Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
690 detections
Filters
Last updated
All Time
Detection languages
264
186
49
46
40
Contributors
172
97
71
63
41
Categories
370
145
94
90
85
Platforms
589
49
20
14
8
Products / Services
197
179
89
34
27
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
This rule detects instances where 'dllhost.exe' is spawned by an unusual parent process. Typically, 'dllhost.exe' is spawned by 'svchost.exe' or 'services.exe'. The rule specifically looks for 'dllhost.exe' processes whose parent is neither 'svchost.exe' nor 'services.exe', indicating a potentially malicious or unexpected execution chain.
Detects file creation, modification, or execution events involving the path '/Library/Caches/com.apple.act.mond', which is the hardcoded drop location for the macOS C++ RAT deployed by the Axios supply chain attack.
This rule detects the execution of 'lockapphost.exe' when its parent process is not 'svchost.exe'. 'lockapphost.exe' is a legitimate Windows process responsible for displaying the lock screen and login UI. If it is spawned by an unusual parent process, it could indicate an attempt to bypass the lock screen or manipulate user interface components for malicious purposes, potentially related to persistence or defense evasion.
Detects the creation of a file named "msbuild.exe" within the Windows Startup folder. This behavior matches the persistence and masquerading techniques used by the TeamPCP threat actor following the compromise of the telnyx PyPI package.
This rule detects network connections made by a specific executable ('v20svc.exe') to domains ending with 'app-metrics-cdn.com' and containing specific URL paths ('/api/upload', '/api/upload-json', '/api/upload-complete', '/api/listener/heartbeat'). This combination of indicators is associated with the Venom Stealer malware, often delivered via fake Avast scan websites.
Detects the execution of processes from the '/tmp/pglog' path or where the binary is named 'pglog'. Threat actor TeamPCP utilizes this specific filename to masquerade their downloaded malicious secondary payload as a legitimate PostgreSQL process, following the compromise of the litellm PyPI package.
Detects the loading of 'libcurl.dll' from suspicious or temporary directories such as ProgramData, Users\Public, or Temp. This behavior is associated with DLL side-loading techniques, such as those used by the BRUSHLOGGER keylogger which masquerades as 'libcurl.dll' to execute malicious code and capture keystrokes.
This rule detects processes executing from the `/tmp/pglog` path or with the filename `pglog` within `/tmp/`, which is a known technique used by the TeamPCP threat actor to masquerade malicious binaries as legitimate PostgreSQL processes for post-exploitation activity.
Detects malicious DLLs masquerading as libcurl.dll by identifying a low number of curl_easy_* exports combined with BRUSHLOGGER keylogger string artifacts. Designed to catch DLL side-loading attempts.
Detects the creation or modification of files within the misspelled 'Photoes' directory (e.g., \ProgramData\Photoes\). This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger for storing keystroke log files.
Detects the creation or modification of files within the misspelled 'Photoes' directory (e.g., \ProgramData\Photoes\). This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger for storing keystroke log files.
Detects persistence mechanisms associated with malware signed by TrustConnect Software PTY LTD. The malware establishes persistence by creating a specific Run key or by registering a service masquerading as Adobe Acrobat Reader.
Detects the execution of files signed by "TrustConnect Software PTY LTD", a certificate issuer observed signing malware that impersonates legitimate workplace applications to deploy RMM backdoors. This rule identifies processes launched from binaries associated with this suspicious certificate.
Detects execution of a binary from common staging directories shortly after
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
This rule detects network traffic containing specific User-Agent strings used by the BurrowShell implant and the Rust-based keylogger to masquerade as legitimate Windows Update or browser traffic. These User-Agent strings are 'Windows-Update-Agent/10.0.10011.Client-Protocol/2.50' and 'Mozilla/5.0 (compatible; SecureNet/1.2)'.
Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
This detection rule identifies a persistence mechanism observed in the Dead#Vax campaign. It detects the Windows Script Host (wscript.exe) being launched by the Task Scheduler engine (taskeng.exe or svchost.exe) to execute a VBScript from a suspicious, user-writable directory such as AppData or a specific ProgramData path like 'ProgramData\IntelDriver'. This behavior is indicative of malicious persistence.
Detects the creation of a registry run key named 'OneDrive' that points to an executable located within the user's AppData ClickOnce cache directory. This is a specific persistence technique used by the SloppyLemming actor to execute the BurrowShell loader.
Detects the execution of LuaJIT or renamed variants with a single text, log, or JSON file as an argument, a pattern characteristic of the FakeGit campaign's loader. The rule specifically looks for process creation events where the executable name is one of the known suspicious processes (luajit.exe, lua.exe, vm_s390x.exe, init.exe, luad.exe, gcc.exe) and the command line contains a .txt, .log, or .json file extension. It further refines the detection by checking if the command line has a limited number of arguments (2 or 3), which is typical for the malware's simple execution pattern.
The rule detects the processes that are executed by the Moonrise malware, which is a backdoor used by the APT29 group.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
The rule is based on the analysis of the malware's behavior and the processes it creates during execution.
Detects a process running with a name that mimics a Linux kernel worker thread (e.g., 'kworker/...') but is not running as the root user. This is a known masquerading technique used by malware such as ClipXDaemon to evade detection.
Page 27 of 33