Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects potential credential capture by monitoring for unauthorized usage of Windows API functions associated with keyboard hooking, such as SetWindowsHookEx and GetAsyncKeyState. It specifically flags suspicious process activity, such as the execution of the 'Pillager' tool or processes interacting with specific suspicious file paths, while excluding common legitimate processes that routinely perform keyboard hooking.
Detects techniques used to perform credential dumping from the LSASS process memory, including the use of comsvcs.dll via rundll32, the procdump utility, and unauthorized process handle requests (OpenProcess) targeting lsass.exe.
Detects potential SharkLoader shellcode injection patterns, where a suspicious executable (e.g., sideloaded SystemSettings.exe) from specific non-standard directories initiates cross-process memory operations like VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread into critical system processes such as svchost.exe or explorer.exe.
Detects processes invoking common Windows API functions typically used to detect the presence of debuggers (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess, GetTickCount) when these processes are executed from suspicious locations (such as specific AppData subdirectories) or masquerading as system binaries (SystemSettings.exe). These behaviors are commonly used by malware to detect analysis environments or debuggers and alter execution flow to evade detection.
Detects the loading of 'SystemSettings.dll' by 'SystemSettings.exe' when the process is launched from an unusual path, specifically within the user's AppData directory. This behavior is indicative of potential DLL sideloading, where an attacker attempts to masquerade as or hijack the execution flow of a legitimate Windows utility by placing a malicious DLL in an untrusted, user-writable directory.
Detects the execution of a process named 'wusvc.exe' located outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. Attackers often rename malicious binaries to look like legitimate system services (such as Windows Update service) to evade detection and maintain persistence.
Detects the Windows Update service (wusvc.exe) or any process with environment strings (command line or folder path) containing sandbox-related keywords such as 'sandbox', 'malware', 'virus', or 'sample'. This behavior is characteristic of malware attempting to detect if it is running within an analysis, sandbox, or virtual machine environment.
This rule detects instances of the SNOWLIGHT dropper (wusvc.exe) initiating or interacting with processes identified as common debugger or system analysis tools. The rule monitors for the simultaneous presence of wusvc.exe and a blacklist of tools like processhacker.exe, ida.exe, and wireshark.exe within a 120-second window on the same device.
Detects instances of the 'wusvc.exe' process (associated with the Snowlight malware) enumerating known security, analysis, and debugging tools on a compromised host. The rule monitors for the co-occurrence of this process and identified security tool processes within a short timeframe on the same device.
Detects unauthorized modifications to the Winlogon registry keys 'Shell' and 'Userinit'. These keys are commonly abused by adversaries to achieve persistence by executing malicious binaries or scripts upon user logon. The rule excludes modifications by the SYSTEM account and flags deviations from standard Windows configuration values (e.g., non-standard Shell values, or Userinit values that do not point to the expected system file).
Detects execution and suspicious memory operations by 'wusvc.exe', a known dropper for the SNOWLIGHT malware. The rule monitors for direct syscalls (NtAllocateVirtualMemory, NtProtectVirtualMemory) and remote thread injection attempts (CreateRemoteThread, QueueUserApc) typical of evasion techniques used to bypass EDR hooks and execute payloads. It further filters for anomalies based on execution path (e.g., Temp, Downloads) or specific process file hashes.
AD Snapshot Is Compressed with 7zr
Cortex XDR
Detects the use of 7-Zip (7zr.exe) to compress Active Directory snapshot files (result.dat or snapshot) into an archive with a specific compression level (-mx=5). This activity could indicate an adversary staging data for exfiltration.
Detects the SNOWLIGHT dropper attempting to detect analysis or security tools by rapidly enumerating common debugging, profiling, and analysis executables (such as x64dbg, IDA Pro, Wireshark, Process Hacker, etc.). The rule triggers when a single process queries at least 3 distinct blacklisted tool names more than 5 times within a 1-minute window, a characteristic behavior used to identify and evade analysis environments.
Detects the use of specific Windows API functions or terms commonly associated with process hollowing, code injection, or advanced process manipulation within command-line strings. The monitored functions include NtCreateWaitCompletionPacket, NtAssociateWaitCompletionPacket, RtlGetCurrentPeb, ProcessPrng, and PowerRegisterSuspendResumeNotification.
Detects potential ransomware activity (specifically VILE) that utilizes direct NT system calls and specific API interactions (e.g., NtCreateWaitCompletionPacket) to bypass user-mode EDR hooks. The rule monitors for a combination of suspicious process activity, unexpected image loads of ntdll.dll, and specific API calls often associated with evasion techniques in Go-based binaries.
Detects cross-process activity (such as process injection or handle access) initiated by the Windows Update service (wusvc.exe) where the executable is not digitally signed by Microsoft Corporation. This behavior is highly suspicious as the legitimate wusvc.exe should always be signed by Microsoft, and this may indicate process masquerading or a compromised service binary.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution.
Detects use of Impacket tooling (wmiexec, psexec, smbexec, atexec, secretsdump) for lateral movement and remote service execution, as observed in Operation Escaneo attributed to MexicanMafia targeting LatAm critical infrastructure. The rule identifies Impacket activity through process command lines, service installations, and network connections to SMB (port 445) and DCOM (port 135) from Python or Impacket-related executables.
Detects suspicious command-line activity involving 'cmd.exe' executing 'ping' to the loopback address (127.0.0.1) combined with an ampersand ('&') and a file deletion command ('del', 'delete', or 'erase'). This pattern is often indicative of an attacker attempting to test network connectivity or bypass security controls while also performing cleanup or destructive actions.
Detects the macOS script reading a downloaded text file, decoding the Base64 contents, and piping it to execution.
Page 43 of 84