Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
840 detections
Filters
Last updated
All Time
Detection languages
353
219
61
54
37
Contributors
197
144
98
85
71
Categories
540
142
109
106
99
Platforms
700
78
24
23
18
Products / Services
277
188
102
61
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
840
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects Salat Stealer dropping and executing copies of Lightshot.exe in trusted directories such as Windows NT, Edge, and Chrome application paths, as well as process spawn chains involving masqueraded Lightshot executables.
Detects instances where googleupdate.exe is executed or loads DLLs from outside the legitimate Program Files paths, or correlates with v8_context_snapshot.bin file access within a 10-minute window, potentially indicating Google Update binary masquerading or side-loading.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem dataset to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity can be significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
Detects execution of conhost.exe from non-standard directories outside System32, SysWOW64, or WinSxS. Specifically targets drops within the user profile under AppData\Local\Microsoft\Conhost\ or when initiated by node.exe, which can indicate npm preinstall hooks or malware attempting to masquerade or abuse console host execution.
Detects indicators associated with the KNTRAT implant, including the creation of named pipes containing the 'kntrat' prefix and the execution of cmd.exe spawned by a conhost.exe instance running outside of legitimate Windows system directories.
Detects execution or modification of conhost.exe from within a non-standard user-profile path (Microsoft\Conhost), which may indicate an attempt to masquerade or use renamed/relocated utilities.
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects indicators related to CROSSROAD/SHINYROAD/ADAPTAGENT activity, including specific PE version metadata typos ('AOMEI Update Compent'), known file hashes, and Radmin launchers running with the '--runtimechk' argument from the AppData directory.
Detects Windows Portable Executable (PE) files (.exe) written to common user profile directories, such as Desktop, Downloads, Documents, and other user profile folders that lack company name metadata. This activity may indicate potentially untrusted executables, dropped malware, or masquerading attempts in user-writable locations.
The detection may also identify legitimate software, portable applications, development tools, and other benign files.
The detection may also identify legitimate software, portable applications, development tools, and other benign files.
Detects Gryxa staging behavior where files are written across 2 or more distinct toolkit directories (such as WinRTCS, WER .wucache, and Diagnosis .etlcache) within a 1-hour window on a single device.
Detects one MAC address obtaining an unusual number of distinct leases. Legitimate
devices hold a lease and renew it. Rapid cycling suggests either MAC spoofing or a
device deliberately churning addresses to frustrate tracking and evade controls bound
to an IP.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASED'
| duration 1h
| groupby macaddress
| select macaddress, distinct_count(srcip)
| having distinct_count_col1 > 5
devices hold a lease and renew it. Rapid cycling suggests either MAC spoofing or a
device deliberately churning addresses to frustrate tracking and evade controls bound
to an IP.
Onboarding: WIN-DHCP is ingested via Syslog (Bloo extractor 79).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=dhcp where sourcename='WIN-DHCP' and action='IP_LEASED'
| duration 1h
| groupby macaddress
| select macaddress, distinct_count(srcip)
| having distinct_count_col1 > 5
Detects an endpoint flipping between compliant and non-compliant repeatedly in a
short period. Stable devices stay in one state. Rapid oscillation suggests something
is being disabled and restored — a security agent stopped and restarted, or posture
data being manipulated to satisfy the check only when it is being observed.
Onboarding: FORESCOUT is ingested via Syslog (CEF) (Bloo extractor 247).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='FORESCOUT' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy
| select user, policy, count(*) as cnt
| having cnt > 6
short period. Stable devices stay in one state. Rapid oscillation suggests something
is being disabled and restored — a security agent stopped and restarted, or posture
data being manipulated to satisfy the check only when it is being observed.
Onboarding: FORESCOUT is ingested via Syslog (CEF) (Bloo extractor 247).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=compliance where sourcename='FORESCOUT' and action='COMPLIANCE_CHECK'
| duration 1h
| groupby user, policy
| select user, policy, count(*) as cnt
| having cnt > 6
Detects the execution of the SCCM/Configuration Manager notification utility (SCNotification.exe) when it is unsigned or has an invalid/expired signature, excluding standard loaded modules from .NET and assembly directories.
The following analytic identifies system processes running from unexpected locations outside of paths such as `C:\Windows\System32\` or `C:\Windows\SysWOW64`. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process paths, names, and hashes. This activity is significant as it may indicate a malicious process attempting to masquerade as a legitimate system process. If confirmed malicious, this behavior could allow an attacker to execute code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
Detects file events involving NCrypt.exe, which may indicate process execution or file modification related to cryptographic functions or potential masquerading.
The following analytic identifies a popular 3rd party software process being executed where it's process name does not match it's original file name attribute.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
Detects the creation of persistence mechanisms through both Registry Run keys and Scheduled Tasks within a one-hour window, specifically targeting names indicative of masquerading as legitimate update or helper components.
Detects the GOST tunnel binary deployed as svchost.exe from a staging directory, identified by its known hash, or by an unsigned PE importing config.dll with a matching MZ header and embedded config.dll reference (reduces FPs from legitimately signed software that imports a DLL of the same name)
Detects the GOST tunnel binary deployed as svchost.exe from a staging directory, identified by its known hash, or by an unsigned PE importing config.dll with a matching MZ header and embedded config.dll reference (reduces FPs from legitimately signed software that imports a DLL of the same name)
The following analytic identifies a Windows command interpreter process being executed where it's process name does not match it's original file name attribute.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
Page 1 of 40