Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
311 detections
Filters
Last updated
All Time
Detection languages
184
28
21
21
21
Contributors
88
85
46
21
17
Categories
20,401
11,795
5,864
5,145
4,864
Platforms
259
40
20
6
3
Products / Services
113
76
51
37
35
MITRE Techniques
122
89
87
64
63
CVEs
6
5
3
1
1
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Detects the execution of short-lived processes (under 5 seconds) named 'start.exe' or 'BQT.exe' that contain environment variables or flags indicative of PyInstaller. This behavior is often associated with malware attempting to evade analysis or sandbox environments by executing and terminating quickly.
This rule detects two suspicious behaviors associated with the TinyRCT malware family: the execution of common installer or archiver utilities in the Downloads folder that terminate within two seconds, and the use of 'choice.exe' for self-deletion of an executing process within a short timeframe.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
This rule detects two suspicious behaviors associated with the TinyRCT malware family: the execution of common installer or archiver utilities in the Downloads folder that terminate within two seconds, and the use of 'choice.exe' for self-deletion of an executing process within a short timeframe.
Detects the use of the command-line utility 'taskkill' to terminate 'explorer.exe' followed by a command to restart it, often used by malware or unauthorized scripts to force a refresh of the desktop environment or hide malicious activities.
Detects the use of taskkill.exe or tskill.exe to forcibly terminate known security agent processes. This behavior is indicative of an attacker attempting to disable endpoint protection software to evade detection during post-exploitation activities.
Detects the use of taskkill.exe or tskill.exe to forcibly terminate known security agent processes. This behavior is indicative of an attacker attempting to disable endpoint protection software to evade detection during post-exploitation activities.
Detects attempts to terminate security-related processes using taskkill, tskill, or PowerShell's Stop-Process cmdlet. This is a common technique used by adversaries to disable endpoint detection and response (EDR) or antivirus (AV) agents on a compromised system to evade detection.
Detects attempts to terminate security-related processes using taskkill, tskill, or PowerShell's Stop-Process cmdlet. This is a common technique used by adversaries to disable endpoint detection and response (EDR) or antivirus (AV) agents on a compromised system to evade detection.
This rule detects suspicious executable or DLL file creations in common temporary or user-writable directories shortly after a Microsoft Defender related process (MsMpEng, Nissrv, Werfault, Services) terminates unexpectedly. The rule focuses on the causality chain to link the Defender crash with the subsequent file placement, suggesting an attempt to bypass or disable security software before deploying malicious payloads.
Detects taskkill, PowerShell, Windows Management Instrumentation or command-shell activity that attempts to terminate Discord. This activity is often seen with stealers like VVS Stealer which stops active Discord processes before replacing application support files with injected JavaScript.
Detects behavior attributed to the AMOS (Atomic macOS Stealer) malware, where a shell process uses 'setsid' to detach from the current terminal session, followed immediately by the execution of 'killall Terminal' to conceal the execution of malicious commands.
Detects potential sandbox evasion behavior characteristic of OXLOADER malware. The rule identifies a non-system process dynamically loading 'mpr.dll' and terminating shortly thereafter (within 1 minute). This sequence is associated with anti-sandbox techniques where malware attempts to trigger an error (e.g., ERROR_BAD_NAME 0x43) via a malformed UNC path using 'WNetAddConnection2W' to detect if it is running within an analysis environment.
Identifies the ransomware executing taskkill or net stop to forcefully terminate SQL, Exchange, and backup services, freeing file locks for successful encryption.
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
Detects the forceful termination of web browsers using taskkill.exe with the /F (force) and /IM (image name) flags. This behavior is a common precursor for information stealers attempting to unlock browser databases for credential harvesting.
Detects the consequence of the BYOVD exploit: the sudden termination or crash of protected EDR/AV processes (MsMpEng.exe, Sense.exe, csrss.exe tampering) in conjunction with the loading of the 'EEDbg.sys' driver, which is associated with the EnCase BYOVD technique.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
Page 13 of 15