Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects the execution of Windows 365 native clients (Windows365.exe). Threat actors like UNC3753 abuse legitimate VDI clients on compromised BYOD devices to bypass corporate perimeters and access sensitive internal network segments.
This rule detects an unusually high number of Windows Management Instrumentation (WMI) process executions (wmic.exe or wmiprvse.exe) on a single device within a one-hour window. A threshold of 10 or more executions per hour is used to flag potential suspicious activity. Adversaries often leverage WMI for various purposes, including reconnaissance, lateral movement, persistence, and execution of malicious commands.
Detects malware using debugger detection APIs to evade dynamic analysis
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the execution of Windows Snipping Tool (SnippingTool.exe) or Screen Sketch (ScreenSketch.exe) when launched with the 'ms-screensketch' command-line argument. This behavior is indicative of a user or process taking a screenshot, which could be part of information gathering by an adversary.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
Detects executables whose Original File Name metadata differs from the actual filename on disk, which may indicate renamed Living-off-the-Land Binaries (LOLBINs) or attacker tools attempting to evade security controls. The rule specifically looks for a predefined list of known LOLBINs and trusted tools.
This rule looks for a Rust-based stealer that uses Tor for hiding traffic and low-level Linux hooks associated with IronWorm. This malware targets developers through poisoned packages. Linux build servers are at special risk. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule links changes that weaken Windows Defender with a rapid series of network discovery commands. Attackers often turn down protections before mapping the network for ransomware. Treat this sequence as active compromise. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Flags suspicious execution of X-VPN.exe or related installers loading unexpected DLLs, consistent with the CWE‑427 uncontrolled search path exploited in the campaign.
Detects malware using mutexes to prevent multiple instances running simultaneously
Detects process execution events containing command-line arguments unique to Chaos ransomware execution, such as 'ignorar_arquivos_grandes' or 'work_mode'. It also includes a more generic detection for 'lkey' and 'path' arguments used together to reduce false positives.
Detects calls to NtAllocateVirtualMemory originating from scripting engines or binaries executing from temporary user-controlled locations. This behavior is commonly associated with reflective loading, shellcode execution, and in-memory malware.
WMI Drive Discovery By MediaType
Cortex XDR
Detects a specific WMI query used by GammaWorm to find network drives and low-cost USB drives for malware propagation by filtering for mediatype=null. This query targets 'win32_logicaldisk' and specifically looks for drives where 'mediatype=null', which can indicate network or removable drives.
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
Detects processes making HTTP/HTTPS requests to localhost on ports 40341 or 40342 for '/metadata'. This pattern can indicate local service discovery, inter-process communication, or potentially malicious activity attempting to interact with local services, possibly for credential access or privilege escalation.
Flags executables whose embedded metadata identifies them as Cloudflared while the filename differs from expected distribution names, suggesting potential evasion through binary renaming.
Identifies processes consistent with Cloudflare Quick Tunnel usage by detecting unauthenticated cloudflared executions that publish local services through the --url option. Such behavior may enable unauthorized external access to internal resources.
Detects exclusive file locks used to prevent security tools from accessing files
This rule detects the creation of a specific mutex pattern associated with the Grixba ransomware. The mutex name starts with 'CPFATE_' and contains the .NET framework version string 'v4.0.30319', which is a unique artifact used by Grixba to ensure only one instance of itself is running.
Detects command line activity indicative of probing endpoint detection and response (EDR) software directories such as CrowdStrike, Falcon, Carbon Black, and SentinelOne. The Miasma malware probes these exact paths to fingerprint host defenses before executing its credential theft module.
Page 68 of 84