Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects the creation of synchronization objects with names matching specific patterns often associated with malicious setups or obfuscated file naming conventions. It joins these object creation events with process rollup data to provide context on the originating process, including command line arguments and file paths.
Detects the payload stripping extended properties (xattr -c) to bypass macOS Gatekeeper, followed by immediate execution of the stripped file. This behavior is associated with the 'ClickFix' campaign.
Detects the use of 'attrib.exe' to modify file attributes to hidden and system for a file named 'Win.Kernel_Svc', which is indicative of the XWorm malware attempting to conceal its payload.
Detects the execution of the Squid proxy application with command line arguments that may indicate its use for malicious proxying or tunneling activities. This includes arguments related to safe ports, connection types (CONNECT, PORT, PASV), specific port numbers (21), and outgoing address configurations.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
This rule detects command line patterns associated with Cobalt Strike Beacon injection, specifically looking for indicators of 'beacon.dll', 'beacon.exe', or 'injection' strings being executed by suspicious parent processes such as explorer.exe, svchost.exe, or winlogon.exe. This activity is indicative of post-exploitation behavior and potential lateral movement or persistence attempts.
Detects the use of rclone, MEGAcmd, or common command-line tools like curl/wget to transfer data to known cloud storage endpoints (mega.nz, gofile.io, anonfiles, pixeldrain) when initiated from non-standard system paths (i.e., not 'C:\Program Files'). This rule aims to identify data exfiltration activities, particularly those associated with the Qilin threat actor's double extortion tactics.
This rule monitors for processes executing from within the 'AppData\Roaming\Traiolx Custom Utils\' directory that subsequently load specific DLLs (7z.dll, normaliz.dll, or user32.dll). This behavior pattern is indicative of potential malicious activity, such as side-loading or execution of masqueraded binaries.
Detects network connections to known blockchain and crypto-related domains (trongrid.io, aptoslabs.com) initiated by common programming and development tools (node, Code, python, python3). This pattern is often associated with the deployment of unauthorized cryptocurrency miners, blockchain interaction scripts, or malicious actors leveraging development environments.
This rule detects potentially malicious clipboard data access by scripting engines (Python, Node.js) and command-line utilities (xclip, xdotool, PowerShell). It monitors for specific API calls, module imports, or command arguments that signify reading or interacting with the system clipboard, often used by malware for credential theft or data exfiltration.
Detects the execution of the Squid proxy process with command-line arguments indicating the use of FTP parsing components. This could be indicative of a vulnerability exploitation attempt or unusual configuration.
Detects Python or Node.js interpreter processes accessing sensitive files related to cryptocurrency wallets and browser extensions, a behavior consistent with information-stealer malware such as InvisibleFerret used in the Contagious Interview campaign.
Detects instances where common scripting engines such as node.exe, python.exe, or related variants access known web browser credential storage files (e.g., Login Data, Cookies, logins.json). This behavior is characteristic of info-stealing malware, notably identified in the BeaverTail and InvisibleFerret malware families used during the 'Contagious Interview' campaign to exfiltrate sensitive browser data.
Identifies anomalous enumeration of local network sessions via cmd.exe using the 'net session' command, a technique observed during EtherRAT's post-exploitation phase for lateral movement reconnaissance.
Identifies the SFX module bdzsfx.x64.sfx interacting with security providers to disrupt runtime telemetry.
Detects registry queries for common virtualization-related artifacts (e.g., VMware, VirtualBox) performed by specific suspicious processes. This behavior is indicative of sandbox or virtual machine evasion techniques used by malware to detect if it is running in an analysis environment before executing its malicious payload.
Detects a banking trojan invoking SendInput, mouse_event, keybd_event, or related APIs to control the victim session. The rule specifically looks for process events where the filename matches common RAT names (banana, client, update, service) and the command line contains API calls related to input injection.
EchoCreep Decodes AES-CBC Base64 Command
Cortex XDR
Detects a non-browser process combining base64 decoding with AES-CBC processing before launching shell commands. This behavior is indicative of the EchoCreep malware, which uses sophisticated obfuscation techniques to hide its command and control communications.
Detects the scope-squatted package preinstall script executing the Claude CLI to harvest the developer's authenticated session email. Specifically, it looks for 'node.exe' as the initiating process, executing a process named 'claude' or a process with 'auth' and 'status' in its command line.
Identifies the Potentially Unwanted Program (PUP) forcibly modifying Chrome or Edge extension directories or registry preferences to inject malicious stealers. This rule specifically looks for file creation or modification events within browser extension folders, initiated by common installer/updater executable names.
Detects vLLM performing unauthorized system reconnaissance by executing common system information discovery commands such as 'whoami', 'id', 'uname', 'hostname', 'ifconfig', and 'ip'. This activity is indicative of an attacker attempting to gather information about the compromised system.
Page 48 of 84