Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects potential VILE ransomware activity by identifying a specific combination of Windows token manipulation APIs (e.g., AdjustTokenPrivileges, DuplicateTokenEx) paired with the usage of VILE-specific direct NT syscalls (NtCreateWaitCompletionPacket, ProcessPrng) within the same process context. This behavioral pairing serves as a high-fidelity indicator of VILE ransomware execution.
Detects Pay2Key ransomware attempting DLL search order hijacking against Avast Antivirus components. The rule monitors for two behaviors: Windows system DLLs (e.g., powrprof.dll) being loaded from the Avast installation directory, and Avast-specific component DLLs (e.g., snxhk.dll, ashBase.dll) being loaded from non-standard file paths outside the legitimate Avast software installation directory.
Detects Grixba infostealer execution from the C:\Users\Public\Music\ staging path, identified by the creation of RWX (PAGE_EXECUTE_READWRITE) memory regions and the registration of Vectored Exception Handlers (VEH). These behaviors are indicative of advanced process injection techniques used during the preparation phase of malware execution, often associated with the Play Ransomware group.
Detects the execution of the Grixba infostealer, associated with the Play Ransomware group, which is known to perform ntdll EDR unhooking. The rule specifically monitors the launch of the identified malicious binary (Gt_net.exe or GT_NET.exe) from the C:\Users\Public\Music\ directory, a behavior observed consistently across Grixba versions.
Detects cross-process activity (such as process injection or handle access) initiated by the Windows Update service (wusvc.exe) where the executable is not digitally signed by Microsoft Corporation. This behavior is highly suspicious as the legitimate wusvc.exe should always be signed by Microsoft, and this may indicate process masquerading or a compromised service binary.
Detects modifications to Windows Active Setup registry keys involving suspicious StubPath values or the creation of the specific {RAGE-MASTER} registry key associated with TrymeLocker malware. This technique is used to maintain persistence by executing malicious code upon user login.
Detects the execution behavior associated with the VILE ransomware, specifically focusing on the combination of privilege manipulation API usage (e.g., AdjustTokenPrivileges, DuplicateTokenEx) and the creation of known ransomware-related artifacts like configuration files or decoy files.
Detects the spawning of suspicious child processes (e.g., cmd.exe, PowerShell, node.exe, calc.exe) by the Lunar Client application. This behavior is indicative of an exploit targeting the Electron framework's preload IPC bridge, allowing a renderer process to execute commands or gain elevated privileges on the host system.
This rule detects logon events from Windows Admin Center (WAC) virtual accounts where the associated user principal name (UPN) belongs to an external or unknown tenant. This activity is a key indicator of compromise for CVE-2026-20965, where an attacker uses a forged token from an external tenant to gain unauthorized access.
Detects the execution of CbsMsgApi.exe, which is the initial loader used by the REF4033 group to install the BADIIS IIS module and create a persistence service. The detection is based on the specific filename or the known MD5 hash of the loader.
Detects evidence of AnyDesk exploiting an COM impersonation vulnerability via the adprinterpipe named pipe. The rule monitors for AnyDesk spawning SYSTEM-level child processes, interaction with the adprinterpipe, or modification of critical print-related registry keys.
Detects indicators of an npm infostealer campaign, specifically identifying the execution of obfuscated JavaScript payloads disguised as font files (e.g., fa-solid-400.woff2) or eslint-loaders by Node.js, and the creation of a '_V' file used as a persistence marker to prevent redundant execution.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
This rule detects the creation and execution of scheduled tasks used by StrikeShark's SharkLoader, often associated with Cobalt Strike, for persistence. It identifies suspicious scheduled task names that mimic legitimate Microsoft services (e.g., OneDrive, MicrosoftUpdate) and the execution of 'SystemSettings.exe' from unusual 'AppData' subdirectories ('xwreg' or 'xgdf'). The rule has three branches: detecting 'schtasks.exe' command-line usage to create such tasks, detecting 'ScheduledTaskCreated' events with the suspicious names or command patterns, and detecting 'SystemSettings.exe' execution from the specific 'AppData' subdirectories.
This rule detects potential memory-resident malware or staging activity by identifying instances where a high volume of DLL, OCX, or SYS files are loaded from user-writable directories (Temp, AppData, Users) on a specific device within a one-hour window. A threshold of 5 or more unique image loads from these locations is flagged as potentially suspicious, as it may indicate an attacker loading multiple malicious components or modules.
Detects MFA factor activation, device enrollment, and password resets originating from residential/commercial proxy infrastructure, often associated with threat groups like BlackFile/UNC6671/Cordial Spider.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects attempts to modify or bypass AppArmor security profiles using utilities such as aa-complain, aa-disable, or apparmor_parser, correlated with process execution involving user namespace unsharing (e.g., via unshare or CLONE_NEWUSER/CLONE_NEWNET). This combination suggests an attacker attempting to weaken host security controls or perform a container breakout or privilege escalation by manipulating kernel-level namespaces and security policies.
Detects execution of exploit binaries associated with CVE-2026-46331 (pedit COW) or the abuse of legitimate 'tc' (traffic control) and 'unshare' utilities to perform page cache corruption and privilege escalation in user namespace contexts.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions. This behavior is indicative of an information stealer attempting to exfiltrate sensitive browser data.
This rule detects potential persistence mechanism installation by monitoring the creation of registry values in 'Run' or 'RunOnce' keys, followed by the execution of 'powershell.exe' or 'wscript.exe' on the same host within a 5-minute window.
Page 100 of 401