Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects the unique start and end markers (VAPTb3gin, VAPTfin) used by the VAPT autonomous framework to confirm exploit success across network or host logs. This rule searches across process and network events for these confirmation markers.
Detects the exploited Bomgar process explicitly attempting to read sensitive credential files (like the SAM registry hive dump or /etc/shadow) to escalate privileges.
Detects the Komari agent executing from anomalous staging directories (e.g., Public, ProgramData, Temp) and immediately initiating high-frequency external network connections. This rule correlates process creation events with network connection events to identify suspicious behavior indicative of Komari C2 activity.
Identifies the fake updater process making network connections to download heavily encrypted payload blobs (often .bin or .dat files) to evade perimeter AV. This rule specifically looks for `curl.exe`, `powershell.exe`, or `certutil.exe` being used to download files with `.bin`, `.dat`, or `.enc` extensions, initiated by a process with 'setup' or 'update' in its filename.
This rule detects a potential HTML smuggling attack where a browser (Chrome or Edge) saves a file (specifically ISO, IMG, VHD, ZIP, or RAR extensions) via a JavaScript Blob, and that same file is executed by the user via Windows Explorer within a 10-minute window. This chain of events is indicative of a phishing technique used to bypass traditional security controls.
Detects malware copying itself as RuntimeHost.exe into a localized cache directory (D3F4E2A1) while ScreenConnect.ClientService.exe is running, indicating potential cryptojacking activity.
Detects the execution of a shortcut file named 'MicrosoftUpdateSerice.lnk', which is a common misspelling of 'MicrosoftUpdateService.lnk'. This technique is often used for evasive startup persistence by adversaries, as highlighted by its use in APT28/MuddyWater campaigns.
Detects scripts or commands that directly reference 'RtlDosPathNameToNtPathName' in their command line. This function can be used by adversaries for NT path evasion, a technique to manipulate how the operating system resolves file paths, potentially leading to execution of malicious files or bypassing security controls. The detection is based on the presence of this specific function name in process command lines.
Detects if multiple different fake AI installers (e.g., DeepSeek and Kimi) are executed on the same machine, indicating a concentrated phishing delivery.
Detects an environment where 'bun' is executing both the primary ('setup.mjs') and secondary ('execution.js' or 'bw_setup.js') payloads within an hour, indicating a potential supply chain attack.
This rule detects attempts to manipulate Windows Management Instrumentation (WMI) Quality of Service (QoS) policies, specifically targeting the 'MSFT_NetQosPolicySettingData' class. This activity is indicative of the EDRChoker technique, which aims to throttle network traffic for Endpoint Detection and Response (EDR) agents to hinder their telemetry and block their functionality. The detection logic looks for WMI events or process command lines containing references to 'MSFT_NetQosPolicySettingData' along with 'ThrottleRateAction' or 'AppPathNameMatchCondition'.
This rule identifies indicators and behaviors associated with KongTuke and PS1Bot campaigns. It specifically looks for network connections to known malicious IPs, domains, and URI paths, as well as the execution or presence of files with known malicious SHA256 hashes associated with these campaigns. The original description mentions 'finger.exe abuse, scheduled task and registry persistence, dynamic C# compilation for keylogging/screen capture, and suspicious PowerShell download cradles', but the current KQL rule only covers network and file/process IOCs.
Detects the use of two or more distinct remote access products by the same user on the same device within a one-hour window. This could indicate suspicious activity, such as an attacker attempting to maintain persistence or using multiple tools for different stages of an attack, or a legitimate user having multiple remote access tools installed and running concurrently.
Detects command-line utilities such as grep, cat, sed, awk, or shell commands (bash, sh) being used to read the 'psappsrv.cfg' file and specifically searching for sensitive configuration parameters like 'Address=', 'HostName=', 'appserv', 'prcs', or 'ps_config_homes'. This activity could indicate an attacker attempting to discover system information or network configurations related to Oracle PeopleSoft.
Detects inspection of active mounts or /etc/hosts for PeopleSoft, configuration home, NFS, or environment naming patterns. This rule specifically looks for commands like 'mount', 'cat', 'grep', 'bash', or 'sh' being executed with command-line arguments that include 'mount' and PeopleSoft-related terms ('psoft', 'ps_config', 'nfs'), or '/etc/hosts' with PeopleSoft-related terms ('psoft', 'csprd', 'peoplesoft', 'psft').
Detects Python processes attempting to decrypt browser credential databases using DPAPI or CryptUnprotectData. This behavior is characteristic of malware like InvisibleFerret, which targets stored browser credentials.
Detects a custom proxy process listening for forwarding instructions and creating a second outbound connection to a supplied host and service. This rule specifically looks for network events where the process image name contains 'chainworm', 'svc', or 'proxy' (case-insensitive) and the command line arguments indicate forwarding or connection establishment activities like 'forward', 'next hop', 'bind', 'listen', 'reconnect', or 'TcpClient'.
Detects files executing with double extensions designed to trick users (e.g., .pdf.exe). This rule specifically looks for process events where the filename matches a pattern of a common document/image/archive extension followed by an executable extension.
Detects WMI activity where 'wmiprvse.exe' is used to query 'SecurityCenter2' for antivirus product information. This behavior is often associated with adversaries performing reconnaissance to identify security software.
This rule detects processes that attempt to set the 'BlockNonMicrosoftBinaries' mitigation policy using 'SetProcessMitigationPolicy'. This policy is typically used to prevent the loading of non-Microsoft signed DLLs into a process, which can be an evasion technique used by adversaries to hinder analysis or prevent injection by security products.
Detects unique INFINITERED marker strings in process command lines or event metadata. The indicators include the upgrade-code GUID delimiter, its Base64 representation, the stolen-session identifier prefix, and the custom file-download command tag. These values are specific to the reported malware and should be treated as high-confidence evidence when present.
Page 61 of 84