Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects the creation of mutexes by processes that contain specific keywords in their command line, indicative of the Remcos RAT loader. The keywords include 'Remcos', 'optimize', 'system', 'update', and 'task', combined with mutex creation patterns like 'CreateMutex', 'Global\', or 'Local\'. This behavior is often associated with malware establishing persistence or coordinating its activities.
Detects a user mounting a deceptive .dmg file (e.g., posing as a crypto wallet or developer tool) resulting in the immediate execution of a hidden binary. The rule specifically looks for 'hdiutil attach' followed by a process execution from within a mounted volume that matches a common application or shell script path.
Identifies the Go payload using bcdedit to disable automatic startup recovery and ignore boot failures, which is a common technique used by ransomware to prevent system recovery.
Detects files retaining the MOTW (Zone.Identifier) executing successfully because their Fox Tempest signature bypasses SmartScreen warnings.
Detects unauthorized processes monitoring the system clipboard and replacing content with cryptocurrency addresses. This behavior is indicative of clipboard hijacker malware or banking trojans (such as Rokarolla) attempting to redirect funds by modifying the address in the clipboard.
Hunts for curl or wget pulling secondary stage obfuscated payloads from Pastebin or GitHub Gists initiated by developer tools.
This rule detects potentially malicious PowerShell behavior by correlating two events within a 5-minute window: first, a PowerShell process reading files from the C:\ProgramData directory, and second, the same process invoking sensitive memory manipulation APIs (e.g., NtAllocateVirtualMemory, NtCreateThreadEx, GetDelegateForFunctionPointer). This pattern is commonly associated with fileless malware loaders or staging scripts that read encrypted payloads from disk and execute them in memory.
Detects unauthorized processes monitoring the system clipboard and replacing content with cryptocurrency addresses. This behavior is indicative of clipboard hijacker malware or banking trojans (such as Rokarolla) attempting to redirect funds by modifying the address in the clipboard.
Maps the macro executing tasklist repeatedly to monitor whether code.exe has stopped running, indicating the victim completed authentication.
Detects outbound network connections initiated by common AI agent runtime processes (Python, Node.js, OpenClaw) to external destinations that are not identified as known AI service providers, specifically focusing on non-standard ports or the use of WebSocket protocols. This behavior may indicate an AI agent being used for unauthorized data exfiltration, command-and-control communication, or interaction with an unverified external service.
This rule detects suspicious inter-process communication (IPC) attempts using WM_COPYDATA messaging, where processes (often script interpreters or unsigned binaries) interact with high-value GUI-based applications (like browsers or shell environments). This pattern is a common indicator of process injection techniques, such as hijacking existing Windows callbacks to execute code within the context of a target process.
Detects cross-process activity where a non-Microsoft signed process or an unsigned process attempts to inject code into high-value Windows system processes, such as lsass.exe, explorer.exe, or svchost.exe. This activity is indicative of malicious code injection or process hollowing, often used to achieve privilege escalation or persistent stealth.
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory.
Detects cross-process activity where a non-Microsoft signed process or an unsigned process attempts to inject code into high-value Windows system processes, such as lsass.exe, explorer.exe, or svchost.exe. This activity is indicative of malicious code injection or process hollowing, often used to achieve privilege escalation or persistent stealth.
Detects unsigned or non-Microsoft processes attempting to access sensitive system process memory (lsass.exe, winlogon.exe, services.exe) or processes attempting to enable SeDebugPrivilege, which are common indicators of credential dumping or process injection attempts.
Detects the use of the Windows attrib.exe utility to set the hidden file attribute (+h) on files. Adversaries often use this technique to hide malicious files, scripts, or directories from standard file browsing tools to evade detection. The rule includes an exclusion for processes signed by Microsoft to reduce noise from legitimate system operations.
Detects cross-process access (such as memory read/write) by an unsigned process against sensitive system processes (e.g., lsass.exe, svchost.exe, explorer.exe). This activity is often a precursor to credential dumping, process hollowing, or other forms of process injection used by malicious actors to achieve persistence or privilege escalation.
Detects cross-process access (such as memory read/write) by an unsigned process against sensitive system processes (e.g., lsass.exe, svchost.exe, explorer.exe). This activity is often a precursor to credential dumping, process hollowing, or other forms of process injection used by malicious actors to achieve persistence or privilege escalation.
This rule detects suspicious process activity indicative of the Remcos RAT attempting to extract credentials from web browsers like Chrome, Firefox, or Opera. It specifically looks for `Remcos` related processes initiating browser executables with command-line arguments often associated with credential dumping or unusual browser behavior, such as `--allow-file-access`, `--no-sandbox`, `--headless`, or referencing a 'profile'.
Detects Hannibal Stealer-related process injection patterns involving the use of legitimate Windows binaries (sppextcomobj.exe, slui.exe) spawned by rundll32.exe, or specific child-process relationships, correlated with directory paths associated with CefSharp.BrowsersSubprocess or SCef.WindowsAdapter, which are indicative of malware staging.
This rule detects processes that contain cryptocurrency-related keywords in their command line, specifically when initiated by common Windows executables like cmd.exe, powershell.exe, notepad.exe, or notepad++.exe. This behavior can indicate a ransomware infection attempting to display payment instructions or interact with cryptocurrency wallets.
Page 50 of 84