Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
This rule detects internal strings associated with the SPECTRALVIPER framework, specifically identifying commands related to the orchestration of lateral movement via named pipes. These indicators suggest active post-exploitation movement using custom pivot links and pipe communication.
This rule detects suspicious activity based on a set of Indicators of Compromise (IOCs) including malicious IP addresses, domains, URLs, and file hashes (SHA256). It monitors network connection events for communication with known malicious IPs, domains, or URLs, and file/process events for the execution or presence of files with known malicious SHA256 hashes.
Detects the use of package management or file integrity monitoring tools (rpm, dpkg, debsums, aide, inotifywait) to verify or interact with critical SSH/PAM configuration files, or the use of inotifywait to monitor SSH configuration access. This behavior may indicate an adversary attempting to verify compromised configurations, check for the presence of backdoors, or monitor security modifications.
Detects instances where the legitimate Windows DllHost.exe process creates or modifies executable or script files in common directories frequently used for staging malicious payloads, such as public folders, temporary directories, and program data. This behavior is often associated with process injection or side-loading techniques where a trusted process is abused to drop secondary malicious files.
Detects high-frequency registry modification activity by Windows script hosts (wscript.exe or cscript.exe) targeting common persistence locations such as Run keys and file association command keys. This behavior is indicative of malicious scripts attempting to establish persistence or hijack system execution flows.
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Detects Remcos RAT using process hollowing to inject into the default browser executable. The loader chain originates from a TuglaInsaatci-masquerading executable and passes through in-memory DLL stages (Optimax.dll / System Optimizer Ultimate.dll) before hollowing the browser. The Remcos_Mutex_Inj mutex confirms successful injection into the browser process.
Detects modifications to COM object InProcServer32 registry keys within the user's registry hive (HKEY_USERS). Attackers often hijack COM objects to achieve persistence by pointing them to malicious DLLs or OCX files. This rule specifically filters out common legitimate paths (Windows directories, Program Files) and known installers to reduce noise.
This rule monitors for file system operations (creation, modification, deletion, or renaming) performed by a Node.js process when interacting with sensitive directories and files associated with web browser extensions and cryptocurrency wallets. This pattern is commonly observed in credential and private key theft activities where malicious scripts attempt to exfiltrate wallet data.
Detects suspicious network connections or process activity targeting Discord webhooks or API endpoints, potentially indicating data exfiltration, command and control, or token validation by malicious actors. The rule specifically looks for non-Discord processes making these connections or using suspicious user agents.
Detects DcRAT malware attempting to perform fileless process injection into svchost.exe from the 'Mixed Reality.exe' process. This behavior leverages NT API calls such as ZwWriteVirtualMemory and NtDuplicateObject, a technique identified in Operation DragonReturn targeting Indian infrastructure.
This rule monitors for processes that repeatedly call GetTickCount64 while also invoking sleep functions, a common technique used by malware to detect virtualized environments or sandboxes by measuring time intervals and stalling execution to bypass short-duration automated analysis. The rule prioritizes alerts originating from non-standard system paths or processes.
Detects unauthorized process injection attempts (specifically ZwWriteVirtualMemory, NtWriteVirtualMemory, WriteProcessMemory, NtDuplicateObject, and ZwDuplicateObject) into 'svchost.exe' from suspicious, non-system parent processes. This detection focuses on behavior associated with DcRAT and Operation DragonReturn, using risk scoring based on file paths and specific known malicious file names.
Detects malicious process, file, and registry activities associated with Hannibal Stealer staging directories and characteristic command-line execution patterns, specifically targeting indicators like CefSharp.BrowsersSubprocess and specific DLL function delegates used in staging.
This rule detects processes attempting to access sensitive Linux system files (/proc/[pid]/environ or /proc/[pid]/cmdline) or the specific file 'linux-process-env.json'. Such actions are indicative of an adversary attempting to perform system discovery, dump process environment variables for secrets, or collect process metadata.
Detects sensitive data exfiltration via git push to remote code repositories
Detects unauthorized attempts to access or dump the memory of the Local Security Authority Subsystem Service (LSASS) process. The rule monitors for cross-process memory access, the use of legitimate Windows tools like rundll32.exe (loading comsvcs.dll) and procdump.exe for dumping LSASS, and detection of Cobalt Strike-specific command-line patterns related to credential theft.
This rule detects processes that load 'amsi.dll' followed by a call to 'VirtualProtectApiCall' with 'PAGE_EXECUTE_READWRITE' memory protection flags within a 30-second window. This behavioral pattern is frequently used in fileless execution techniques to disable Antimalware Scan Interface (AMSI) or to facilitate the execution of shellcode by modifying memory permissions.
Page 37 of 84