Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule monitors for processes named 'setup.exe' executing from user-writable directories (e.g., AppData, Downloads, Temp) that load unsigned or non-Microsoft DLLs from the same suspicious directories. This pattern is commonly associated with DLL side-loading or malicious installation attempts where a process attempts to load illegitimate code from local user space.
This rule detects suspicious process command lines that indicate potential tunneling activity. It looks for commands containing 'tunnel', '--url', and '--logfile', while excluding legitimate 'cloudflared.exe' processes. This pattern is often used by adversaries to establish covert communication channels or exfiltrate data.
Detection of the ark.x64.dll performing reflective code loading of the Cobalt Strike beacon into memory.
Identifies PowerShell utilizing ProcessHollowing.Execute to hijack MsBuild.exe.
Detects rapid screenshot capture and image encoding by a non-support process for live remote viewing, indicative of a Remote Access Trojan (RAT) like Banana RAT. The rule specifically looks for process command lines containing functions related to screen capturing (CopyFromScreen, BitBlt, Graphics.CopyFromScreen) and image encoding/streaming (JPEG, Bitmap, stream, frame, socket).
Detects potential Reynolds ransomware activity by identifying processes that enumerate a significant number of security software processes (EDR/AV) using `CreateToolhelp32Snapshot` or similar process creation events. This behavior is often a precursor to security software termination or evasion.
Detects the creation or modification of suspicious macOS Launch Agents or Launch Daemons, specifically looking for patterns associated with the 'macOS.Gaslight' malware (e.g., 'com.apple.system.services.activity') or the creation of Launch Agents in user directories by processes masquerading as browser renderers (indicated by '--type=renderer' in the command line, excluding legitimate browsers). This rule aims to identify persistence mechanisms used by malware.
Detects G2M.exe making external connections shortly after loading a local g2m.dll, providing behavioural confirmation that the trusted binary has been repurposed. This rule specifically looks for network activity from G2M.exe when its process image path is located in suspicious directories like AppData, Temp, Downloads, ProgramData, or Users\Public, indicating potential abuse of a legitimate application.
Detects activity associated with VAPT (Vulnerability Assessment and Penetration Testing) frameworks, specifically looking for marker strings in process command lines and known VAPT malware names in file and process events. This rule aims to identify potential privilege escalation attempts or the presence of VAPT tools on a system.
Identifies untrusted AutoHotkey (AHK) scripts executing under renamed benign system signatures, specifically masquerading as Realtek components.
Detects the execution of ClickOnce application reference shortcuts (.appref-ms) which point to malicious remote URIs. This rule specifically looks for process command lines containing '.appref-ms' and initiated by 'explorer.exe'.
Detects the anomalous execution or loading of files named "Subtitles" which actually contain decrypted .NET assemblies, specifically looking for command lines containing "Packages\Microsoft.WindowsSoundDiagnostics\Subtitles". This pattern is associated with AsyncRAT malware.
Identifies the browser extension utilizing the native messaging bridge to launch execution commands outside the sandbox, specifically looking for Microsoft Edge processes initiating commands containing 'open_native_messaging'.
This rule detects suspicious process activity indicative of ransomware, specifically Prinz Eugen. It identifies processes named 'servertool.exe', 'encrypt.exe', or 'lock.exe' that interact with common user directories ('Users', 'OneDrive', 'Downloads', 'Documents') and are observed at least 3 times within a 15-minute window on a single device, suggesting a recursive encryption pattern.
Parses bitsadmin commands executing arbitrary HTTP requests and dropping .exe or .dll files into system paths.
Detects WinSCP command-line use that performs scripted uploads, synchronisation, or non-interactive transfer, which could indicate data exfiltration or automated file transfers.
Detects the addition of broad exclusion paths to Microsoft Defender, specifically targeting drive roots, administrative shares, or common working directories. This activity is often associated with ransomware, such as the 'Gentlemen Ransomware', to evade detection.
This rule detects suspicious activity involving a high volume of file compression using common archiving tools like 7-Zip and WinRAR. Adversaries often compress data before exfiltration or for staging purposes to reduce size and potentially evade detection. A high count of compression events within a short timeframe (1 hour) by a single account could indicate malicious activity.
Detects the execution of the 'squid.exe' process with command line arguments that may indicate memory manipulation or buffer overflow attempts. These arguments include terms like 'malloc', 'free', '4096', '4KB', 'buffer', and 'MEM_'. This could be indicative of an attacker attempting to exploit vulnerabilities or perform malicious memory operations within the Squid proxy server.
Detects potential exploitation attempts related to the Squidbleed vulnerability by monitoring 'squid.exe' process command lines for indicators of ASAN (AddressSanitizer) heap overflow reports. This includes keywords like '==', 'ERROR', 'ERROR SUMMARY', and 'SUMMARY', which are often present in ASAN crash reports.
Detects suspicious process command lines associated with WebRTC, STUN, TURN, or ICE protocols when initiated by common web browsers (Chrome, Firefox, Opera) and having a parent process identified as 'Remcos'. This behavior could indicate the Remcos RAT attempting to establish peer-to-peer communication or exfiltrate data.
Page 51 of 84