remote thread creation, or opening processes against common web browser executables (chrome.exe, msedge.exe). This behavior is characteristic of malicious process injection where a legitimate, high-privileged system process is abused to inject code into a browser process.
Detects instances where the Windows Search Indexer service process (SearchIndexer.exe) performs suspicious process-related API calls such as memory writes, remote thread creation, or opening processes against common web browser executables (chrome.exe, msedge.exe). This behavior is characteristic of malicious process injection where a legitimate, high-privileged system process is abused to inject code into a browser process.
Detects instances where the Windows Search Indexer service process (SearchIndexer.exe) performs suspicious process-related API calls such as memory writes, remote thread creation, or opening processes against common web browser executables (chrome.exe, msedge.exe). This behavior is characteristic of malicious process injection where a legitimate, high-privileged system process is abused to inject code into a browser process.
Detects instances where the Windows Search Indexer service process (SearchIndexer.exe) performs suspicious process-related API calls such as memory writes, remote thread creation, or opening processes against common web browser executables (chrome.exe, msedge.exe). This behavior is characteristic of malicious process injection where a legitimate, high-privileged system process is abused to inject code into a browser process.
Detects network communication originating from the 1C:Enterprise server process (rphost.exe) to a specific remote IP address and port associated with potential malicious activity.
Page 16 of 84