Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects evidence of Yuta/Glove Stealer malware establishing persistence. The rule monitors for unauthorized registry modifications to Windows Run keys pointing to suspicious paths (AppData, Temp) or specific files ('winupdate.exe'), and the creation of files within the Windows Startup folder using specific naming conventions such as 'WindowsDefenderAgent' or 'winupdate'.
Detects instances where known Windows binaries frequently abused for User Account Control (UAC) bypass (fodhelper.exe, eventvwr.exe) spawn unexpected child processes. These binaries are trusted system utilities that, when used as an actor for launching other processes, often indicate malicious activity aimed at privilege escalation.
Detects instances where critical Windows host processes (svchost.exe, explorer.exe, or lsass.exe) spawn a new process, which is a common behavioral indicator of process injection or post-exploitation activity. The rule excludes common, legitimate system-level causality chains.
This rule detects potential DLL sideloading by identifying instances where a process executing from a user-writable path (e.g., \Users, \ProgramData, \Temp) loads a DLL that resides in the same directory. This pattern is commonly associated with malicious payloads delivered via phishing archives where a legitimate binary and a malicious DLL are placed in the same folder to facilitate sideloading.
Detects the creation of scheduled tasks using schtasks.exe with suspicious command line parameters or originating from unusual parent processes. This includes tasks created to run as SYSTEM, tasks configured with ONSTART triggers, tasks referencing common temporary directories, or tasks created by processes typically unrelated to scheduled task management (e.g., Teams, remote assistance tools, or command processors).
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
Detects activity associated with the Payouts King ransomware, including identified malicious binary hashes, the creation of Mozilla-themed scheduled tasks for persistence, and execution via command line to elevate tasks to SYSTEM privilege.
Detects the creation of scheduled tasks using schtasks.exe where the command points to payloads residing in user-writable directories such as AppData or Temp. This behavior is indicative of TA4922 malware (e.g., Atlas RAT or RomulusLoader) establishing persistence. The rule excludes common installers and trusted publishers to reduce false positives.
Detects the creation of scheduled tasks that contain indicators related to QEMU virtualization software (e.g., binaries, disk images) or tasks created by web server processes. This behavior is often associated with adversary attempts to establish persistence, hide malicious activity within VM environments, or execute payloads following exploitation of a web application.
Detects a User Account Control (UAC) bypass technique where an adversary modifies the registry keys (HKCU\Software\Classes\mscfile\shell\open\command) to intercept execution when eventvwr.exe is launched. The rule identifies the suspicious registry write followed by the subsequent execution of a child process (like BQT.exe or start.exe) originating from eventvwr.exe.
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
Clipboard hijacking malware for cryptocurrency address substitution
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
Detects instances where the Windows Event Viewer utility (eventvwr.exe) spawns a child process other than the Microsoft Management Console (mmc.exe). This behavior is a well-documented technique for bypassing User Account Control (UAC) because eventvwr.exe is an auto-elevating binary, which can be manipulated to execute arbitrary payloads with high-integrity privileges.
Page 106 of 401