Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
175 detections
Filters
Last updated
All Time
Detection languages
65
63
11
9
8
Contributors
35
24
19
19
11
Categories
100
76
57
26
15
Platforms
172
2
1
Products / Services
56
45
34
9
6
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
2
1
IDS Protocols
4
1
Detects query of Software Inventory Logging collection state — defense evasion reconnaissance.
Detects DC-RAT by matching complete static API/function and string fingerprint.
Detects Kazuar establishing persistence using a dynamically generated host-specific Mutex, which is derived from the machine GUID. This rule correlates Mutex creation events with registry events related to the MachineGuid.
Detects a single parent process launching registry or PowerShell queries for both Defender PUA policy and Windows product edition within a ten-minute window. This behavior can indicate malware attempting to understand its environment and potentially evade detection or tailor its execution.
This YARA rule detects the Nimplant malware, a lightweight C2 framework. It identifies Nimplant by looking for specific DLL and library names (some with common typos), a comprehensive list of Nim-related source file names often found in Nimplant builds, specific hexadecimal patterns corresponding to Windows API calls (like GetComputerNameW, CreateProcess, GetUserNameW, OpenProcessToken, CreateFileA, VirtualProtect, CreateToolhelp32, WinHttpConnect), Zlib compression patterns, TLS callback patterns, and various strings including registry keys and a version string for Nimplant itself. The rule aims to identify Nimplant executables or related artifacts on Windows systems.
This rule detects when a newly dropped executable, likely from temporary or download directories, performs broad registry reconnaissance. Specifically, it looks for access to registry keys related to software, internet settings, credentials, vaults, and uninstall information. The XQL view includes actor and causality fields to aid in investigation.
This rule detects the execution of 'envchk.exe' from common Windows temporary directories (e.g., C:\Windows\Temp\ or C:\Users\<User>\AppData\Local\Temp\). It then correlates this activity with subsequent executions of system profiling commands such as 'hostname.exe', 'ipconfig.exe', 'tasklist.exe', 'wmic.exe', 'powershell.exe', or 'reg.exe' within a 5-minute window. The detection specifically looks for command-line arguments indicative of system information gathering (e.g., 'getmac', 'Win32_Product', 'Get-Package', 'Get-Culture', 'Get-DnsClient', 'tasklist', 'hostname'). This sequence of events is characteristic of the environment-check stage of the DAEMON Tools backdoor campaign, aiming to identify the system's configuration and environment.
Detects instances where 'node.exe' executes 'protocal.cjs' from a 'NodePackages' path and subsequently spawns child processes that perform host reconnaissance activities. These activities include PowerShell registry queries, process listing, and querying installed applications, which are indicative of an adversary gathering system information.
Detects registry query for AlwaysInstallElevated — precursor to MSI-based privilege escalation.
Identifies the explicit mutex generated by the CastleLoader RAT to ensure only one instance executes concurrently. This rule specifically looks for the creation of a mutex named 'MissedCallsTrapPhone'.
Detects DC-RAT by matching complete static API/function and string fingerprint.
Detects registry query for AlwaysInstallElevated — precursor to MSI-based privilege escalation.
This rule detects the enumeration of specific security-related drivers or services, including those associated with ESET, Npcap, NPF, and Sysmon. It triggers when processes like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' are launched and their command line contains keywords related to these drivers/services. The rule aims to identify potential reconnaissance activities by adversaries attempting to discover installed security software or system monitoring tools.
Detects a user-writable parent process launching at least eight registry queries across four or more browser, credential, software, network, and uninstall areas within ten minutes. This behavior can indicate malicious activity, as adversaries often query the registry to gather system information, discover installed software, or identify persistence mechanisms.
Detects query of Software Inventory Logging collection state — defense evasion reconnaissance.
Detects bulk registry queries over SMB for system discovery
This rule detects the enumeration of specific security-related drivers or services, including those associated with ESET, Npcap, NPF, and Sysmon. It triggers when processes like 'sc', 'reg', 'cmd', 'powershell', or 'pwsh' are launched and their command line contains keywords related to these drivers/services. The rule aims to identify potential reconnaissance activities by adversaries attempting to discover installed security software or system monitoring tools.
This rule detects multiple attempts (3 or more within an hour) to access critical registry hives (SAM, SYSTEM, SECURITY) with specific access masks (0x0001 - ReadData/ListDirectory or 0x0002 - WriteData/AddFile). This activity can be indicative of credential dumping attempts, particularly targeting the SAM hive to extract local user credentials.
This rule detects multiple attempts (3 or more within an hour) to access critical registry hives (SAM, SYSTEM, SECURITY) with specific access masks (0x0001 - ReadData/ListDirectory or 0x0002 - WriteData/AddFile). This activity can be indicative of credential dumping attempts, particularly targeting the SAM hive to extract local user credentials.
Detects bulk registry queries over SMB for system discovery
This YARA rule detects Portable Executable (PE) files associated with the Nimplant C2 framework. It identifies Nimplant by looking for specific DLL names (some with common typos), Nim-related source file names (e.g., pixle.nim, urls.nim), Windows API function calls commonly used by malware (e.g., GetComputerNameW, CreateProcess, VirtualProtect), Zlib patterns, TLS callbacks, and specific strings like registry keys and a version string "@NimPlant v1.4". The rule requires the file to be a valid PE file (MZ header).
Page 5 of 9