Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule retrieves a collection of raw telemetry events including process, file, registry, and network information for a specific host (ex. HostName123). It acts as a diagnostic or hunting query to list the most recent 5,000 activities performed on the specified machine.
Detects the loading of a potentially malicious DLL (WinUpdateHelper.dll) by a process masquerading as or identified as a GTA 5 Online mod menu. This behavior is indicative of DLL injection or side-loading techniques used by gaming cheats/malware to maintain execution context.
Detects the use of the 'EnumSystemLocalesA' API call where the provided callback address points to a non-image backed memory region with 'EXECUTE' permissions. This pattern is indicative of process injection techniques, where an adversary uses an API callback mechanism to execute malicious code within the memory space of a legitimate process.
This rule detects processes command lines containing keywords associated with anti-debugging techniques, such as 'PT_DENY_ATTACH' (a common macOS ptrace flag used to prevent debugger attachment) or generic 'ptrace' and 'sysctl' system calls often leveraged by malware for process introspection or debugger evasion.
Detects anomalous activity where a single process or actor attempts to stop or reconfigure a large number of system services, specifically targeting backup, database, security, and administrative services. This behavior is highly indicative of ransomware or destructive malware activity attempting to disable defenses and data recovery capabilities.
This rule is designed to reconstruct an investigative timeline around a specific device and timestamp identified by an initial network event. It aggregates process execution, file activity, network connections, and alert evidence from the affected device within a specified time window before and after the triggered pivot event, facilitating incident investigation and root cause analysis.
Detects attempts to grant world-writable (0666) permissions to the /dev/kvm device node using chmod or setfacl, or unauthorized (non-root) accounts interacting directly with the device. Such configuration changes are associated with the Januscape (CVE-2026-53359) vulnerability, which allows local users to exploit a shadow MMU use-after-free in the kernel to escalate privileges to root or escape into the host from a virtualized environment.
This rule detects attempts to directly access and modify raw disk devices, a technique commonly used by wiper malware like GigaWiper. It monitors for operations involving raw physical disk paths (e.g., \\.\PhysicalDrive) in conjunction with strings indicative of disk destructive routines such as partition removal, disk creation IOCTLs, or raw drive handle manipulation.
This rule identifies instances where files are written to the system by processes that lack associated administrative notification or acknowledgment command-line patterns. By joining file-write events with process command-line data, it isolates file creation or write operations performed by potentially unmonitored or non-standard administrative processes, which could indicate suspicious file activity.
Detects the creation of a local user account using net.exe or net1.exe followed immediately (within 10 minutes) by that same account being added to a local administrators group on the same device.
Detects known malicious indicators, including C2 domain connections, suspicious file hashes, and specific mutexes often associated with malware execution.
Detects potential token impersonation activities where 'DuplicateTokenEx' or 'ImpersonateLoggedOnUser' functions are used in conjunction with 'explorer.exe'. This pattern is often used by adversaries to perform unauthorized privilege escalation or lateral movement by impersonating the security context of a logged-on user.
Detects the creation of a .plist file in a user LaunchAgents directory within 300 seconds of the process loading the ServiceManagement framework. This pattern is often used by macOS applications to establish persistence or perform background tasks, but can be indicative of malicious activity if associated with unauthorized or masquerading binaries.
This rule detects potentially malicious process injection activities where an unsigned or improperly signed process attempts to perform actions like creating a remote thread or opening a process against critical system processes (explorer.exe, svchost.exe), followed closely by the loading of an unsigned module by those same system processes.
This rule detects the use of the 'EnumTimeFormatsEx' Windows API function by monitoring device events. This API is used to enumerate time formats supported by a locale. While potentially benign, it is frequently used in reconnaissance or anti-sandbox techniques by malware to determine environment settings or to fingerprint the target system.
This rule detects scenarios where an unsigned process, originating from typical staging areas (e.g., Temp, AppData, ProgramData), performs cross-process injection (e.g., process hollowing) into a signed third-party binary. This behavior is indicative of malware loaders attempting to masquerade their execution by hiding within the context of legitimate, signed software.
Detects the creation or connection of a named pipe with a name containing 'RoguePlanet'. Named pipes are a common inter-process communication mechanism that may be abused by malicious software for command and control, lateral movement, or execution, and identifying specific naming conventions associated with known threats is a common detection strategy.
This rule detects the creation of specific mutexes known to be associated with malicious software. Mutexes are often used by malware to ensure that only one instance of the malicious process is running on the host at a time, or to signal presence to other components.
Detects APC-based sleep encryption patterns commonly used by malware loaders like FOLIAGE and AceLdr. The rule identifies suspicious sequences of NtQueueApcThread and NtTestAlert calls targeting the same thread, which are used to automate the in-memory encryption/decryption cycle between C2 callbacks while evading detection by maintaining a quiet user-mode memory profile.
This rule detects processes that perform both memory allocation (VirtualAlloc) and cryptographic random number generation (BCryptGenRandom) within a short timeframe. This combination is highly characteristic of reflective loading or stage-based process injection, where an adversary allocates memory for shellcode and generates keys or seeds for encrypted payloads, often used to evade signature-based detection.
Detects the creation of DLL files in suspicious locations (AppData, Temp, ProgramData, Users\Public, Downloads) that are initiated by specific processes commonly associated with software that might be vulnerable to DLL side-loading, such as Microsoft, Citrix, VMware, or Fortinet binaries, when those processes are executing from outside standard protected directories.
Page 32 of 84