Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects attempts to disable or impair Endpoint Detection and Response (EDR) or Antivirus (AV) solutions by abusing Quality of Service (QoS) policies. It specifically looks for two methods: 1) Process command-line execution that creates or modifies QoS policies (`New-NetQosPolicy` or `Set-NetQosPolicy`) and targets known EDR/AV process names with throttling actions. 2) Direct manipulation of the Windows Registry under `SOFTWARE\Policies\Microsoft\Windows\QoS` where the registry value data contains known EDR/AV process names. This activity is indicative of an attacker attempting to "choke" the telemetry stream from security products, potentially to evade detection.
This rule detects the execution of processes where the original file name contains 'autoit' but the current file name does not, which can indicate obfuscation or malicious use of AutoIt scripts.
Tracks python modules executing PIL and mss libraries to capture screen matrices and generate Base64 output arrays.
Detects processes executing with strings matching typical Windows drive enumeration sequences targeted by Makop.
Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.
Identifies the explicit mutex generated by the CastleLoader RAT to ensure only one instance executes concurrently. This rule specifically looks for the creation of a mutex named 'MissedCallsTrapPhone'.
Detects Linux execution environments where processes manually manipulate their argv[0] to masquerade as kernel threads ([khubd]) or legitimate daemons (smbd -D). The rule specifically looks for process command lines matching 'khubd', 'smbd -D', or 'kauditd -sh' where the actual executable filename is not 'smbd', 'kauditd', or 'khubd'.
Detects wscript.exe running JavaScript payloads dropped specifically into the AppData\Local\Temp path, typical of SocGholish fake update execution.
Identifies explicit attempts to parse or dump the Active Directory database using ntdsutil.exe IFM creation parameters.
Detects rclone remote configuration or config file creation when the binary is running from a portable user writable location, such as Downloads, Temp, AppData, Desktop, /tmp/, or /var/tmp/. This activity can indicate an attempt to exfiltrate data to cloud storage services.
Detects suspicious injection into a headless Chrome or Edge process by looking for the '--headless' and 'DEBUG_ONLY_THIS_PROCESS' command-line arguments. This combination suggests an attempt to bypass app-bound encryption, potentially via IElevator COM.
Identifies instances where update.exe enforces an svchost.exe parent to evade sandboxes, specifically looking for 'UpdateChecker.dll' being loaded by a process named 'update.exe' whose parent is 'svchost.exe'. This behavior is associated with the Screening Serpens APT group.
Detects InterlockRAT activity by identifying Java runtime executions (java.exe or javaw.exe) that include the '-jar' argument and originate from suspicious folders like AppData\Local\Temp, ProgramData, or Public. InterlockRAT is known to leverage Java runtimes to establish persistent SOCKS5 tunnels and reverse shells.
Identifies GhostSocks executing with command line parameters specifically pointing to remote relay nodes, obfuscating the final exfiltration destination.
Hunts for SimpleHelp executing reg.exe commands to disable Windows Defender components (DisableRealtimeMonitoring, DisableAntiSpyware) prior to encryption.
Detects the threat actor clearing the staging archives securely via sdelete or forcefully via del /f /q immediately post-exfiltration. This rule correlates process execution of 'cmd.exe' or 'sdelete.exe' with specific command-line arguments targeting archive files (zip, rar, 7z) and a preceding network connection to a remote IP, indicating potential data exfiltration followed by anti-forensic cleanup.
Detects the execution of Python-based OpenClaw modules running directly out of newly cloned or extracted GitHub repository structures, specifically looking for Python processes where the command line includes patterns indicative of a cloned or extracted repository (e.g., '-main' or '-master' followed by a Python script).
Detects a browser being launched via LNK or script with explicit kiosk or fullscreen parameters to trap the user in a fake tech support HTML lure. This rule specifically looks for chrome.exe or msedge.exe being executed with command-line arguments such as '--kiosk' or '--start-fullscreen' in conjunction with an HTML or HTM file.
Correlates the final execution of a dropped ransomware binary directly from the C:\ProgramData\JWrapper or related SimpleHelp cache directories, identified by common ransomware flags in the process command line.
This rule detects the execution of JavaScript files named 'bw_setup.js' or 'execution.js' using the 'bun' runtime, immediately followed by an outbound network connection to the command and control (C2) domain 't.m-kosche.com'. The detection logic correlates process execution events with network connection events within a 10-minute window, indicating potential malicious activity associated with supply chain attacks.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
Page 58 of 84