Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
58
33
7
2
2
Contributors
22
14
11
8
8
Categories
48
21
15
12
11
Platforms
84
8
4
3
3
Products / Services
21
19
15
6
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects suspicious activity related to the Windows Subsystem for Linux (WSL), such as installing new distributions (especially penetration testing ones like Kali), importing custom images, or executing commands non-interactively. Attackers may use WSL to run malicious Linux binaries, hide artifacts, and evade defenses.
Detects the creation or modification of registry values used by the HIDDENDRIVER rootkit to configure its hiding and protection capabilities. This rootkit, a modified version of the open-source "Hidden" project, uses these registry entries to define which files, processes, and registry keys to conceal. This activity is associated with the REF3927 threat actor and the TOLLBOOTH malware campaign.
Detects the disabling of crash dumps by modifying the 'CrashControl' registry key to set the 'CrashDumpEnabled' value to 0. This activity has been observed in malware like HermeticWiper to hinder forensic analysis.
Detects when a 7-Zip process creates an executable file in a sensitive system directory. This could indicate exploitation of a vulnerability like CVE-2025-11001 or CVE-2025-11002, where a malicious archive writes a file to an unexpected location to achieve persistence or code execution.
Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
Detects scenarios where an attacker enables the WSL to cary out malicious activities in a virtual instance to avoid detection.
Detects scenarios where an attacker modifies the "configuration" partition in order to obfuscate sneaky changes that will allow him to introduce a stealthy AdminSDholder backdoor.
This rule detects the installation of VirtualBox drivers or the initiation of VirtualBox virtual machines. Adversaries, particularly ransomware groups like Ragnar Locker and Maze, have been observed using virtual instances to execute malicious operations, thereby evading detection by security tools on the host system. The rule specifically looks for command-line arguments related to VirtualBox driver components (VBoxRT.dll, VBoxC.dll, VBoxDrv.sys) or commands used to start/control virtual machines ('startvm', 'controlvm').
Detects network connections using DNS over TLS (DoT) on port 853 or DNS over HTTPS (DoH) to known public resolvers from non-browser processes. This activity can indicate an attempt to bypass network security controls and monitoring by hiding DNS queries within encrypted traffic.
Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign, often used with an append redirection operator ">>" to update file content indirectly. This technique can be used by attackers to append data to files, as demonstrated by the example: `cmd /c >> example.txt set /p="test data"` which appends "test data" to "example.txt". The rule specifically looks for `cmd.exe` executions containing `/c set /p=` or `"set /p=` or `>>*set /p=` in the command line.
Once executed, colorcpl.exe will copy the arbitrary file to c:\windows\system32\spool\drivers\color\
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
Detects the execution of Process Hacker based on binary metadata information (Image, Hash, Imphash, etc).
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Process Hacker is a tool to view and manipulate processes, kernel options and other low level options.
Threat actors abused older vulnerable versions to manipulate system processes.
Detect creation of suspicious executable file names.
Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.
Some strings look for suspicious file extensions, others look for filenames that exploit unquoted service paths.
Detects when an adversary is trying to hide it's action from Sysmon logging based on error messages
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
'This query detects domain user accounts creation (event ID 4720) where the username ends with $.
Accounts that end with $ are normally domain computer accounts and when they are created the event ID 4741 is generated instead.
Ref: https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights.html'
Accounts that end with $ are normally domain computer accounts and when they are created the event ID 4741 is generated instead.
Ref: https://blog.menasec.net/2019/02/threat-hunting-6-hiding-in-plain-sights.html'
Adversaries can carry out malicious operations using a virtual instance to avoid detection. This rule is built to detect the registration of the Virtualbox driver or start of a Virtualbox VM.
The following analytic detects the use of the Windows binary attrib.exe to hide files or directories by marking them with specific flags. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line arguments that include the "+h" flag. This activity is significant because hiding files can be a tactic used by attackers to conceal malicious files or tools from users and security software. If confirmed malicious, this behavior could allow an attacker to persist in the environment undetected, potentially leading to further compromise or data exfiltration.
'This detection will go over the heartbeats received from the agents of Domain Controllers over the last hour, and will create alerts if the last heartbeats were received an hour ago.'
Detects the execution of System Informer, a task manager tool to view and manipulate processes, kernel options and other low level operations
Page 4 of 6