Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects instances where the Windows Update service (wusvc.exe) loads a module or file while simultaneously initiating a process. This behavior is often associated with process injection or the misuse of legitimate system binaries (LOLBins) to facilitate malicious activities by proxying execution through trusted services.
Detects behavior patterns consistent with Remcos RAT, specifically: 1) unauthorized process injection (CreateRemoteThread/ProcessInjection) into common host processes, 2) spawning of browser-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe) from non-standard parent processes, and 3) anomalous outbound network connections from these injected processes over non-standard ports.
Detects suspicious behavior associated with Remcos RAT, including UAC bypass techniques using ICMLuaUtil, process injection into system binaries, and persistence mechanism creation in the Windows registry.
This rule detects the creation of named pipes or mutexes with GUID-like naming patterns by non-system processes. Threat actors frequently use uniquely generated GUIDs for IPC mechanisms like named pipes and mutexes to coordinate between processes or to check for existing infection, often to avoid detection by using non-obvious names.
This rule detects the creation of named pipes or mutexes with GUID-like naming patterns by non-system processes. Threat actors frequently use uniquely generated GUIDs for IPC mechanisms like named pipes and mutexes to coordinate between processes or to check for existing infection, often to avoid detection by using non-obvious names.
Detects instances where a non-browser, non-updater process attempts to perform process injection into common browser executables (Chrome, Edge, Firefox, IE). This behavior is consistent with process hollowing techniques used by Remcos RAT, particularly observed in campaigns such as FortiBleed, to masquerade malicious activity under legitimate browser processes.
This rule detects command line patterns associated with Cobalt Strike Beacon injection, specifically looking for indicators of 'beacon.dll', 'beacon.exe', or 'injection' strings being executed by suspicious parent processes such as explorer.exe, svchost.exe, or winlogon.exe. This activity is indicative of post-exploitation behavior and potential lateral movement or persistence attempts.
Detects cross-process injection (Process Injection) from a specifically identified 'Mixed Reality' process into svchost.exe, followed by suspicious module loads (non-system32 DLLs) within that svchost.exe instance. This behavior pattern is consistent with DcRAT and XenoRAT deployment activities using masquerading or hijacked processes.
This rule detects potential command and control (C2) activity by identifying specific DNS queries to known malicious domains or suspicious network-related processes executing on an endpoint. It flags DNS requests for 'birdeemusic.com' and network connections initiated by processes with names indicative of custom or potentially malicious payloads like '_socket.pyd' or 'Traiolx Custom Utils'.
Detects Node.js processes initiating network connections to remote destination port 2222. This specific port and behavior pattern are known to be used by the Miasma botnet as a fallback C2 channel or for SSH-based remote access when standard communication ports are blocked or monitored.
Detects instances where the Windows Service Host process (svchost.exe) initiates more than five network connections to external (non-private/non-local) IP addresses within a short timeframe. This behavior is often characteristic of command-and-control (C2) activity or beaconing by malicious code masquerading as or injecting into system services.
Detects the execution of Lua interpreter binaries (LuaJit or lua) spawned from a specific process named 'HFY.exe', which is associated with the BeepRAT dropper. The rule also correlates this execution with suspicious raw disk read activity to identify potential in-memory payload loading or malicious interaction with system files.
Detects the creation of a 'linux-process-env.json' artifact by a Node.js process. This file is typically generated by the Djinn Stealer malware as part of its 'collectLinuxProcessEnv' function, which enumerates system process command lines and environment variables from the /proc directory after initial compromise.
Detects LogonUser API used with token impersonation for privilege escalation
Detects malware using excessively long sleep calls to outlast sandbox analysis time
Detects users clicking links from emails containing Canadian payroll lures leading to fake Workday/ADP domains. The rule specifically looks for navigation to URLs matching a regex pattern for Workday, ADP, or payroll-related terms combined with login/auth/secure keywords, and correlates this with browser process events (Chrome or Edge).
Detects the execution of S3 Browser or Office installation executables, followed by network traffic from the same host to known cloud storage or file-sharing sites within a short time window. This behavior aligns with Muddled Libra's method of staging and exfiltrating sensitive data, such as PST files, to adversary-controlled cloud buckets.
Detects the threat actor abusing ntdsutil.exe to create an Install From Media (IFM) dump of the Active Directory database for offline credential cracking.
Detects CastleLoader generating campaign-specific Named Mutexes to prevent multiple instances from running concurrently on the compromised host. The rule specifically looks for mutex creation events initiated by Python processes where the mutex name contains keywords associated with CastleLoader campaigns like 'Castle', 'Background', 'ClickFix', or 'TrapPhone'.
Correlates the use of Impacket scripts (wmiexec.py or smbexec.py compiled variants) executing remote commands via WMI or SMB services on target endpoints. Specifically looks for 'wmiprvse.exe' or 'services.exe' initiating 'cmd.exe' or 'powershell.exe' with command-line arguments indicating local host or administrative share access and redirection to a temporary directory.
This rule detects the execution of suspicious executables ('servertool.exe', 'encrypt.exe') when their command line arguments contain references to common cloud storage services (OneDrive, SharePoint, GoogleDrive, Dropbox, iCloud). This pattern could indicate an attempt to exfiltrate data to cloud storage or encrypt data for impact, potentially as part of a ransomware attack.
Page 40 of 84