Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects potentially malicious process discovery or memory access behavior. It triggers when processes perform frequent calls to common process enumeration APIs (e.g., CreateToolhelp32Snapshot, NtQuerySystemInformation) or when any process gains access to the Windows Update service (wusvc.exe), which is often used as a target for process injection or hollowing.
Detects the execution of wusvc.exe (Windows Update service) from non-standard locations, specifically the user Downloads folder or locations other than the authorized C:\Windows\System32\ directory. This pattern is commonly used to masquerade malicious payloads as legitimate system services.
Detects the SNOWLIGHT dropper process (masquerading as wusvc.exe) dynamically loading advapi32.dll and invoking GetUserNameA via hash-based API resolution. This behavior is indicative of malware performing system owner/user discovery.
This rule detects suspicious activity involving the loading of amsi.dll in conjunction with memory protection changes (VirtualProtectApiCall) that often signify an attempt to patch or disable the Antimalware Scan Interface (AMSI) in memory. It specifically monitors for remote thread creation, memory protection modifications involving 'AmsiScanBuffer', and executable memory page allocation within 30 seconds of loading amsi.dll, excluding known trusted Microsoft processes.
This rule detects potential malicious activity by tracking the aggregation of multiple distinct persistence mechanisms on a single host. It triggers when a single process is associated with at least four unique types of persistence-related events, such as scheduled task registration, startup folder file creation, registry run key updates, Winlogon configuration changes, IFEO modifications, or service registration.
Detects the GT_NET or Gt_net executable calling the VirtualProtectEx API to modify memory permissions to PAGE_EXECUTE_READWRITE. This behavior is a common indicator of process injection, where an attacker modifies memory to execute shellcode or malicious payloads within the context of a legitimate process.
Detects suspicious combinations of API calls and system monitoring often used by the VILE ransomware family to evade debuggers, sandboxes, and automated analysis environments. This includes detecting the registration of Vectored Exception Handlers (VEH), memory checks for debugging artifacts, reading the Process Environment Block (PEB), and monitoring for file restoration activities via ReadDirectoryChangesW.
Detects indicators of VILE ransomware activity, specifically identifying attempts to suppress Event Tracing for Windows (ETW) via NtTraceEvent patching, alongside execution of low-level NT syscalls and the presence of identified VILE-associated artifact files (e.g., .ico, .zip, .json).
Detects the SNOWLIGHT dropper process (wusvc.exe) identifying and enumerating various security, analysis, and debugging tools on the system to evade detection.
Detects attempts to perform a container escape via the docker cp command by abusing path traversal vulnerabilities or suspicious file write operations performed by the Docker daemon to the host filesystem outside of standard container paths, often associated with symbolic link extraction exploits.
This rule detects the execution of processes containing the string "zuidrt" or the execution of 'mshta.exe', followed by a network connection to the known XenoRAT C2 IP address 185.235.137.106. This correlation aims to identify XenoRAT payload execution and subsequent communication with its command and control server, as observed in Operation XENOFISCAL.
Detects Hannibal Stealer-related process injection patterns involving the use of legitimate Windows binaries (sppextcomobj.exe, slui.exe) spawned by rundll32.exe, or specific child-process relationships, correlated with directory paths associated with CefSharp.BrowsersSubprocess or SCef.WindowsAdapter, which are indicative of malware staging.
This rule detects potential registry enumeration activities targeting sensitive Windows system keys ('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' or 'HKLM\HARDWARE\DESCRIPTION') that are associated with the execution of suspicious processes named 'systemki.exe' or 'sysklnd.exe'. These filenames are consistent with historical observations of the Sauron (also known as Strider) malware framework.
BirdCall Collects Clipboard Content
Cortex XDR
Detects an unsigned process using clipboard-related command-line or module indicators before writing local collection data. The rule specifically looks for process image names containing "bird", "call", "update", or "service" (case-insensitive) combined with command-line arguments or module indicators related to clipboard access such as "clipboard", "GetClipboardData", "OpenClipboard", or "CF_UNICODETEXT".
Detects modifications to the `/Library/Preferences/com.apple.loginwindow.plist` file on macOS. This file can be abused by adversaries to establish persistence by configuring login hooks or other autostart mechanisms.
Detects a single parent process launching registry or PowerShell queries for both Defender PUA policy and Windows product edition within a ten-minute window. This behavior can indicate malware attempting to understand its environment and potentially evade detection or tailor its execution.
Detects the execution of a 64-character hex-named executable using the 'i=' parameter for potential process injection or tracking, indicative of Makop Ransomware activity.
Detects rapid, automated execution of sequential reconnaissance commands (whoami, nltest, net, systeminfo) within a 1-minute window, indicative of potential SocGholish activity or similar automated reconnaissance.
Identifies execution of the primary Hindi-named loader ('कर विवरण') used in the TaxShadow campaign.
This rule detects suspicious network connections, process activity, and file events related to Node.js or systemd-userdbd, potentially indicating C2 communication or the presence of malicious tools. Specifically, it looks for outbound TCP connections to port 4444, process command lines containing shell commands or 'node-pty', and file paths/names associated with 'apintergrationpost' or 'node-pty'.
Detects the Matanbuchus loader downloading and writing the AstarionRAT executable payload to disk in the AppData directory, specifically when initiated by rundll32.exe.
Page 53 of 84