Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,080 detections
Filters
Last updated
All Time
Detection languages
542
104
98
88
78
Contributors
471
224
194
49
30
Categories
20,440
11,814
5,871
5,145
4,864
1,080
Platforms
997
84
17
4
3
Products / Services
374
306
162
124
115
MITRE Techniques
744
384
300
286
244
CVEs
15
5
4
2
2
IDS Classtypes
2
1
1
IDS Protocols
3
1
Detects persistence mechanisms associated with the MYRA Linux RAT, including malicious library injection via LD_PRELOAD using /usr/local/lib/.libcache.so, creation of persistence scripts in /etc/profile.d/, and process masquerading where a process executes as 'systemd-userdbd' but is not launched by the legitimate systemd manager.
Detects attempts to stop or disable critical security, backup, and logging services on Windows systems using command-line utilities (net.exe, sc.exe) or PowerShell. Adversaries frequently perform these actions to impair defensive monitoring, bypass security controls, or prepare the system for destructive activities like ransomware deployment.
Detects evidence of log deletion, logrotate configuration modification, or syslog daemon termination (rsyslog, syslog-ng, journald) occurring within 30 minutes of suspicious child process activity from common web application interpreters (e.g., python, node, java, php). This correlation pattern is a strong indicator of post-exploitation activity aimed at clearing tracks or impairing host logging services.
Detects indicators of the MYRA Linux RAT, including process masquerading as systemd-userdbd, persistent modifications to system locations like /etc/profile.d/ and /usr/local/lib/, and malicious cron scheduling, typically originating from a Node.js process.
Detects Remcos RAT masquerading as explorer.exe by launching legitimate Internet Explorer browser components (iexplore.exe, ieinstal.exe, or ielowutil.exe) in a suspended state. This activity is indicative of process hollowing or PEB modification used by Remcos to inject malicious code into a seemingly legitimate process while evading detection.
Detects attempts to terminate security-related processes or stop security-related services using common administrative tools like taskkill.exe, sc.exe, net.exe, or net1.exe. This activity is often indicative of an adversary attempting to disable security monitoring and protection software to facilitate further malicious actions.
Detects attempts to disable or tamper with Microsoft Defender Antivirus through various methods, including modifying registry policies, stopping the WinDefend service, executing PowerShell commands to alter preferences, or adding arbitrary exclusions via WMI.
Detects attempts to uninstall, disable, or remove ModSecurity Web Application Firewall (WAF) modules on IIS or Apache servers. This behavior often indicates an adversary attempting to impair security defenses by disabling WAF protection to facilitate further malicious activity, such as web shell deployment or exploitation.
Detects the removal or uninstallation of the ModSecurity Web Application Firewall (WAF) module across Windows (via appcmd.exe) and Linux (via package managers or apxs). Adversaries often disable security controls like ModSecurity to facilitate the exploitation of web vulnerabilities or to maintain persistence without triggering defensive alerts.
This rule detects potential tampering with security software processes and services, as well as the execution of suspicious batch scripts (i.bat). It identifies when administrative tools like sc.exe, taskkill.exe, or net.exe are used to stop or delete security agents such as Sysmon, Filebeat, SentinelAgent, or antivirus services. It also monitors for the execution of 'i.bat' via command shell, which is commonly associated with malicious automation or persistence.
This rule detects potential file timestamp manipulation (timestomping) and suspicious file operations commonly associated with web shell installation on Windows systems. It monitors for PowerShell commands, touch.exe execution, and cmd.exe file copy operations directed at web directories, as well as file write events involving specific known web shell filenames.
Detects the execution of batch files that perform multiple actions to impair or disable security tools, including Windows Defender, Sysmon, Filebeat, and IIS logging components. The rule monitors for a pattern of suspicious process commands (stop, config, delete, kill, Set-MpPreference) originating from a .bat file, flagging hosts where two or more distinct impairment actions are executed by the same parent process.
Detects the use of WMIC to interact with the MSFT_MpPreference WMI namespace to add folder or file extension exclusions to Microsoft Defender. This technique is often used by attackers to exempt malicious files or tools from being scanned by security software.
This rule detects the potential tampering of IIS logging configurations within a short duration following suspected web shell activity. It monitors for the execution of appcmd.exe or PowerShell commands that disable or modify IIS logging, specifically targeting sites or configurations after an IIS worker process (w3wp.exe) has performed activity associated with a webshell. This pattern is indicative of an attacker attempting to conceal their footprint after gaining access.
Detects anomalous activity where a process or user attempts to stop or disable multiple security-related services (e.g., Windows Defender, Sysmon, EDR agents) within a short window. This behavior is indicative of an adversary attempting to impair defensive monitoring and protection tools during a compromise.
Detects Akira ransomware-related activity by identifying the creation of characteristic ransom notes or files with the .akira extension, combined with signs of security defense impairment (such as disabling Windows Defender via command line).
Detects DcRAT malware attempting to perform fileless process injection into svchost.exe from the 'Mixed Reality.exe' process. This behavior leverages NT API calls such as ZwWriteVirtualMemory and NtDuplicateObject, a technique identified in Operation DragonReturn targeting Indian infrastructure.
Detects a specific AMSI bypass technique associated with Operation DragonReturn, where the process patches amsi.dll memory using VirtualProtect after dynamically locating the function with GetModuleHandleA and GetProcAddress.
Detects unauthorized process injection attempts (specifically ZwWriteVirtualMemory, NtWriteVirtualMemory, WriteProcessMemory, NtDuplicateObject, and ZwDuplicateObject) into 'svchost.exe' from suspicious, non-system parent processes. This detection focuses on behavior associated with DcRAT and Operation DragonReturn, using risk scoring based on file paths and specific known malicious file names.
Detects a suspicious pattern where a large volume of files (documents, archives, or media) are written to common user directories, followed within 10 minutes by attempts to impair system recovery (deleting shadow copies) or disable Microsoft Defender exclusions using native Windows utilities such as vssadmin, wmic, or PowerShell. This behavior is highly indicative of ransomware staging activities.
Detects LCRYX ransomware activity characterized by the execution of VBScript files via wscript/cscript, followed by attempts to disable security products (Windows Defender or third-party AVs) using command-line utilities, and establishing persistence via Registry Run keys within a 10-minute window on the same host.
Page 36 of 52