Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,097 detections
Filters
Last updated
All Time
Detection languages
501
303
85
65
62
Contributors
265
169
125
111
80
Categories
20,443
11,831
5,872
5,155
4,866
1,097
Platforms
1,096
3
1
1
1
Products / Services
364
351
226
40
32
MITRE Techniques
675
348
323
252
226
CVEs
2
1
1
1
1
IDS Classtypes
2
1
IDS Protocols
4
This rule detects various artifacts and behaviors associated with the DeedRAT malware, also known as MicRun or SBAMRES. It identifies the execution of 'MicRun.exe', suspicious file paths like 'C:\ProgramData\MicroDefaults', and registry persistence via 'Run' keys with specific data patterns. The rule also looks for the creation of malicious services using 'sc create MicRun', known malicious SHA256 hashes for both processes and files, and suspicious filenames such as 'SBAMRES.DLL' and 'MicRun.exe'. Additionally, it detects network communication to a known DeedRAT C2 domain, 'luckybear669.kozow.com'.
On environments managing sensible or critical information, I am not really happy when their local device configuration are modified and their network rely on airports, hotels, or the nearest coffee shop's Wi-Fi. This Query review if the TCPIP register is modified and it DHCP Domain is managed by a non-trusted/known network. It would help to restrict their access to enterprise data until be 100% sure they are using a VPN or back to enterprise DHCP Domain.
This rule detects various activities associated with the NotDoor malware, including the copying of malicious files to Outlook macro folders, C2 beaconing attempts using nslookup or curl to suspicious domains, registry modifications to disable Outlook macro security or enable macro loading on boot, and the creation of staging files in temporary directories for potential exfiltration. These behaviors are indicative of NotDoor installation, persistence, defense evasion, and data staging.
Detects HijackLoader attempting to perform anti-virtual machine (VM) checks by querying for VirtualBox-specific registry keys from a PowerShell process that also initiates a network connection. This combination of behaviors is indicative of sandbox evasion.
Detects registry queries for software inventory and browser settings as well as suspicious scheduled task creation, techniques observed in LummaC2 malware campaigns. Registry queries target installed software and browser preferences for reconnaissance (T1012). Scheduled tasks ensure persistence (T1053.005)
This detection identifies the installation of known malicious Chrome extensions associated with the "Madgicx Plus" campaign, which targets Meta advertisers to steal credentials and hijack sessions. The rule looks for registry modifications that include the specific IDs of these malicious extensions.
Detects scenarios where an attacker changed the IFEO settings related to sethc.
Detects scenarios where an attacker would enable shadow configuratin via registry. Note that this alert does not report the created Key and that further verification on hosts will be required to confirm the behavior.
Detects scenarios where an attacker installs the Mimikatz driver to bypass the LSA protected mode (RunAsPPL) and dump LSASS process content.
Detects scenarios where an attacker attempts to register the SMBexec service to estasblish persistence.
Detects scenarios where an attacker abuses the Netsh DLL feature to perform some code execution.
Detects scenarios where an attacker abuses the Windows "system failure and recovery" capacities (CrashControl) to store information or to establish persistence.
Detects a combination of suspicious activities often associated with the LummaC2 stealer. This includes querying the 'Run' registry key for reconnaissance and creating a scheduled task for persistence, often named "Update" and set to run on logon.
Detects attempts to query system information directly from the Windows Registry using 'reg.exe' or PowerShell cmdlets like 'Get-ItemPropertyValue' or 'gpv'. The rule specifically looks for queries related to time zone, network configuration, operating system details, installed programs, Windows Defender status, existing services, and scheduled tasks.
This KQL rule detects commands executed via the Run dialog by monitoring changes to the "Runmru" registry key. This key stores a history of commands entered into the Run dialog. Attackers or malicious scripts often use this method to launch tools like PowerShell, cmd, or malicious payloads, particularly in social engineering attacks where users are tricked into running commands.
Detects Component Object Model (COM) hijacking used by the Curly COMrades threat actor for persistence. This rule identifies registry modifications that alter specific CLSIDs related to the .NET NGEN task to load the MucorAgent malware.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
Page 42 of 53