Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule identifies the Potemkin Loader establishing persistence by creating a scheduled task. The scheduled task is configured to execute a Remote Monitoring and Management (RMM) payload upon user logon or system startup. Detection is based on `schtasks.exe` command-line arguments that include `/create`, `/tn` (task name), and `/tr` (task run) pointing to an executable within an AppData directory.
This rule monitors for processes executing from within the 'AppData\Roaming\Traiolx Custom Utils\' directory that subsequently load specific DLLs (7z.dll, normaliz.dll, or user32.dll). This behavior pattern is indicative of potential malicious activity, such as side-loading or execution of masqueraded binaries.
Detects the creation or usage of specific DLLs and batch files within a directory path containing 'Traiolx Custom Utils'. This pattern often suggests the deployment or execution of components related to specific tools or potentially malicious software, leveraging DLL side-loading or path-based execution.
Detects a suspicious execution chain associated with LegionLoader, where a malicious DLL (e.g., normaliz.dll or 7z.dll) is staged in the AppData\Roaming directory followed by the execution of rundll32.exe spawned by msiexec.exe or cmd.exe to load the staged DLL.
Detects potential persistence activity associated with LegionLoader by monitoring for the execution of an MSI installer from user-writable directories (e.g., AppData, Temp), followed by the creation of a scheduled task via schtasks.exe, and the creation of files within the AppData\Roaming directory within a 5-minute window.
Detects the LegionLoader malware using a malicious normaliz.dll staged in user-writable directories (AppData\Roaming\Traiolx Custom Utils) to perform DLL sideloading. The rule correlates this malicious module load with suspicious LOLBin behavior where msiexec.exe executes cmd.exe, forming a known infection chain.
Detects the creation of a Temporary Access Pass (TAP) by a service principal or agent identity, rather than a human administrator. This scenario indicates a potential compromise where a Temporary Access Agent with UserAuthMethod-TAP.ReadWrite.All permission is abused to generate a TAP for a Global Administrator.
This rule monitors for the creation of scheduled tasks using the Windows 'schtasks.exe' utility that contain command-line strings associated with BeepRAT malware activity. Specifically, it identifies task names or configurations used for persistence or payload execution, such as 'WindowsUpdateTempFileCleanUp', 'TCC\\config.ini.c', 'HFY.exe', and various TCC loader arguments.
This rule detects scenarios where an unknown or suspicious executable (named HFY.exe) interacts with Windows binaries commonly used for User Account Control (UAC) bypass attacks, such as eventvwr.exe, fodhelper.exe, and consent.exe. The detection monitors process creation events (Sysmon Event ID 1 or Windows Event ID 4688) for direct execution or parent-child relationships involving these binaries, which are often used to elevate privileges without user interaction.
Detects the use of the 'schtasks.exe' utility with command line arguments containing strings associated with suspicious activity or known malicious patterns, such as file cleanup or configuration manipulation, often used for persistence or stealthy execution.
Detects suspicious process execution patterns associated with the 'HFY.exe' utility, including potential User Account Control (UAC) bypass attempts via auto-elevating Windows binaries like eventvwr, fodhelper, and sdclt, as well as specific command-line parameters for 'tcc.exe'.
Detects indicators of the BeepRAT malware (associated with Operation DragonClone), including specific process execution patterns of HFY.exe, LuaJit.exe, or tcc.exe, network connections to known C2 infrastructure on port 18848, keylogger file creation, and malicious task scheduling or TCC loader execution techniques.
Detects the creation of scheduled tasks using schtasks.exe with command-line arguments that contain suspicious file names, paths, or flags often associated with malicious behavior, such as persistence mechanisms or potential lateral movement tools.
Detects the execution of HFY.exe, a known component of the BeepRAT malware family, along with the presence of its associated sideloaded or dependency DLL files (e.g., data.dll, SQLite.Interop.dll). The rule monitors both process creation events and file system artifacts indicative of the malware's deployment.
This rule detects activities associated with the BeepRAT malware, including the execution of LuaJit.exe with specific command-line arguments (config.ini, temp.bin), the creation of staging files in the TCC local AppData directory, and parent-child process relationships involving a known dropper (HFY.exe). It also utilizes specific SHA256 hashes to identify known malicious BeepRAT binaries.
Detects the creation of scheduled tasks using 'schtasks.exe' with command-line arguments containing specific patterns such as 'WindowsUpdateTempFileCleanUp', 'config.ini.c', 'SchTask_x86', or 'SchTask_x64'. These patterns are often associated with the deployment of malicious persistence mechanisms or software execution.
Detects the execution of tcc.exe with command-line arguments indicative of file operations often associated with UAC bypass techniques. The rule also monitors for the loading of UAC-related DLLs or child processes by tcc.exe, which further suggests activity aimed at gaining elevated privileges.
Detects the creation of WMI event subscriptions, including event filters, consumers, and bindings, performed by wmic.exe, powershell.exe, or pwsh.exe. This activity is commonly used by adversaries to establish persistence or facilitate execution via the Windows Management Instrumentation service.
Detects evidence of SystemBC (Coroxy) malware persistence, characterized by the creation of a scheduled task using 'schtasks.exe' that executes a random binary residing in '%ProgramData%' with a 'start' argument, coupled with concurrent modifications to the Windows 'Run' registry keys in a persistent path.
Detects local privilege escalation attempts targeting the SystemInformer (ProcessHacker) PHSVC service. The rule identifies suspicious child process execution from trusted hosts (rundll32.exe, SystemInformer.exe) occurring simultaneously with a connection to the SiSvcApiPort named pipe, which is indicative of the abuse of the SystemInformer service channel for privilege escalation.
Detects the use of 'docker cp' commands containing path traversal sequences (e.g., '..') in the destination argument. This behavior is indicative of an attempt to escape the container environment and write files to the host filesystem, potentially exploiting the 'docker-cp-copyout' vulnerability.
Page 118 of 401