Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects potential process injection behavior associated with the Remcos Remote Access Tool. It monitors for suspicious parent-child process relationships where 'remcos.exe' is identified as a parent of 'svchost.exe' or 'explorer.exe', or where Internet Explorer components (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed in a manner inconsistent with typical Windows system process hierarchies.
Detects a process interacting multiple times with VMware Tools (vmtoolsd.exe) followed by multiple interactions with WMI Restrictions registry keys within a 15-minute window. This behavioral pattern is indicative of potential privilege escalation or environment discovery techniques where an adversary attempts to modify security restrictions while masquerading or interacting with legitimate virtualization management components.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
Detects the use of known named pipes associated with Cobalt Strike post-exploitation frameworks, often used for inter-process communication during beaconing or lateral movement.
Detects suspicious API call sequences indicative of process injection into the 'svchost.exe' system process. The rule monitors for a combination of memory manipulation and thread execution APIs, such as 'ZwWriteVirtualMemory', 'NtDuplicateObject', 'VirtualAllocEx', and 'CreateRemoteThread', when initiated by processes other than legitimate Windows system processes. This is a common indicator of unauthorized code execution or lateral movement.
Detects unauthorized processes attempting to access sensitive browser credential files (Login Data and Cookies) for Chrome, Edge, and Firefox. The rule applies risk scoring based on whether the accessing process is located in suspicious directories (e.g., Temp, Downloads) or if specific indicators associated with the Millenium RAT are present.
Detects Python or Node.js processes accessing files associated with cryptocurrency wallets and browser extension storage. This behavior is indicative of credential or wallet theft, as observed in campaigns such as 'Contagious Interview' which involved threats like BeaverTail and InvisibleFerret.
Detects the usage of the 'SeLoadDriverPrivilege' privilege. This privilege is required to load or unload a device driver.
With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode.
This user right does not apply to Plug and Play device drivers.
If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers.
This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.
With this privilege, the user can dynamically load and unload device drivers or other code in to kernel mode.
This user right does not apply to Plug and Play device drivers.
If you exclude privileged users/admins and processes, which are allowed to do so, you are maybe left with bad programs trying to load malicious kernel drivers.
This will detect Ghost-In-The-Logs (https://github.com/bats3c/Ghost-In-The-Logs) and the usage of Sysinternals and various other tools. So you have to work with a whitelist to find the bad stuff.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
Detects potential process injection attempts involving the Windows Update service (wusvc.exe). The rule monitors for remote thread creation or APC injection activities combined with memory operations (VirtualAlloc or VirtualProtect) that set memory regions to PAGE_EXECUTE_READWRITE, which is a common pattern for running shellcode in a hijacked process context.
This rule detects suspicious process access or remote thread creation events where AdgNsy.exe interacts with WAB.exe (Windows Address Book). Such activity is indicative of potential process injection or unauthorized memory access to steal contact data or manipulate process memory.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
Detects the Glove Stealer (Yuta) payload, identified as winupdate.exe, performing registry queries for virtual machine artifacts such as VMware, VirtualBox, or QEMU strings. This is a common sandbox evasion technique to determine if the malware is running in an analysis environment.
Detects suspicious cross-process activity, such as process hollowing, where an unsigned or unusually located process (e.g., in AppData, Temp, or Downloads) attempts to inject code into legitimate Windows system processes like svchost.exe or explorer.exe.
Detects registry modifications (specifically key creation or value setting) initiated by QEMU system binaries or their child processes, focusing on paths commonly associated with persistence (Run keys) or general software configuration storage.
Detects node.exe accessing Chrome browser extension storage directories associated with popular cryptocurrency wallets. This activity is indicative of the Miasma/MYRA infostealer (peer-math.js) attempting to harvest encrypted wallet vaults from developer workstations, as seen in the Polymarket Trap supply chain attack.
This rule identifies potentially malicious activity where a process, which has been dormant on the system for at least 7 days since its initial start, suddenly performs a high volume (more than 50 events in 60 seconds) of file creation or modification events. This behavior pattern is often indicative of ransomware encryption activities, where malware lies dormant before initiating a rapid, destructive encryption cycle.
Detects outbound network connections from node.exe or npm related processes to domains associated with the Polymarket Trap supply chain attack. This detection highlights the malicious behavior of compromised npm packages that initiate C2 communication at import time, bypassing standard postinstall security scripts.
Detects Node.js or npm processes that access multiple SSH-related files within a short timeframe while also establishing external network connections, which is consistent with credential exfiltration patterns.
Detects suspicious kernel-level activity following a potential privilege escalation event on Linux systems. The rule monitors for unauthorized kernel module loading (via non-standard paths) or direct write access to /dev/kmem, which is indicative of rootkit installation or kernel-level memory manipulation.
Page 36 of 84