Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Identifies AstarionRAT establishing persistence by writing itself into the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, specifically looking for an executable in an AppData path, initiated by rundll32.exe.
Correlates the initial Fake Tech Support lure with the dropping of the secondary Havoc .exe or .dll payload into C:\Users\Public or %AppData%. This rule detects the creation of executable or DLL files in common public or user application data directories, specifically within 'C:\Users\Public' or 'C:\Users\<username>\AppData\Local', and correlates this file creation with a process that has '--kiosk' in its command line, which is often associated with browser-based lures.
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
Detects attempts to forcefully stop or disable the Windows Defender service (WinDefend) using either 'sc.exe stop WinDefend' or 'powershell.exe Stop-Service WinDefend' commands. This activity is indicative of an adversary attempting to impair defenses.
Detects processes associated with Remcos RAT attempting to perform activity logging or idle time monitoring by looking for specific command-line arguments related to window and idle state functions, combined with process names or command lines containing 'Remcos'.
Detects the creation or referencing of 'lopa.txt' which the Seedworm threat group uses to save stolen passwords. This rule identifies processes that interact with 'lopa.txt' either through their command line arguments or by directly accessing a file with that name.
This rule detects the creation or manipulation of mutexes by processes that contain keywords associated with the Remcos RAT (Remote Access Trojan). Specifically, it looks for command-line arguments containing "Remcos_Mutex_Inj", "Remcos_Mutex", "mutex", or "CreateMutex". This activity can indicate the presence or execution of Remcos RAT on a system, as mutexes are often used by malware for single-instance enforcement or inter-process communication.
Detects the MYRA RAT using memfd_create and fexecve to execute a Rust payload entirely in memory without writing an executable to disk, as observed in the Operation Friday Harvest npm supply chain campaign. The rule looks for process events where the action type indicates process creation, memory allocation, or process access, or where the FolderPath starts with '/proc/' and contains '/fd/'. It specifically targets initiating processes named 'node' or 'npm' or those with command lines associated with npm post-installation scripts. Further filtering is applied to FolderPaths matching the '/proc/\d+/fd/\d+' regex or ProcessCommandLines containing 'memfd_create' or 'fexecve', or FolderPaths containing 'memfd'.
This rule detects suspicious process command lines that indicate the extraction of steganographically hidden payloads, potentially associated with the Remcos RAT. It specifically looks for processes with 'GST' in their name or initiating process file name, combined with keywords related to bitmap or image resource manipulation in the command line.
Detects broad hollowing logic involving injected Microsoft utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, aspnet_compiler.exe, MSBuild.exe) communicating over non-standard web command and control ports (8443, 5443, 8041). This rule specifically excludes common initiating processes like cmd.exe, powershell.exe, explorer.exe, and svchost.exe to reduce noise.
This rule detects command-line activity indicative of encryption key extraction or dumping. It looks for specific keywords like 'dumpkey', 'exportkey', 'savekey', 'keystore', and 'privkey' in the command line of processes such as 'servertool.exe', 'encrypt.exe', 'powershell.exe', and 'cmd.exe'. This activity is often associated with ransomware or other malicious software attempting to exfiltrate cryptographic keys.
This rule detects network connections to common lateral movement ports (SMB, NetBIOS, RDP, FTP, Telnet, SSH) occurring within a 30-minute window before or a 60-minute window after the execution of known ransomware encryption binaries ('servertool.exe', 'encrypt.exe'). This correlation aims to identify post-encryption lateral movement attempts by ransomware, potentially for further compromise or data exfiltration.
This rule detects a pattern of network shared folder access followed by the execution of known ransomware executables ('servertool.exe', 'encrypt.exe') within a 45-minute window. This behavior is indicative of ransomware preparing to encrypt data on network shares.
Detects the execution of known ransomware-related executables ('servertool.exe', 'encrypt.exe') when their command line arguments indicate interaction with cloud storage services such as OneDrive, SharePoint, GoogleDrive, Dropbox, or iCloud. This behavior is indicative of ransomware attempting to encrypt or exfiltrate data from cloud environments.
Detects the unique hardcoded mutex created by the Dropping Elephant in-memory RAT to prevent duplicate infections. This rule specifically looks for the mutex string 'kshdkfhskdfjkhsdkfhsjkdfhkj' during global object or mutex creation events.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
Detects a banking trojan (Banana RAT) attempting to intercept or replace PIX QR payment data from the clipboard, browser, or screen content. The rule looks for processes with names indicative of the RAT (banana, client, update, service) and command-line arguments related to PIX, QR codes, or clipboard manipulation.
EchoCreep Downloads a Tool
Cortex XDR
Detects the curl utility being launched by processes associated with EchoCreep or similar backdoor activity (searchapp, service, update, cmd) to download files, indicated by the use of output flags (-o, --output, -L, --remote-name). This activity is indicative of an adversary establishing persistence or downloading additional tools after initial compromise.
This rule detects the registration of a Vectored Exception Handler (VEH) by specific process names (gt_net.exe, grixba) or processes running from suspicious paths (e.g., C:\Users\Public\Music). This behavior is associated with the Grixba component of Play ransomware, which uses VEH for anti-debugging and execution hijacking.
Page 54 of 84