Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects potential process injection attempts targeting svchost.exe by monitoring for specific memory manipulation and object handling APIs (ZwWriteVirtualMemory, NtDuplicateObject, ZwQueryAttributesFile). Also monitors for a synthetic process event containing a specific hardcoded command line string associated with potential malicious setup activity.
Detects DcRAT loader attempts to disable AMSI scanning by patching the AmsiOpenSession function in amsi.dll memory using VirtualProtect, a technique associated with malware such as DcRAT and historical campaigns like Operation DragonReturn.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
This rule detects the execution of a process named 'systemd-userdbd' that is either spawned from suspicious parent contexts (such as Node.js or npm, or from locations like /tmp/, /var/tmp/, node_modules, or .peer/) or is running from a non-standard file path. This behavior is indicative of malware, specifically the MYRA RAT, which uses this process name as a masquerade to evade detection.
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
Detects instances where Node.js, npm, or npx processes attempt to access sensitive configuration files including AWS credentials, Claude API keys, or .env files, which is a common behavior of the Miasma infostealer used in supply chain compromise campaigns to harvest cloud and AI secrets.
Detects the macOS.Gaslight Python collection module compressing staged data into a ZIP archive (collected_data.zip) using shutil.make_archive for subsequent exfiltration over Telegram C2. The module calls compress_output() which archives browser credentials, keychain, terminal history, and process snapshots into temp/collected_data.zip.
Detects instances where CefSharp.BrowsersSubprocess.exe or processes within the SCef.WindowsAdapter folder load the iphlpapi.dll library, combined with command-line arguments indicative of network configuration discovery, such as retrieving MAC addresses, BSSIDs, or default gateways. This activity suggests potential reconnaissance by an application or a process masquerading as a browser component.
Detects the execution of commands used to disable the algif_aead module to mitigate CVE-2026-31431 (Copy Fail).
Detects processes associated with Prinz Eugen ransomware attempting to access shared memory, mailslots, named pipes, or create file mappings. This behavior is indicative of inter-process communication mechanisms often used by malware for various purposes, including data exfiltration, command and control, or privilege escalation.
Detects regsvr32.exe loading DLLs from user-writable directories such as Temp, AppData, ProgramData, Downloads, Desktop, and Public. Legitimate DLL registration runs from System32 or Program Files - execution from these paths indicates LOLBin abuse for proxy execution, DLL sideloading, or defense evasion commonly used to launch malware payloads.
Detects a loop attempting 'net use' against multiple IPC$ shares and recording reachable SMB hosts. This activity is indicative of network reconnaissance, specifically looking for accessible shares on remote systems within a subnet.
Detects a process launched from an OpenClaw skill enumerating debugger, packet-capture, process-monitoring, sandbox, or virtual-machine utilities before payload execution. This behavior is indicative of malware attempting to identify analysis environments.
Identifies the preinstall.js script abusing the local GitHub CLI to query the primary email address via JSON parsing. This detection specifically looks for 'node.exe' initiating a process that executes 'gh' (GitHub CLI) with the 'api user --jq .email' command-line arguments, indicating an attempt to extract the user's email.
Identifies processes executing Base64 decoded commands where the parent script recently communicated with an AI endpoint, representing prompt-injected or AI-generated payloads.
Hunts for the stealer exfiltrating compressed host profiling information (sw_vers, system_profiler) via HTTP POST using curl.
This rule detects suspicious activity related to the Sapphire Sleet malware, specifically its technique of traversing Google Chrome or Brave profile directories to extract and compress Web3 wallet extensions. It correlates file access events on specific browser extension paths with process events where archiving tools like 'zip' or 'tar' are executed.
Detects a sequence of sensitive Windows API calls (AllocateAndInitializeSid, CheckTokenMembership, or ShellExecuteW with runas) occurring within the same process on a host. This behavior is indicative of privilege escalation attempts or unauthorized token manipulation, often observed in malicious processes attempting to elevate privileges or verify token permissions.
Detects the creation or access attempt of the specific named mutex 'Global\ShitSetupOn26126k'. This mutex is used by the DcRAT and Millenium RAT malware families as an anti-sandbox and anti-reinfection check; if the process detects this mutex exists, it self-terminates to avoid analysis or multiple infections.
This rule detects the installation of low-level keyboard hooks (WH_KEYBOARD_LL or WH_KEYBOARD) using API calls. It specifically monitors for processes attempting to hook keyboard input from user-writable directories (e.g., Temp, Downloads, AppData) or using unsigned/invalidly signed binaries, which is a common technique used by malware like keyloggers for credential theft.
Detects bulk process enumeration performed by suspicious or masquerading processes using Windows system APIs (CreateToolhelp32Snapshot, NtQuerySystemInformation, ProcessSnapshot). This activity is often associated with post-compromise reconnaissance and information gathering, specifically seen in Millenium RAT variants.
Page 47 of 84