Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects instances where the WinRAR or Unrar process writes a new executable or script file to the Windows Startup folder or ProgramData directory within a 30-second window. This behavior is commonly associated with archive extraction-based persistence or staging of malicious files.
Detects PowerShell scripts containing combinations of low-level memory manipulation functions (e.g., VirtualProtect, NtProtectVirtualMemory) and .NET instrumentation or API access functions (e.g., Marshal.Copy, DllImport) commonly used in fileless malware to facilitate process injection or memory-resident payload execution.
This rule detects a multi-stage attack sequence starting with WinRAR creating an LNK file in the Windows Startup directory for persistence, followed by the execution of a minimized command prompt, and finally a PowerShell script executing hidden content from the ProgramData directory using IEX (Invoke-Expression).
Detects device registration or join activity by an account shortly after a risky sign-in or policy-lure interaction, indicating potential compromise of the account.
Detects attempts to bypass User Account Control (UAC) by abusing 'eventviewer.exe'. This rule specifically looks for 'eventviewer.exe' being initiated by suspicious processes like 'powershell.exe', 'cmd.exe', 'rundll32.exe', or 'Optimax.dll', while excluding legitimate command-line usage of 'eventvwr.exe'.
Detects the Chromelevator loader (drun.exe) performing reflective injection of an encrypted payload DLL into a remote process using direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR hooks. Also detects the spawned vt-windows-event-stream.exe helper process.
Detects the creation or modification of '.env' files within '.gemini' directories, often found in CI/CD pipelines or developer environments. This activity may indicate an attempt to inject malicious environment variables to hijack the execution flow of the Gemini CLI or related tooling.
This rule detects suspicious inter-process communication (IPC) attempts using WM_COPYDATA messaging, where processes (often script interpreters or unsigned binaries) interact with high-value GUI-based applications (like browsers or shell environments). This pattern is a common indicator of process injection techniques, such as hijacking existing Windows callbacks to execute code within the context of a target process.
Detects potential cross-process memory injection activity by monitoring for a non-debugger process that performs both NtAllocateVirtualMemory and WriteProcessMemory operations against a sensitive GUI target process within a short 5-minute correlation window.
Detects when a single session identifier is used to access multiple cloud applications, where at least three distinct applications are accessed within an hour, and these applications were not part of the original interactive sign-in. This behavior can indicate a token replay attack, specifically as described in the Elastic Security Labs research on Tycoon 2FA AiTM detection engineering.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by performing in-memory patching of the AmsiScanBuffer function within amsi.dll. The rule identifies suspicious memory manipulation operations (VirtualProtect, WriteProcessMemory) performed by script hosts (PowerShell, WScript, CScript) involving PAGE_EXECUTE_READWRITE permissions or specific memory modification patterns (0xB8 opcode patching) indicative of disabling security scanning capabilities.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring specific registry modifications (ms-settings, mscfile) and the unexpected execution of child processes from high-integrity binaries like fodhelper.exe and eventvwr.exe, or processes launched with the runas command from high-integrity contexts.
Detects AutoHotkey (AHK) scripts spawning specific .NET Framework processes (cvtres.exe, AddInProcess32.exe, AppLaunch.exe, aspnet_compiler.exe), which is indicative of process hollowing, often used by malware like AsyncRAT to inject malicious code into suspended legitimate processes.
Detects execution patterns associated with the DirtyClone local privilege escalation exploit. The rule monitors for the execution of the exploit binary, compilation of related exploit source code, the creation of combined user and network namespaces via unshare, manipulation of IPsec xfrm states/policies by unprivileged users, and the spawning of a root shell via su. These activities are indicative of an attempt to elevate privileges from an unprivileged context to root.
Detects the modification or creation of registry values within the Windows Run or RunOnce keys. These keys are commonly abused by adversaries for persistence to ensure that malicious code or scripts execute automatically when a user logs in. The rule includes exclusions for common legitimate installers and signed applications from well-known publishers to reduce noise.
Detects cross-process activity where a non-Microsoft signed process or an unsigned process attempts to inject code into high-value Windows system processes, such as lsass.exe, explorer.exe, or svchost.exe. This activity is indicative of malicious code injection or process hollowing, often used to achieve privilege escalation or persistent stealth.
This rule detects the execution of PowerShell with hidden window styles and encoded commands that is correlated with a concurrent update to Windows Registry Run or RunOnce keys. This combination is a common technique used by malware and adversaries to establish persistence on a host system.
Detects suspicious command-line execution patterns involving common SSH files and utilities, such as access to SSH keys, known_hosts, authorized_keys, or suspicious configuration flags. This pattern often indicates attempts to harvest SSH credentials, bypass host key checking, or facilitate persistent remote access. The rule specifically looks for these actions when performed by standard shell utilities or automated tools.
Detects the modification or creation of registry values within the Windows Run or RunOnce keys. These keys are commonly abused by adversaries for persistence to ensure that malicious code or scripts execute automatically when a user logs in. The rule includes exclusions for common legitimate installers and signed applications from well-known publishers to reduce noise.
Detects cross-process activity where a non-Microsoft signed process or an unsigned process attempts to inject code into high-value Windows system processes, such as lsass.exe, explorer.exe, or svchost.exe. This activity is indicative of malicious code injection or process hollowing, often used to achieve privilege escalation or persistent stealth.
Detects the creation or manipulation of WMI event subscriptions using wmic.exe, powershell.exe, or mofcomp.exe. These tools are commonly abused by adversaries to establish persistence by triggering malicious code execution via WMI event filters, consumers, and bindings.
Page 124 of 401