Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com, indicating the attacker backend returned status:completed and the kit executed window.location.replace to redirect the victim to OneDrive after token capture. This sequence suggests a successful device code phishing attack where the victim's credentials or tokens have been captured, and they are then redirected to a legitimate service to avoid suspicion.
Detects the execution of known privilege escalation tools such as SweetPotato, JuicyPotato, RoguePotato, PrintSpoofer, and BadPotato. These tools are commonly used by attackers to escalate privileges on compromised Windows systems.
Detects attempts to bypass User Account Control (UAC) by launching specific Windows applications (eventvwr.exe, fodhelper.exe, computerdefaults.exe, slui.exe) that can auto-elevate, when initiated by cmd.exe or powershell.exe. This rule specifically excludes executions from standard system directories (system32, syswow64) to reduce false positives from legitimate system operations.
Targets rundll32 calling a Begin export from a DLL staged in Temp or AppData. The UDM rule retains principal and target context for correlation.
Identifies the execution of a process with 'VirtualSmokestGuy666' in its command line, which is indicative of CastleRAT Build 666 establishing persistence. This specific string suggests a scheduled task or similar mechanism used by the malware to maintain its presence on the system.
Correlates a successful AAD sign-in from a new IP address immediately followed by the registration of a new FIDO2 or Authenticator device, a hallmark of AiTM persistence.
Detects when a browser desktop shortcut (.lnk file) is modified by a setup or update executable, which could indicate a Potentially Unwanted Program (PUP) injecting malicious arguments or redirecting the browser to an attacker-controlled gateway upon launch.
Detects potentially unwanted programs (PUPs) establishing reboot persistence by writing their extracted, secondary malware stage into the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. This rule specifically looks for registry modifications where the value data points to an executable within AppData (Local or Roaming) and the initiating process is an installer, updater, or setup executable.
Detects the alternate Codex persistence mechanism utilizing PowerShell to create WMI Event Filters and Command-line Event Consumers.
Identifies the payload establishing reboot persistence by writing a .plist to the user's ~/Library/LaunchAgents directory and activating it using 'launchctl load'.
Detects AutoIt3.exe allocating memory with read, write, and execute (RWX) permissions into another process's space, which is indicative of a payload injection phase, specifically associated with the Vidar stealer loader.
Detects the Kali365 framework automatically establishing mailbox rules to delete or hide security alerts, finance emails, or replies from the phished user. The rule specifically looks for the creation or modification of inbox rules that involve actions like 'MoveToFolder', 'DeleteMessage', or 'MarkAsRead' and are applied to emails containing keywords such as 'phish', 'security', 'alert', 'finance', or 'invoice'.
Detects suspicious execution patterns involving SystemSettings.exe, specifically when spawned by uncommon binaries (xwreg.exe or xgdf.exe) or when performing thread creation operations, which may indicate process injection or suspicious lateral movement attempts.
Detects the loading of specific suspicious library files (SyncRes.dat, SystemSettings.dll, DscCoreR.mui) from the AppData Roaming directory subfolders 'xwreg' or 'xgdf'. This activity is often associated with file masquerading or persistence techniques where malicious code is executed under the guise of legitimate-sounding system files.
This rule detects processes accessing or loading specific files (such as .mui, .dat, .nls, and .etl files) that are associated with specific naming conventions (xwreg, xgdf) or locations often targeted by malicious DLL search order hijacking or masquerading attempts. By identifying files that mimic or occupy paths related to system resources, the rule aims to uncover activity indicative of persistence or evasion techniques.
This rule detects when 'SystemSettings.dll' is loaded by a process other than the legitimate 'SystemSettings.exe' located in the Windows ImmersiveControlPanel directory. This behavior can be indicative of DLL hijacking or unauthorized code injection into a system-level component.
Detects the use of SharpGPOAbuse or common command-line arguments associated with GPO manipulation, such as creating immediate tasks or modifying domain object ACLs. Additionally, it monitors for suspicious execution of gpupdate.exe with the /force flag, specifically when initiated by unauthorized processes or non-Microsoft signed binaries.
Detects potential persistence mechanisms associated with SharkLoader or similar malware campaigns. The rule monitors for unauthorized modification of Windows Run registry keys by non-Microsoft signed processes, the creation of suspicious scheduled tasks masquerading as legitimate update tasks (e.g., OneDrive or Microsoft updates), and the execution of processes from common malware working directories like 'AppData/Roaming/xwreg' or 'AppData/Roaming/xgdf'.
Detects execution and suspicious behavior associated with the SharkLoader malware, specifically monitoring the masquerading of SystemSettings.exe within user AppData or ProgramData paths. It identifies unauthorized cross-process activities, module loads of specific suspicious DLLs, and potential code injection techniques typical of shellcode staging, such as those used by Cobalt Strike Beacon.
Detects potential PPID spoofing and process injection activity associated with SharkLoader and Cobalt Strike. The rule monitors for cross-process injection into critical system processes or shell spawning from suspicious directories (AppData/Roaming or ProgramData/KasperskyLab), typically used by SharkLoader to stage payloads or perform parent process spoofing.
Detects anomalous activity associated with the SharkLoader malware, which masquerades as the legitimate Windows SystemSettings.exe process. The rule identifies suspicious characteristics such as execution from non-standard directories (AppData), use of MinHook for API hooking, loading of known payload-related files (syncres.dat, dsccorer.mui), and unauthorized remote thread creation.
Page 131 of 401