Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects the loading of a driver by system utilities (drvinst.exe, pnputil.exe, setupapi.dll, or System process) shortly after a PnP (Plug and Play) device connection event. It specifically flags instances where the driver file is located in suspicious directories (Windows/Temp, Users/Public, AppData/Local/Temp) or the file does not have a .sys extension, which are common indicators of malicious driver installation or BYOVD (Bring Your Own Vulnerable Driver) tactics.
This rule detects command-line activity that references sensitive Windows API functions or privileges associated with token manipulation and process privilege escalation, such as SeDebugPrivilege, SeImpersonatePrivilege, DuplicateTokenEx, CreateProcessWithTokenW, and NtSetInformationToken. The rule excludes common service accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) to focus on potentially unauthorized use by standard or administrative accounts.
Detects Visual Studio Code or Node.js processes checking for common CI/CD environment variables (such as GITHUB_ACTIONS, JENKINS_HOME, or GITPOD_WORKSPACE_ID) or specifically testing for the existence of CI environments via 'process.env.CI'. This behavior is characteristic of malicious extensions attempting to identify if they are running within a sandboxed CI/CD build environment to potentially evade detection or adjust their payload delivery.
Detects outbound network connections initiated by the Internet Information Services (IIS) worker process (w3wp.exe) to non-Microsoft IP addresses on suspicious or high-range ports. This behavior often indicates compromised web servers being used for command-and-control (C2) communication, reconnaissance, or data exfiltration.
Detects NightLedger Command 93, which collects C:\Windows\debug\NetSetup.log alongside a process listing and exfiltrates both to C2. Since DeviceFileEvents does not surface read-class ActionTypes, this query hunts the collection behavior in DeviceProcessEvents: shell commands (type, more, cmd /c) referencing the NetSetup.log path, spawned from the DLL-loader process class consistent with NightLedger's execution chain. NetSetup.log contains domain name, DC hostnames, and join timestamps, high-value AD recon for an espionage actor.
Detects outbound network connections initiated by the Internet Information Services (IIS) worker process (w3wp.exe) to non-Microsoft IP addresses on suspicious or high-range ports. This behavior often indicates compromised web servers being used for command-and-control (C2) communication, reconnaissance, or data exfiltration.
Detects NightLedger Command 36 (screenshot capture) by anchoring the ScreenshotTaken event to the implant's known execution context rather than relying on a blocklist of legitimate tools. NightLedger executes inside a DLL side-loaded by AppVShNotify.exe or related LOLBin processes, and stages under user-writable paths consistent with the group's known deployment locations (LocalAppData\Microsoft\VisualStudio, univpn\promote, etc.). The compound condition; screenshot event AND suspicious initiating process path or LOLBin loader; produces high-confidence detections with minimal enterprise noise.
Detects NightLedger's delivery mechanism: the implant is compiled as a malicious SspiCli.dll and co-located with AppVShNotify.exe (a legitimate Microsoft App-V binary). AppVShNotify.exe imports RPCRT4.dll, which delay-loads SspiCli.dll when an authenticated RPC call is made; loading the implant from the working directory rather than System32. Any load of SspiCli.dll by AppVShNotify.exe from outside canonical Windows system paths is a binary-confidence indicator with near-zero false positive rate in production environments.
Detects NightLedger Command 75, which enumerates logical drives as a pre-exfiltration reconnaissance step; identifying available storage volumes before staging and uploading data via Command 70 (POST to C2). The query hunts for drive enumeration commands (WMIC, fsutil, PowerShell variants) spawned specifically from the DLL-loader process class associated with NightLedger's execution chain. Drive enumeration from rundll32, regsvr32, AppVShNotify.exe, or dllhost has no legitimate use case and is high-confidence in this parent-process context.
Detects NightLedger Command 36 (screenshot capture) by anchoring the ScreenshotTaken event to the implant's known execution context rather than relying on a blocklist of legitimate tools.
