Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
769 detections
Filters
Last updated
All Time
Detection languages
293
239
59
42
39
Contributors
188
145
112
101
29
Categories
20,440
11,814
5,871
5,145
4,864
769
Platforms
710
56
10
9
6
Products / Services
317
159
152
133
37
MITRE Techniques
603
504
364
327
195
CVEs
5
4
2
2
1
IDS Classtypes
7
1
IDS Protocols
9
1
Detects Obfuscated use of stdin to execute PowerShell
Detects Obfuscated use of Environment Variables to execute PowerShell
Detects Obfuscated Powershell via COMPRESS OBFUSCATION
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects Obfuscated Powershell via Stdin in Scripts
Detects Obfuscated Powershell via use Clip.exe in Scripts
Detects Obfuscated Powershell via use MSHTA in Scripts
Detects Obfuscated Powershell via use Rundll32 in Scripts
Detects the use of getsystem Meterpreter/Cobalt Strike command by detecting a specific service installation
This rule detects the creation or modification of services, registry keys, or driver loads that exhibit characteristics associated with the ValleyRAT malware. Specifically, it looks for services or registry entries pointing to executables in common temporary directories (Users, ProgramData, Windows AppData\Local\Temp, or \Temp\) and driver loads from similar temporary paths. It also includes a specific check for drivers signed by 'Shandong Anzai Information Technology' and known SHA256 hashes associated with ValleyRAT. The rule excludes legitimate Symantec AV components and a Lenovo signed driver to reduce false positives.
This rule detects various activities associated with the Charon ransomware, including DLL sideloading, ransomware deployment, payload reading, ransom note creation, shadow copy deletion, and service creation for persistence. It leverages specific filenames, process behaviors, and registry modifications to identify the threat.
This rule detects various stages of the Charon ransomware deployment and activity, including the writing of ransomware-related files to disk, malicious DLL side-loading, the deployment trigger, and the creation of ransom notes or service associated with Charon.
Detects the execution of sc.exe or reg.exe to create or modify specific Windows services to point to a malicious DLL. This technique is used by the Silver Dragon APT group to hijack legitimate services like 'bthsrv' and 'wuausrv' for persistence.
Detects the creation of a system service for NSecKrnl using sc.exe, indicating a potential Bring Your Own Vulnerable Driver (BYOVD) attack. Warlock has been observed utilizing the vulnerable NSecKrnl.sys driver to terminate kernel-level security products before deploying ransomware.
Detects persistence mechanisms associated with malware signed by TrustConnect Software PTY LTD. The malware establishes persistence by creating a specific Run key or by registering a service masquerading as Adobe Acrobat Reader.
Detects the creation of a Windows kernel service using sc.exe where the binary path points to common user-writable or temporary directories. This is a common TTP for Bring Your Own Vulnerable Driver (BYOVD) attacks, often used for privilege escalation and persistence.
Detects the creation of a new Windows service where the binary path points to suspicious, world-writable, or temporary directories. This is a common technique used in Bring Your Own Vulnerable Driver (BYOVD) attacks to load a malicious or vulnerable driver.
Detects execution of AnyDesk on Windows endpoints. Adversaries may use legitimate remote access tools to obtain interactive access and to maintain persistence after initial compromise.
Detects the creation of the 'UPlugPlay' Windows Service, a known persistence mechanism for the Prometei botnet. The malware may create the service using the command-line tool 'sc.exe' or directly via Windows APIs, which generates Event ID 7045.
Detects modifications to the registry values responsible for service recovery actions, specifically the 'FailureCommand' or 'FailureActions' values. This can indicate an attacker is configuring a service to execute a malicious payload upon failure for persistence or privilege escalation.
The rule detects the installation of the Gorelo RMM service by monitoring Windows System events (Event ID 7045) or Security events (Event ID 4697), which record the creation of new services. It specifically looks for service names or binary paths containing the string "gorelo", flagging the moment the agent is first established on the system.
Page 27 of 37