Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Correlates the execution of an executable initiated by cscript.exe with the subsequent access of Chrome's 'Login Data' file, indicating an attempt at offline DPAPI decryption, potentially by the Laravel Stealer malware.
Correlates the execution of the trojanized scp binary passed with the '!' flag, an internal trigger designed to disable SELinux enforcing mode prior to payload execution. This rule specifically looks for 'scp' command-line executions containing '!' and excludes standard scp syntax that might contain '@' for user@host.
Detects a .NET loader interrogating the process list for a specific cluster of sandbox/analysis tools (apateDNS, tcpvcon, any.run, joeboxserver, Dbgview) using PowerShell before proceeding with its malicious activity. The rule triggers when PowerShell command line arguments contain at least two of the specified tools.
Detects removal of Zone.Identifier ADS to bypass MOTW security prompts
Detects the Python interpreter executing with a command line containing a specific string fingerprint ('lzcdrtfxyqiplpd') associated with the Glassworm obfuscation variant. This indicates potential obfuscated code execution.
Detects the execution of the 'stat' command with specific arguments ('-f', '%Su', '/dev/console') which is indicative of the AMOS Stealer attempting to pivot user context to the active console user. This activity is typically performed by the '~/.agent' script associated with the malware.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
Detects attempts to escalate privileges via sudo
This rule detects potential exploit attempts targeting Microsoft Word or Outlook by monitoring process crashes (AccessViolation) initiated by these applications, specifically when the command line indicates the processing of document or email file types (.docx, .eml, .rtf). This could indicate an attempt to exploit a vulnerability in these applications through a specially crafted file.
Detects pulling of potentially malicious container images from registries
Detects patching of network device system images for persistent backdoors
Detects the use of 'pgrep' to search for the 'Runner.Worker' process. This activity is often a precursor to an attacker attempting to access the process's memory via '/proc/[pid]/mem' for credential dumping or other malicious purposes.
Hunts for the fake VPN creating highly randomized, high-entropy directories in %AppData% to store its persistence binaries. This rule specifically looks for folder creation events in the AppData\Roaming directory with a highly randomized, 12 or more character alphanumeric name, and correlates it with a process event from either GlobalProtect or AnyConnect VPN clients.
Correlates a script connecting to an LLM API and immediately piping the response or executing rapid shell commands (cmd/bash) representing AI-generated reconnaissance or exploit execution.
Detects Python executing OS commands spawned directly from the deserialization of a poisoned Pickle model file. This rule correlates process creation events where 'python.exe' initiates a command interpreter ('cmd.exe', 'sh', 'bash') with file access events to common Pickle file extensions ('.pkl', '.pickle', '.pth', '.bin').
Detects a single process creating several named pipes, which is indicative of the Kazuar malware's communication mechanism between its Kernel, Bridge, and Worker modules. The rule specifically looks for a process creating 3 or more unique named pipes within a 10-minute window.
Detects several related module processes on one host while a single process accounts for all external network connections. This behavior is indicative of the Kazuar malware, which uses a botnet-like structure where one 'leader' process handles C2 communications.
Detects PowerShell attempting to hook keystrokes via user32.dll SetWindowsHookEx. This behavior is often associated with malware like PS1Bot to capture user input.
Identifies the Python loader generating the decryption key using hashlib.sha512 over an embedded parameter.
Hunts for the IAT_PHANTOM_FIX evasion routine where Python generates thousands of SHA-512 hashes to delay execution and fool heuristics. This rule specifically looks for 'python.exe' processes executing command lines that contain a loop iterating a large number of times (at least 1000) and performing SHA-512 hashing, indicative of anti-analysis techniques used by malware like XWorm.
Detects the malware executing system interrogation commands to build its unique Client ID from ProcessorCount, UserName, and OSVersion. This rule specifically looks for a process named 'Win.Kernel_Svc' (case-insensitive) initiating multiple executions of 'cmd.exe', 'wmic.exe', or 'systeminfo.exe' within a short timeframe.
Page 62 of 84