Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects use of dd command to wipe disk content for data destruction
Detects access or creation of 'mcp.json' files within the '.amazonq' directory immediately following a 'git clone' operation. This sequence may indicate potential unauthorized access or exfiltration of Amazon Q assistant configurations or cached data associated with development environments.
Detects browser/node subprocesses spawned by AutoGen/Python processes making loopback WebSocket connections to the AutoGen Studio MCP control plane, which is indicative of the AutoJack exploit chain. This rule specifically looks for Python processes associated with 'autogen' or 'autogenstudio' that initiate network connections to loopback addresses on ports 8080 or 8081, often with specific URL paths related to the MCP WebSocket API.
This rule detects the Drun loader, also known as Chromelevator, by identifying its characteristic use of direct syscalls to bypass EDR User Mode API hooking. It specifically looks for 'drun.exe' executing commands containing 'NtAllocateVirtualMemory', 'NtWriteVirtualMemory', or 'NtCreateThreadEx', or loading 'ntdll.dll' while having 'drun.exe' as the initiating process. It also identifies the presence of the 'drunko\drun\x64\Release' folder path.
Detects potential malicious activity including unsigned processes performing cross-process injection into common system processes, suspicious sideloading of 'vulkan-1.dll' from non-standard locations, and execution of unsigned binaries from user-writable directories like Temp, AppData, or ProgramData.
Detects Atlas RAT and ValleyRAT patterns involving process injection into svchost.exe or explorer.exe by an unauthorized process originating from a user-writable directory (e.g., Temp, AppData, Downloads). The rule correlates process injection events with preceding suspicious process launches.
Detects anomalous process behavior characterized by rapid access to multiple sensitive credential files or enumeration of critical environment variables (e.g., cloud, AI, or cryptocurrency wallet keys). This behavior aligns with the mass credential harvesting techniques observed in the IronWorm/Shai-Hulud campaign.
Detects evidence of process hollowing and injection techniques associated with the TA4922 (Silver Fox) threat actor. The rule monitors for three primary indicators: remote thread creation into common target processes (svchost, explorer, etc.) by non-system images, process access with high privilege handles (0x1fffff/0x1f3fff) targeting those same processes, and the execution of system binaries from non-standard filesystem locations.
Detects Node.js processes accessing common shell history files or PowerShell history logs. This behavior is indicative of infostealer malware, such as those targeting developers, attempting to extract credentials or command history from the local filesystem.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Detects SPECTRALVIPER malware attempting process injection into OneDrive.Sync.Services.exe by monitoring for specific sideloading chains (IntelAudioService.exe, Genuine.exe, Updater.exe, AutoCad242.exe) and cross-process indicators like handle access with write permissions or remote thread creation.
Detects SPECTRALVIPER lateral movement activity utilizing the XGU Pivot Shadow technique. The rule monitors for named pipe creation or connection events involving specific host processes (IntelAudioService.exe and OneDrive.Sync.Services.exe) used to orchestrate inter-instance command and control distribution. It also flags potential sideloading behavior where IntelAudioService.exe is executed from an anomalous path within the user profile.
Detects suspected process injection activities characterized by specific OceanLotus sideloading binaries and SPECTRALVIPER-associated target processes. The rule monitors Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) for suspicious cross-process memory access, thread creation, and high-privilege access rights.
Detects instances where the Dllhost.exe (COM Surrogate) process writes executable files, scripts, or library files to common temporary or public directories. This behavior is often associated with COM hijacking, lateral movement, or malicious payload staging by adversaries.
Detects Linux processes running from non-standard directories that exhibit network beaconing behavior, correlated with the concurrent creation or modification of systemd unit files on the same host. This pattern is indicative of a remote access trojan (RAT) or backdoor establishing persistent command-and-control.
Correlates the RMM shell modifying the fDenyTSConnections registry key to force-enable Remote Desktop Protocol for interactive lateral movement.
Detects inbound network connections initiated by common Windows Nearby Sharing processes ('NearShare.exe', 'NearbySharing.exe', 'quickshare.exe', 'NearbyConnectionsService.exe') that occur on non-standard ports, potentially indicating unauthorized or malicious use of these utilities.
This rule detects a specific environmental keying pattern indicative of malware or reconnaissance tools attempting to identify hostnames and domain membership. It monitors for a sequence of activities occurring within a 30-second window: querying the registry for computer name configuration, executing a WMI query for system information, and querying environment variables. The detection further filters for processes that exhibit this behavior without subsequent network activity or child process creation, which is characteristic of 'silent' environmental keying techniques.
This rule detects the launch of a process where its command line contains references to 'RawWNPF' or '\device\rawwnpf'. This pattern is often associated with malicious activity, specifically related to the 'Fishmonger's Arsenal' campaign and the 'SprySocks' malware, which utilize RawWNPF for inter-process communication or other low-level operations. The rule focuses on capturing the principal and target context for further correlation and investigation.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Page 39 of 84