Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
58
33
7
2
2
Contributors
22
14
11
8
8
Categories
48
21
15
12
11
Platforms
84
8
4
3
3
Products / Services
21
19
15
6
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects enabling Hide500Users in com.apple.loginwindow preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
Detects the creation or modification of TxF CLFS log files (FsTxLog.blf) within the System Volume Information directory, which is a primary staging mechanism for the YellowKey BitLocker bypass. The rule also identifies potential VMware MAC OUI within the Resource Manager GUID, indicating a high-confidence proof-of-concept artifact.
Detektiert Gremlin Stealer TTPs wie Crypto-Clipping oder Session-Hijacking durch Analyse von verdächtigen Prozessbefehlen und Ressourcen-Manipulation laut Unit 42 Bericht.
Detects execution of the "mount" command with "hidepid" parameter to make invisible processes to other users from the system
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
Detects when an attacker tries to hide from Sysmon by disabling or stopping it
Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
Detect creation of suspicious executable file names.
Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.
Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Detects a potentially suspicious execution of a parent process located in the "\Users\Public" folder executing a child process containing references to shell or scripting binaries and commandlines.
Detects disabling the CrashDump per registry (as used by HermeticWiper)
Detects registry modifications to the Run key via reg.exe that include the conhost.exe executable with the undocumented --headless parameter. This technique is used by EtherRAT for persistent, stealthy execution of its Node.js payloads.
Detects registry modifications to the SpecialAccounts\UserList key, setting a value to 0 to hide an account from the Windows login screen. This technique is observed in the CTRL framework to conceal backdoor accounts (e.g., Administrator, Admin, Windows).
KQL Query from file: INC Ransomware Command Execution
Detects the creation of a hard link using mklink.exe, where the source is in C:\ProgramData and the destination is an executable in a user's AppData or Temp directory. This technique was observed in an APT36 campaign to stage and execute payloads while evading path-based detections.
Detects a process performing rapid, high-volume file system enumeration across multiple drives while deliberately avoiding critical system directories, a behavior consistent with the reconnaissance phase of Gunra ransomware.
Detects scheduled task creation configured to execute WindowsSandbox.exe, often used to evade EDR by running malware in an isolated container.
Detects .wsb configuration files created in common staging directories used by attackers for malware deployment.
Detects Windows Sandbox launched by non-interactive accounts such as SYSTEM or service accounts, indicating automated malicious execution.
Detects Windows Sandbox execution with a .wsb configuration file, often used to automate malicious sandbox environments for defense evasion.
Page 3 of 6