Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
macOS malware used by JINX-0164 against cryptocurrency developers
Open-source derived remote access trojan with plugin architecture
Detects instances where QEMU-related binaries (qemu-system-x86_64.exe, qemu-system-i386.exe, or ADNotificationManager.exe) load modules from locations other than the standard Windows system directories or the authorized QEMU installation directory. This behavior is indicative of potential DLL side-loading or hijacking attempts, where a malicious DLL is placed in the same directory as the executable to be loaded by the application.
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
Commodity .NET keylogger and remote access trojan
Detects the specific pattern of ADNotificationManager.exe loading the vcruntime140_1.dll, which is a known indicator of DLL side-loading used in the Gold Encounter attack chain.
This rule detects multiple suspicious registry modifications typically associated with threat actor activity. It identifies potential persistence via HKLM Run keys using QEMU-related strings, attempts to tamper with Windows Defender security settings (DisableAntiSpyware/DisableRealtimeMonitoring), and the enabling of WDigest plaintext credentials, which facilitates credential dumping.
This rule detects the creation of a scheduled task using 'schtasks.exe' that involves suspicious filenames or paths, specifically focusing on components associated with QEMU, database files, or known suspicious executables. It further highlights tasks created with high-privilege context (SYSTEM or highest integrity level) or those configured to trigger on system-level events (logon, start, idle), which are common indicators of persistence mechanisms used by attackers.
Detects specific suspicious behaviors associated with the Payouts King ransomware. It monitors for indirect command execution where cmd.exe is spawned by non-shell processes to programmatically execute schtasks, or the direct invocation of schtasks.exe to execute tasks hidden within paths mimicking Mozilla-related directories for persistence.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
Detects the loading of unsigned or improperly signed DLLs by high-value/legitimate Windows binaries (e.g., mmc.exe, OneDrive.exe, teams.exe, rundll32.exe) from user-writable directories such as AppData, Temp, Downloads, or ProgramData. This behavior is indicative of DLL search-order hijacking or DLL side-loading, often used by adversaries to execute malicious code within the context of trusted applications.
Detects the execution of known legitimate QEMU binaries (qemu-system-x86_64.exe, qemu-system-i386.exe) and ADNotificationManager.exe from non-standard, user-writable, or attacker-controlled staging directories. This behavior is indicative of DLL sideloading attacks, where adversaries place malicious DLLs alongside these binaries to achieve code execution.
Identifies the execution of the elementary.pth payload natively triggering on Python interpreter startup. This rule correlates process events for Python execution with file events indicating the presence of an 'elementary.pth' file on the same device.
Detects modifications to Windows Registry Run or RunOnce keys initiated by either a QEMU-based process (qemu-system) or the Windows Registry utility (reg.exe). The rule specifically targets instances where the registry value data points to common temporary directory paths, which is characteristic of the STAC4713/GOLD ENCOUNTER intrusion activity where QEMU-based virtualization is used to facilitate persistence.
Detects instances where an interactive user initiates a password change attempt as captured by Windows Security Event ID 4723. The rule filters out non-interactive accounts (ending with '$') and common service account naming patterns to focus on human-driven account modifications.
Detects persistence and execution behaviors associated with the MYRA Linux RAT. The rule monitors for the installation of a malicious library (.libcache.so) via shell profile modifications, and subsequent execution attempts where a process masquerades as 'systemd-userdbd' while utilizing 'LD_PRELOAD' and fileless execution techniques (memfd_create/fexecve).
Detects execution patterns associated with the Havoc C2 framework's Demon implant. This includes PowerShell loaders with encoded/non-interactive flags spawned by suspicious script interpreters, PowerShell execution spawned from explorer.exe, and suspicious remote thread injection into explorer.exe from unauthorized processes.
Detects a remote support or loader process spawning a suspended process or invoking commands associated with RunPE and hollowing. This rule specifically looks for processes initiated by 'ScreenConnect', 'SimpleRunPE', or 'ClientService' that include command-line arguments indicative of process hollowing or injection techniques such as 'CREATE_SUSPENDED', 'NtUnmapViewOfSection', 'RunPE', 'hollow', or 'process injection'.
Page 107 of 401