Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects process activity, specifically in the command line, that contains the string "ghost_once_footer_". This string is indicative of a malicious footer injection targeting Ghost CMS.
Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for paths matching the pattern AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\ and excludes common browser update processes.
Parses Python execution strings to detect inline, on-the-fly decompression and execution of the CastleLoader script without touching disk.
This rule detects commands executed within GitHub Actions build jobs that attempt to read memory from the GitHub Actions runner process. This technique is often used in supply-chain attacks to extract secrets that reside in the runner's memory during job execution. The rule specifically looks for command-line arguments containing '/proc' and 'Runner.Worker' along with keywords like 'mem', 'cmdline', 'grep', 'tr -d', or 'isSecret'.
Detects HID keystroke injection attacks from hardware implants
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
This rule detects two types of suspicious process activity. The first part identifies common Windows processes (svchost.exe, explorer.exe, system.exe, services.exe) executing with command lines that suggest driver loading or manipulation (e.g., containing 'driver', '.sys', 'load', 'unsigned', 'disabled UAC'). It flags instances where such activity occurs frequently (5 or more times) within a short timeframe (2 hours) and involves at least one unique driver file. The second part of the rule detects suspicious process termination attempts where specific legitimate Windows processes (MpCmdRun.exe, MsSense.exe, PsExec.exe, rundll32.exe) are observed attempting to terminate critical system processes (svchost.exe, lsass.exe, csrss.exe) multiple times.
Detects attempts to bypass macOS Gatekeeper security controls
This rule identifies processes establishing synchronization objects (mutexes) that start with the hardcoded prefix 'Global\EVOLUTION'. This pattern is indicative of the EVOLUTION stealer malware execution, as it uses this specific mutex naming convention to ensure only one instance of itself is running.
Detects execution of tools known to manipulate Windows access tokens
Detects pulling of potentially malicious container images from registries
Detects in-memory archive creation using .NET compression libraries
Detects execution of tools known to manipulate Windows access tokens
This rule watches a notarised Flutter app wait before calling home and then running shell commands. Delayed contact helps malware evade sandbox checks during install. Behaviour after the delay is the real threat. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects a burst of network discovery activity from tools linked to DIY ransomware kits advertised with AI themes. Attackers use these tools to identify machines before encrypting files. Fast, repeated discovery from a single source is a serious warning sign. The rule specifically looks for multiple distinct discovery tools (nltest.exe, net.exe, net1.exe, dsquery.exe, adfind.exe, whoami.exe, ipconfig.exe) executed from common user-writable or temporary directories within a short timeframe.
This rule looks for command-line text associated with Atlas remote-access malware checking in to its controller. That check-in means the machine may already be under outsider control. Isolate the host and begin incident response if confirmed. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects Rust-compiled dropper generating its local staging environment inside WebViewFixUtility. This rule specifically looks for file events within the `\AppData\Local\WebViewFixUtility` folder that are initiated by `BrowserViewUtility.exe`.
Correlates the execution of the dropped Synaptics.exe with active outbound network connections, indicative of DarkKomet malware beaconing.
Identifies cmd.exe executing a batch script named 'vvvv.cmd' which is checking for the presence of the 'u.dat' reinfection guard file in the Public\Documents folder before execution. This behavior is associated with the UnregStealer malware.
Detects references to the misspelled service 'MicrosoftUpdateSerice' during service creation or manipulation within process command lines. This specific misspelling has been associated with the MuddyWater APT group.
Page 65 of 84