Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
840 detections
Filters
Last updated
All Time
Detection languages
353
219
61
54
37
Contributors
197
144
98
85
71
Categories
540
142
109
106
99
Platforms
700
78
24
23
18
Products / Services
277
188
102
61
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
840
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects a potential BADAUDIO DLL Sideloading persistence attempt, a technique used by APT24. The rule looks for the creation of a DLL, an executable, and a script/shortcut file (VBS, BAT, LNK) in a common user directory within a short time frame.
This detection identifies instances where critical Windows kernel files (ntoskrnl.exe, ntoskml.exe, ntoskrnl64.exe) are executed or manipulated outside of standard system directories (e.g., C:\Windows\System32, C:\Windows\WinSxS). It focuses on processes exhibiting suspicious behaviours such as code injection, driver loading, hooking, or memory mapping/unmapping, while excluding benign system processes like services.exe, trustedinstaller.exe, and dism.exe. It also filters out temporary files created by common browsers (e.g., Chrome, Edge) to reduce false positives. This activity is indicative of potential malicious kernel-level manipulation, such as unauthorised drivers, rootkits, or other advanced persistent threats attempting to bypass security controls.
Detects the execution of legitimate tools (like sshd, tor, obfs4proxy) or their renamed counterparts from user-writable directories, specifically within AppData folders. This technique is associated with Operation SkyCloak to establish persistence and covert communication channels by masquerading as legitimate software.
Detects the renaming of an existing computer account to an account name that doesn't contain a '$' symbol, which is a key indicator of the CVE-2021-42287 (SamAccountName Spoofing) attack. This technique is often used to impersonate a Domain Controller.
This rule detects the ToxicEye Remote Access Trojan (RAT) based on specific byte patterns, configuration strings, and various other strings found within the malware's executable. The rule is split into three parts: one for identifying specific instruction sequences related to configuration settings (e.g., cryptocurrency addresses, file encryption types, installation paths, autorun settings, anti-VM capabilities), another for wide character strings indicative of ToxicEye's internal messages, C2 infrastructure, and data exfiltration targets, and a third for ASCII strings related to its internal components and functionalities. The combined conditions aim to provide high confidence detection of ToxicEye.
This rule detects Portable Executable (PE) files that masquerade as PDF documents by embedding specific PDF-themed icons. The rule checks for the standard PE file magic bytes and then hashes the first resource (typically the icon) of the PE file. If the hash matches any of the known hashes for PDF red icons, it triggers an alert. This technique is commonly used by attackers to trick users into executing malicious files that appear to be benign PDF documents.
This rule detects the execution of a renamed 'dctask64.exe' binary. 'dctask64.exe' is a legitimate, signed executable by ZOHO Corporation, part of ManageEngine Endpoint Central. Adversaries can abuse this binary for malicious purposes such as DLL injection, arbitrary command execution, and process execution. The detection logic specifically looks for process creation events where the image hash matches known hashes of 'dctask64.exe' but the filename is not 'dctask64.exe', indicating a potential masquerading attempt.
Detects when a 7-Zip process creates an executable file in a sensitive system directory. This could indicate exploitation of a vulnerability like CVE-2025-11001 or CVE-2025-11002, where a malicious archive writes a file to an unexpected location to achieve persistence or code execution.
This analytic detects instances of 'svchost.exe' spawning Living Off The Land Binaries and Scripts (LOLBAS) processes. It leverages Endpoint Detection and Response (EDR) data to monitor child processes of 'svchost.exe' that match known LOLBAS executables. This activity is significant as adversaries often use LOLBAS techniques to execute malicious code stealthily, potentially indicating lateral movement or code execution attempts. If confirmed malicious, this behavior could allow attackers to execute arbitrary commands, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location. This can indicate an attempt by an adversary to masquerade malicious executables as legitimate system processes to evade detection.
The following analytic identifies the creation of executables or scripts in suspicious file paths on Windows systems. It leverages the Endpoint.Filesystem data model to detect files with specific extensions (e.g., .exe, .dll, .ps1) created in uncommon directories (e.g., \windows\fonts\, \users\public\). This activity is significant as adversaries often use these paths to evade detection and maintain persistence. If confirmed malicious, this behavior could allow attackers to execute unauthorized code, escalate privileges, or persist within the environment, posing a significant security threat.
The following analytic identifies processes running from file paths not typically associated with legitimate software. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment.
The following analytic identifies processes running from %temp% directory file paths. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment.
Detects the creation of executable files with names identical to legitimate Windows system processes in directories other than their standard system locations (e.g., System32, SysWOW64). This technique is often used by adversaries for defense evasion and masquerading to blend malicious executables with legitimate system files.
This rule detects when specific Windows executables (csrss.exe, lsass.exe, RuntimeBroker.exe, sihost.exe, smss.exe, wininit.exe, winlogon.exe, dllhost.exe, rundll32.exe, svchost.exe) write files with suspicious extensions such as .bat, .dll, .exe, .hta, .iso, .ps1, .txt, .vbe, and .vbs. This behavior can indicate defense evasion or other malicious activity where legitimate system processes are abused to drop or create malicious files.
Detects the creation of files with names used by Yurei ransomware to masquerade as legitimate system processes or backups in unusual locations.
Detects potential credential harvesting attempts through LSASS memory dumps using ProcDump.
This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.
LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.
Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.
This rule identifies suspicious command-line patterns that combine memory dump flags (-ma, -mm, -mp) with LSASS-related process markers.
LSASS (Local Security Authority Subsystem Service) contains sensitive authentication data including plaintext passwords, NTLM hashes, and Kerberos tickets in memory.
Attackers commonly dump LSASS memory to extract credentials for lateral movement and privilege escalation.
This rule detects instances of 'WerFaultSecure.exe' being spawned by an unusual or unexpected parent process. 'WerFaultSecure.exe' is a legitimate Windows component responsible for error reporting and crash dumping. Adversaries may abuse this process, particularly for memory dumping (e.g., LSASS dumping) to evade defenses and escalate privileges. The rule identifies parent processes that are not part of a predefined list of legitimate parents (wermgr.exe, svchost.exe, csrss.exe, WerFault.exe). It assigns a suspicion score and risk level based on the initiating process's filename (e.g., PowerShell, CMD, Explorer) and folder path (e.g., Temp, AppData, Users). It also extracts the target Process ID (PID) and dump type from the command line, and checks for suspicious parameters, to provide a comprehensive risk assessment.
Detects the creation or modification of specific files identified as indicators of compromise (IOCs) used by UNC4841 in their exploitation of Barracuda ESG appliances. These files are associated with various stages of the attack, including persistence, execution, and defense evasion.
Detects the presence of the "u202+E" character in command lines, which causes a terminal, browser, or operating system to render text in a right-to-left sequence. This technique is used for obfuscation and masquerading to make malicious files appear benign.
Detects Windows executables that write files with suspicious extensions
Page 33 of 40