Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects suspicious activities often associated with malware (such as DcRAT or Operation DragonReturn) including the loading of amsi.dll by unauthorized processes in writable directories to facilitate patching of AMSI, and unauthorized cross-process memory writing into svchost.exe from non-system, potentially unsigned or suspicious processes.
Detects attempts to suppress PowerShell ETW telemetry by modifying the PSEtwLog object (setting it to null or 0) in conjunction with indications that AMSI initialization has failed, suggesting a coordinated effort to blind security monitoring during malicious script execution.
Detects anomalous loading of amsi.dll by processes running from suspicious staging paths commonly associated with the Yuta/Glove Stealer campaign. The rule identifies processes that may be performing in-memory patching of 'AmsiOpenSession' or 'EtwEventWrite' to blind security telemetry, a hallmark of credential theft malware.
Detects the creation of .exe.config files by potentially unauthorized or suspicious processes. Attackers may use these configuration files to hijack the .NET AppDomainManager, enabling malicious code execution when the associated executable is launched. The rule monitors file creation events (Sysmon Event ID 11) and filters out expected installers or update processes while flagging suspicious writing processes like PowerShell, CMD, or non-standard binaries.
Detects attempts to stop or delete security-related services (such as Microsoft Defender, Cylance, CrowdStrike, SentinelOne, Malwarebytes, or Bitdefender) using native Windows utilities like taskkill.exe or sc.exe.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects suspicious cross-process access or injection activity targeting Internet Explorer-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe). The rule monitors for high-privileged access rights, non-standard source process paths, and the presence of memory-related API calls often associated with process hollowing or injection (e.g., ZwCreateSection, VirtualAlloc, SetThreadContext) in combination with repeated access attempts.
Detects attempts to tamper with Windows Defender configuration using PowerShell cmdlets 'Add-MpPreference' to add exclusions or 'Set-MpPreference' to disable real-time monitoring. This behavior is consistent with ClickFix attack techniques intended to evade endpoint security defenses.
Detects file creation or write access to C:\Windows\System32\sethc.exe or sethc.exe.bak, indicating a sticky keys backdoor technique where an attacker replaces the Sticky Keys binary with cmd.exe or another shell to obtain a SYSTEM-level shell at the login screen.
Detects instances where a process attempts to access the memory or control flow of a web browser (Chrome, Edge, Brave) using suspicious access rights (0x820), which correspond to PROCESS_VM_WRITE (allowing memory modification) and PROCESS_SUSPEND_RESUME (allowing thread suspension). This behavior is often indicative of process injection or hollowed execution attempts against browser processes.
Detects cross-process injection attempts into the Windows system process 'svchost.exe' where the source process is either unsigned or lacks a verified Microsoft publisher. This pattern is commonly observed in malware payloads, such as DcRAT, attempting to hide malicious activity within a legitimate system process.
This rule detects attempts by the PowerShell process to bypass the Antimalware Scan Interface (AMSI) by patching the amsi.dll in memory. Specifically, it looks for 'WriteProcessMemoryApiCall' events targeting 'powershell.exe' where 'amsi.dll' has been loaded into the process's memory space. This technique is often used by malware, such as Potemkin Loader, to evade detection.
Detects the creation or modification of opportunistic locks (oplocks) involving Wermgr.exe copies located within Volume Shadow Copies or temporary directories using specifically crafted file streams (:WDFOO). This activity is a known technique used to perform Time-of-Check Time-of-Use (TOCTOU) race condition attacks to suspend security software or hold open race windows to evade detection by Windows Defender.
Detects registry modifications to the 'Debugger' value for Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique, known as IFEO (Image File Execution Options) hijacking, allows an adversary to redirect the execution of these binaries to a malicious payload. This is a common persistence mechanism used by malware, including TrymeLocker, to achieve unauthorized access or privilege escalation at the login screen.
Detects the AnyDesk.exe process loading a DLL from non-standard, user-writable directories (e.g., AppData, Temp, Downloads). This behavior is indicative of a Component Object Model (COM) hijacking attack where an attacker registers a malicious COM server to trick AnyDesk's printer component into loading an arbitrary DLL, potentially enabling privilege escalation or persistent code execution.
Detects instances of the systemd-userdbd process executing from non-standard file paths or general systemd-related processes launching from world-writable or temporary directories (e.g., /tmp, /dev/shm, /var/tmp, /home). This behavior is often indicative of process masquerading or a persistence mechanism where an adversary attempts to execute a malicious binary by mimicking system service naming conventions.
Detects activity associated with the SPECTRALVIPER malware loader, specifically identifying known malicious file hashes (system.config.xml, NotificationConfig.json) and cross-process memory injection patterns (RemoteMemoryAllocation, RemoteMemoryWrite, CreateRemoteThreadApiCall) initiated by specific suspect processes.
Detects reflective process injection activity where the IntelAudioService.exe process opens a handle to the OneDrive.Sync.Service.exe process, potentially using XGU::Manager::ProcessReflector class methods to inject shellcode.
Detects the AdaptixC2 agent (AdgNsy.exe) performing process injection into the Windows Address Book (WAB.EXE). The rule specifically monitors for the creation of AdgNsy.exe, its execution under the WMI Provider Host (WmiPrvSE.exe), and subsequent cross-process access to WAB.EXE, which is a known behavior of the AdaptixC2 framework utilized during Akira ransomware intrusions.
Detects the execution of native Windows utilities (vssadmin, wmic, bcdedit) used to inhibit system recovery or modify boot configuration, such as deleting shadow copies or disabling recovery features. The rule further flags these actions when executed by suspicious parent processes, processes outside of standard system paths, or via WMI/DCOM interfaces frequently associated with ransomware and lateral movement.
Detects evidence of AsyncRAT infection involving process hollowing into RegAsm.exe. The rule monitors for suspicious PowerShell activity involving specific artifacts ('cap.ps1', 'ConsoleApp1') used to perform reflective assembly loading, attempts to add Windows Defender exclusions for RegAsm.exe, and subsequent suspicious outbound network connections from RegAsm.exe to known C2 infrastructure.
Page 32 of 52