Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,243 detections
Filters
Last updated
All Time
Detection languages
464
342
149
95
72
Contributors
278
169
159
101
91
Categories
429
320
215
200
195
Platforms
1,080
66
40
37
19
Products / Services
268
245
165
144
141
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,243
CVEs
4
4
4
2
2
IDS Classtypes
3
IDS Protocols
1
1
Detects modification of the VSCode settings.json file by a process other than VSCode itself. This could indicate an attempt to exploit vulnerabilities where an attacker tricks a user into applying a malicious configuration to achieve remote code execution.
This rule detects various activities associated with the FoxKitsune malware, including network staging, suspicious file drops in SysWOW64, unusual svchost execution, service persistence, and attempts to tamper with Windows Defender. It correlates these events to identify potential FoxKitsune infections.
Detects the deletion of Kubernetes log events, which could indicate an attempt at defense evasion or covering tracks by an attacker. The rule looks for 'delete' operations on 'Event' resources while excluding actions by 'ci-admin*' or 'system:*' users to reduce false positives.
Detects a specific obfuscated PowerShell command-line pattern used by the LunarApplication malware to execute scripts from the %TEMP% directory while bypassing execution policies. This rule looks for PowerShell processes with specific flags to bypass execution policy and accept piped input, combined with distinctive randomized script extensions (.yiz.ps1 or .unx.ps1) typically used by this malware.
Strings based rule for burntcigar malware
Detects an adversary stopping or killing the syslog daemon (syslog,
rsyslog, or syslog-ng), which is responsible for forwarding system
events to /var/log and to SIEM collectors.
Stopping the syslog daemon is distinct from clearing existing logs --
it cuts the live telemetry pipeline at the source. Any activity
occurring after the daemon is stopped produces no log records
whatsoever, creating a blind spot.
rsyslog, or syslog-ng), which is responsible for forwarding system
events to /var/log and to SIEM collectors.
Stopping the syslog daemon is distinct from clearing existing logs --
it cuts the live telemetry pipeline at the source. Any activity
occurring after the daemon is stopped produces no log records
whatsoever, creating a blind spot.
Detects deleting of K8s log events. Indicating Defense Evasion tactics, and covering of tracks.
This rule detects attempts to add a file or path exclusion to Microsoft Defender using the WMI command-line tool (wmic.exe/wmice.exe). This is a known defense evasion technique used by malware like MKDOOR to prevent detection.
Regex based Rule for burntcigar malware
Detects the modification or deletion of specific JavaScript or Python files shortly after a Node.js or Python interpreter starts. This behavior is characteristic of the 'self-patching' and 'evidence removal' techniques used by the Lazarus Group's Graphalgo malware.
Detects EDR suspension attacks using WerFaultSecure.exe to freeze security agents via Windows Error Reporting service, creating detection blind spots for credential dumping or lateral movement
Detects attempts to tamper with Windows Defender settings using PowerShell. This includes adding exclusions for paths/extensions or disabling real-time monitoring, which are techniques used by malware like the PHALT#BLYX campaign to evade detection.
SPL Query from file: Defender Exclusion Added via WMIC
Detects the use of WMIC to add a file path to the Microsoft Defender exclusion list. This specific command structure is a known technique used by the MKDOOR backdoor to evade detection.
Detects the modification of Microsoft Office Trust Center settings to weaken macro security policies. This is a common technique used by attackers to enable malicious macros in documents, bypassing default security controls.
Detects the modification of registry keys to disable Windows Defender Credential Guard. Disabling this security feature can expose credentials to theft and is a common precursor to lateral movement.
This rule detects attempts to disable Windows Defender and Windows Firewall via registry modifications using the 'reg add' command. Specifically, it looks for command-line arguments that include 'add', 'REG_DWORD', and keywords related to disabling Defender features (DisableAntiSpyware, DisableBehaviorMonitoring, DisableRealTimeMonitoring, DisableOAVProtection) or the 'mpssvc' service, along with setting the value to '4' or '1'. This activity is often associated with malware attempting to evade security controls.
Detects the use of custom kill signals (-900, -901) which are used by the ShadowGuard eBPF rootkit to add or remove a process from its allow-list for kernel-level concealment.
Detects the use of non-standard signals with the 'kill' command, which are used to manage the ShadowGuard eBPF rootkit's process hiding capabilities. Signal -900 is used for allow-listing a PID, and -901 is used to remove a PID from the allow-list.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to add an exclusion (Path, Process, or Extension) to Microsoft Defender. This technique is used by malware, such as the MKDOOR backdoor, to prevent detection by security products.
Detects a rapid, repeated termination of known security tool processes within a short time frame. This behavior is indicative of an "EDR killer" malware attempting to disable security controls in a continuous loop.
Page 33 of 60