NightLedger executes inside a DLL side-loaded by AppVShNotify.exe or related LOLBin processes, and stages under user-writable paths consistent with the group's known deployment locations
(LocalAppData\Microsoft\VisualStudio, univpn\promote, etc.). The compound condition; screenshot event AND suspicious initiating process path or LOLBin loader; produces high-confidence detections with minimal enterprise noise.
NightLedger executes inside a DLL side-loaded by AppVShNotify.exe or related LOLBin processes, and stages under user-writable paths consistent with the group's known deployment locations
(LocalAppData\Microsoft\VisualStudio, univpn\promote, etc.). The compound condition; screenshot event AND suspicious initiating process path or LOLBin loader; produces high-confidence detections with minimal enterprise noise.
Detects NightLedger's delivery mechanism: the implant is compiled as a malicious SspiCli.dll and co-located with AppVShNotify.exe (a legitimate Microsoft App-V binary). AppVShNotify.exe imports RPCRT4.dll, which delay-loads SspiCli.dll when an authenticated RPC call is made; loading the implant from the working directory rather than System32. Any load of SspiCli.dll by AppVShNotify.exe from outside canonical Windows system paths is a binary-confidence indicator with near-zero false positive rate in production environments.
Detects NightLedger Command 93, which collects C:\Windows\debug\NetSetup.log alongside a process listing and exfiltrates both to C2. Since DeviceFileEvents does not surface read-class ActionTypes, this query hunts the collection behavior in DeviceProcessEvents: shell commands (type, more, cmd /c) referencing the NetSetup.log path, spawned from the DLL-loader process class consistent with NightLedger's execution chain. NetSetup.log contains domain name, DC hostnames, and join timestamps, high-value AD recon for an espionage actor.
This rule detects suspicious communication between user-mode processes and kernel-mode drivers using specific Input/Output Control (IOCTL) codes. These IOCTL codes are often associated with known vulnerable drivers that can be exploited for privilege escalation (BYOVD - Bring Your Own Vulnerable Driver) or unauthorized kernel interactions.
Detects NightLedger Command 75, which enumerates logical drives as a pre-exfiltration reconnaissance step; identifying available storage volumes before staging and uploading data via Command 70 (POST to C2). The query hunts for drive enumeration commands (WMIC, fsutil, PowerShell variants) spawned specifically from the DLL-loader process class associated with NightLedger's execution chain. Drive enumeration from rundll32, regsvr32, AppVShNotify.exe, or dllhost has no legitimate use case and is high-confidence in this parent-process context.
This rule detects network connections to known malicious IP addresses, domains, and URLs, as well as the execution or presence of files with known malicious SHA256 hashes. It correlates network and file events to identify potential compromise indicators.
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
This rule detects potential token impersonation or duplication events, often used to escalate privileges or move laterally, by monitoring 'TokenDuplication' and 'ImpersonationEvent' actions. It further refines these signals by looking for associated in-memory DLL loads performed by processes other than standard system components (svchost.exe or services.exe).
Detects network connections to uncommon or suspicious top-level domains (TLDs) initiated by processes other than standard web browsers. The rule filters out known browser processes and analyzes network traffic patterns, including connection count and prevalence across the fleet, to identify potentially anomalous or malicious C2 activity.
This rule detects potential token impersonation or duplication events, often used to escalate privileges or move laterally, by monitoring 'TokenDuplication' and 'ImpersonationEvent' actions. It further refines these signals by looking for associated in-memory DLL loads performed by processes other than standard system components (svchost.exe or services.exe).
This rule monitors for suspicious activity by detecting two distinct patterns: first, network connections initiated by Java processes located in tomcat/catalina directories on high-risk ports; second, suspicious administrative audit actions (Add admin, Modify credential, Export device list) within N-central where the initiating user context is missing.
Detects the HeptaX keylogger by identifying a specific sequence of suspicious process behaviors: installation of WH_KEYBOARD_LL or WH_MOUSE_LL hooks, creation of a specific "Microsoft_SysInternal_logger-v2.0" mutex, elevating the process priority class to high or realtime, and writing log files to a directory masquerading as a OneDrive folder within ProgramData.
Page 30 of 84