Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects autoit3.exe invoking process injection Windows APIs (OpenProcess, VirtualAllocEx, WriteProcessMemory, CreateRemoteThread, CloseHandle) from kernel32.dll targeting the legitimate charmap.exe process, consistent with the AutoIT payload injector chain delivering VIPKeylogger/MedusaHVNC.
This query performs comprehensive field extraction and normalization on SentinelOne Deep Visibility raw logs. It acts as a parsing and preparation layer to structure diverse event categories (process, network, file, registry, authentication, and task events) into a standardized format for security analysis, triage, and threat hunting.
Detects anomalous native code execution behavior within Firefox or Tor Browser processes by correlating memory protection changes (e.g., VirtualProtect/mprotect) with subsequent suspicious execution events occurring within a two-minute window, indicative of WebAssembly-based exploit chains.
Detects unauthorized process injection attempts—such as remote thread creation, memory writes, or OpenProcess calls—targeting browser processes (chrome.exe, firefox.exe). The rule filters out known-legitimate security tools and browser helper processes by leveraging process names, company metadata, and valid digital signatures. This activity is indicative of credential or crypto wallet theft, as seen in stealers like Dolphin X.
Detects a code editor process (VS Code, Cursor, Windsurf, VSCodium) reading the MachineGuid registry value followed within 3-8 seconds by an outbound network connection to a non-private IP from the same process on the same host, consistent with Open VSX evil-twin extensions harvesting developer machine identifiers and exfiltrating fingerprinting data.
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Detects suspicious processes that repeatedly enumerate installed software via registry Uninstall keys and access sensitive browser data (History, cookies, and web-data files) over a period of multiple days, while simultaneously generating consistent outbound network beaconing. This behavior is indicative of data-stealing malware, such as the Dolphin X 'AI Profiler', which profiles victims based on their application usage and browsing habits.
This rule detects unauthorized access or modifications to hardware watchdog device files (/dev/watchdog, /dev/watchdog0, /dev/misc/watchdog, /dev/FTWDT101_watchdog) on Linux systems. Adversaries may manipulate these files to disable the hardware watchdog's automatic reboot functionality, potentially to maintain persistence or to ensure system stability while performing malicious actions without the risk of an unexpected forced reboot.
This rule monitors for the execution or interaction with macOS native security components, specifically XProtect, XProtectRemediator, and YARA-based detection processes. It flags events related to these tools as potential security telemetry, scanning activities, or remediation actions.
Detects a single unrecognized process combining two or more distinct PRO/ULTIMATE surveillance behaviors: webcam capture via Win32 Media Foundation, screenshot/screen-recorder file drops, and keystroke/clipboard dump file creation, within a short 15-minute window. Excludes known legitimate screen-recording, remote-support, and accessibility software.
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Detects a non-browser process establishing a loopback connection to a Chrome or Edge remote-debugging (CDP) endpoint. Malicious processes may abuse the Chrome DevTools Protocol to drive a headless browser, allowing the attacker to perform browser-based actions or use the browser as a covert C2 channel. This rule monitors for HTTP requests to /json/list/ or /devtools/ on 127.0.0.1 originating from processes other than chrome.exe or msedge.exe.
Detects instances where notepad.exe is executed with a security context (AccountName) that differs from the initiating process's account (InitiatingProcessAccountName). This pattern is consistent with the LegacyHive technique, which utilizes CreateProcessWithLogonW to load a target user's registry hive by spawning a suspended process as that user.
Detects instances where the TOKYOCORE malware (fsociety.exe) attempts to identify or enumerate the presence of security-critical applications, including debuggers, virtual machine guest agents, and antivirus/EDR software. This behavior is indicative of malware attempting to evade analysis or disable security controls.
Detects TriBack Loader variants executing decrypted shellcode through rarely-monitored Win32 callback APIs (InitOnceExecuteOnce, CreateTimerQueueTimer, or dynamically-resolved EtwpCreateEtwThread) instead of the commonly-hooked CreateThread/VirtualAlloc-execute pattern, evading EDR thread-creation hooks after DLL sideloading. InitOnceExecuteOnce and CreateTimerQueueTimer calls only trigger when the same process has also loaded an unsigned DLL via LoadLibrary, correlating the callback-based execution primitive with the DLL-sideloading stage of the TriBack chain and reducing alerts on benign standalone use of these synchronization/timer APIs.
Detects instances where the Microsoft Installer process (msiexec.exe) initiates a network connection to the local IPv4 loopback address (127.0.0.1). This behavior may indicate an MSI custom-action payload attempting to interact with a web browser through the Chrome DevTools Protocol (CDP) to establish a covert command-and-control channel.
This rule detects when a web server process (such as apache, httpd, or php-fpm) modifies or creates a new PHP file within common WordPress directories (plugins or themes). This behavior is often indicative of an attacker attempting to plant a web shell to gain or maintain persistent access to a compromised server.
Detects a suspicious sequence of PowerShell activity involving memory allocation (VirtualAlloc), thread creation (CreateThread), and dynamic API resolution (GetProcAddress or LoadLibrary) within a short time window. This pattern is often indicative of reflective code loading or in-memory process injection, which are techniques used by adversaries to execute malicious code without touching the disk.
Detects instances of 'RuntimeBroker.exe' executing from a directory other than the standard Windows System32 location, specifically when the command line includes a known cryptocurrency wallet address string. This behavior is indicative of potential masquerading or malicious activity where a legitimate Windows system binary name is abused to execute unauthorized commands or facilitate cryptocurrency-related tasks.
This query detects the specific credential access pattern used by Storm-1175 (Medusa ransomware operators).
The threat actor first modifies the registry to re-enable WDigest plaintext credential caching, then performs LSASS memory dumping (via Task Manager, Procdump, Mimikatz, NanoDump, or rundll32 comsvcs.dll techniques).
By correlating the registry change with subsequent suspicious LSASS access activity within an 8-hour window, the hunt maintains high fidelity even if the actor switches between different dumping tools.
The threat actor first modifies the registry to re-enable WDigest plaintext credential caching, then performs LSASS memory dumping (via Task Manager, Procdump, Mimikatz, NanoDump, or rundll32 comsvcs.dll techniques).
By correlating the registry change with subsequent suspicious LSASS access activity within an 8-hour window, the hunt maintains high fidelity even if the actor switches between different dumping tools.
This rule identifies AnyDesk remote access software activity by correlating process execution with network connection events between hosts. It tracks the AnyDesk application attempting to establish a network connection within a 5-minute window, effectively monitoring potential interactive remote access sessions across the network.
Page 31 of 84