Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Identifies Nightspire utilizing bcdedit.exe to modify boot configuration data, explicitly ignoring all boot failures and disabling the Windows recovery environment.
This rule detects attempts to disable Microsoft Defender's real-time monitoring or behavior monitoring features using PowerShell. It specifically looks for `powershell.exe` executing `Set-MpPreference` with the `-DisableRealtimeMonitoring` or `-DisableBehaviorMonitoring` parameters set to `1`, `$true`, or `True`.
This rule detects the installation of a LaunchAgent persistence mechanism on macOS. It specifically looks for the creation of a property list (.plist) file within the '~/Library/LaunchAgents/' directory, combined with the execution of the 'launchctl load' command, which is used to load and activate LaunchAgents. This technique is commonly used by malware, including infostealers, to establish persistence and survive system reboots.
Identifies JScript payloads leveraging wmiprvse.exe to query SecurityCenter2 and enumerate installed endpoint protection products, often associated with SocGholish activity.
Identifies the Python backdoor natively invoking sudo -k -S pwd to silently validate phished credentials against the OS.
Identifies process execution patterns matching the open-source nord-stream tool, abused by the actor to steal GitHub Actions secrets.
Detects PowerShell executing the Add-MpPreference cmdlet specifically excluding the targeted mining executables (RuntimeHost.exe, lolMiner.exe, gminer.exe). This activity is indicative of an attacker attempting to disable or bypass Windows Defender's real-time protection for known cryptomining executables, a common tactic in cryptojacking campaigns.
Correlates the successful establishment of a reverse proxy (ngrok/cloudflared) with an incoming interactive logon event originating from the local loopback, indicating the tunnel is actively being used for malicious purposes such as Terminal Server Phishing.
This rule detects the creation or modification of a scheduled task that uses 'schtasks', 'powershell', or 'pwsh' to launch an executable from user-writable locations such as Temp, AppData, Public, or ProgramData. The command line specifically looks for references to 'adobe', 'acrobat', or 'onedrive' in conjunction with these user-writable paths, indicating potential abuse of legitimate software for persistence or execution of malicious code.
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
This rule detects various suspicious activities related to privilege escalation and access token manipulation. It identifies the enablement of sensitive privileges (SeDebugPrivilege, SeTcbPrivilege, SeImpersonatePrivilege) by non-system processes, suspicious API calls for token impersonation/duplication (ImpersonateNamedPipeClient, DuplicateTokenEx) from non-privileged processes, and the creation of SYSTEM child processes by medium-integrity parent processes. These behaviors are often indicative of an attacker attempting to elevate privileges on a compromised system.
Detects the attacker utilizing SimpleHelp's elevated privileges to create or modify Windows services to ensure persistent remote access independent of the RMM.
Detects MYRA RAT's proc_hide and agent_launcher components masquerading as systemd-userdbd by copying Node.js binary to /usr/lib/systemd/systemd-userdbd and using prctl PR_SET_NAME to overwrite process name and argv[0]. This rule identifies suspicious process activity where a process attempts to impersonate 'systemd-userdbd' by having a matching folder path or command line, but originating from an unexpected location or being associated with known MYRA RAT components like 'agent_launcher' or 'proc_hide', or Node.js.
Detects payloads that check domain membership before executing
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
This rule detects the presence of files or processes with known malicious SHA256 or MD5 hashes. It queries both DeviceProcessEvents and DeviceFileEvents to identify if any file or running process matches the provided list of malicious hashes.
This rule detects the creation or interaction with mutexes that contain both 'asus_' and '_v' in their names. This pattern has been observed in malware associated with ASUS systems, potentially indicating the presence of malicious software attempting to establish a unique identifier on the compromised system.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
This rule detects the creation of mutexes by processes that contain specific keywords in their command line, indicative of the Remcos RAT loader. The keywords include 'Remcos', 'optimize', 'system', 'update', and 'task', combined with mutex creation patterns like 'CreateMutex', 'Global\', or 'Local\'. This behavior is often associated with malware establishing persistence or coordinating its activities.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
Detects Node.js or JavaScript runtimes executing code patterns commonly associated with GlassWorm-style supply chain attacks. The campaign abuses invisible Unicode variation selectors to hide malicious payloads that are decoded and executed through eval(). Investigate execution originating from repositories, package managers, VS Code extensions, or temporary development directories.
Page 49 of 84