Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
690 detections
Filters
Last updated
All Time
Detection languages
264
186
49
46
40
Contributors
172
97
71
63
41
Categories
370
145
94
90
85
Platforms
589
49
20
14
8
Products / Services
197
179
89
34
27
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects tools and process executions used by Greenbug in their May 2020 campaign as reported by Symantec
Detects binaries that use the same name as legitimate sysinternals tools to evade detection.
This rule looks for the execution of binaries that are named similarly to Sysinternals tools.
Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.
This rule looks for the execution of binaries that are named similarly to Sysinternals tools.
Adversary may rename their malicious tools as legitimate Sysinternals tools to evade detection.
Detect suspicious parent processes of well-known Windows processes
Detects the creation of a file with the ".dll" extension that has the name of a System DLL in uncommon or unsuspected locations. (Outisde of "System32", "SysWOW64", etc.).
It is highly recommended to perform an initial baseline before using this rule in production.
It is highly recommended to perform an initial baseline before using this rule in production.
Looks for rare process launch as a scheduled task and activity done by the processes.
Author: Jouni Mikkola
More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/
Author: Jouni Mikkola
More info: https://threathunt.blog/hunting-for-malicious-scheduled-tasks/
Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location
Detects filename indicators that contain a specific typo seen used by the Small Sieve malware.
Detects binaries used by the Lazarus group which use system names but are executed and launched from non-default location
Detects Winword starting uncommon sub process MicroScMgmt.exe as used in exploits for CVE-2015-1641
Detects an uncommon svchost parent process
Detects the execution of msiexec.exe from an uncommon directory
Detects the creation of copy of suspicious files (EXE/DLL) to the default GPO storage folder
'This hunting query looks for file paths/hashes related to observed activity by Dev-0228. The actor is known to use custom version of popular tool like PsExec, Procdump etc. to carry its activity.
The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.'
The risk score associated with each result is based on a number of factors, hosts with higher risk events should be investigated first.'
'This query identifies modifications to COM registry keys to point to executable files in C:\Windows\System32\spool\drivers\color\'
'This query looks for writes of PE files to C:\Windows\System32\spool\drivers\color\.
This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This is a common directory used by malware, as well as some legitimate programs, and writes of PE files to the folder should be monitored.
Ref: https://www.microsoft.com/security/blog/2022/07/27/untangling-knotweed-european-private-sector-offensive-actor-using-0-day-exploits/'
This rule detects the creation of specific files associated with the Kapeka backdoor. It looks for files created in common application data directories (ProgramData or AppData\Local) that have a 5-6 character alphanumeric name followed by a ".wll" extension. Additionally, it specifically looks for files named "win32log.exe" or "crdss.exe" in these locations, which are known indicators of the Kapeka backdoor. The Kapeka dropper disguises these files as legitimate to evade detection.
Detects the creation of new pods within the `kube-system` namespace. This activity is suspicious because attackers might create pods with names similar to legitimate system components (e.g., `kube-proxy-bv61v`) to masquerade as system pods and evade detection. Legitimate system pods created by controllers typically have random suffixes in their names. This rule specifically looks for `create` operations on `pods` within the `kube-system` namespace.
This analytic detects the execution of a renamed `rclone.exe` process, which is commonly used for data exfiltration to remote destinations. This detection leverages Endpoint Detection and Response (EDR) telemetry, focusing on process names and original file names that do not match. This activity is significant because ransomware groups often use RClone to exfiltrate sensitive data. If confirmed malicious, this behavior could indicate an ongoing data exfiltration attempt, potentially leading to significant data loss and further compromise of the affected systems.
This analytic identifies the execution of Living Off The Land Binaries and Scripts (LOLBAS) from unexpected file paths. LOLBAS are legitimate Windows binaries that can be abused by threat actors for malicious purposes, such as defense evasion or code execution. The rule specifically looks for processes that are identified as LOLBAS tools but are executed from a directory other than their standard or expected system locations (e.g., outside of Program Files, System32, or SysWOW64). This behavior can indicate an adversary attempting to bypass security controls or execute malicious code in a stealthy manner.
The analytic detects potential MSC EvilTwin loader exploitation, which manipulates directory paths with spaces to bypass security controls. The technique, described as CVE-2025-26633, involves crafting malicious MSC files that leverage MUIPath parameter manipulation. This detection focuses on suspicious MSC file execution patterns with unconventional command-line parameters, particularly those containing unusual spaces in Windows System32 paths or suspicious additional parameters after the MSC file. If confirmed malicious, this behavior could allow an attacker to execute arbitrary code with elevated privileges through DLL side-loading or path traversal techniques.
The following analytic detects an anomaly where an svchost.exe process is spawned by a parent process other than the standard services.exe. In a typical Windows environment, svchost.exe is a system process that hosts Windows service DLLs, and is expected to be a child of services.exe. A process deviation from this hierarchy may indicate suspicious behavior, such as malicious code attempting to masquerade as a legitimate system process or evade detection. It is essential to investigate the parent process and associated behavior for further signs of compromise or unauthorized activity.
Page 32 of 33