Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the loading of suspicious DLLs and support files (e.g., systemsettings.dll, dsccorer.mui, syncres.dat, msedge.dll) from atypical AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates these file loads with known MD5 hashes associated with Sharkloader, indicating potential malicious payload execution or side-loading activities.
This rule detects modifications to Windows Registry Run keys that point to suspicious directories associated with the SharkLoader malware (such as 'xwreg' or 'xgdf' subdirectories in AppData) or an abnormally located SystemSettings.exe executable, both of which are common indicators of persistence attempts.
Detects modifications to Windows Registry Run and RunOnce keys that involve suspicious patterns, including specific process names associated with potentially malicious activity (e.g., SystemSettings.exe, SystemSettings.dll, KasperskyLab folders) or the execution of 'reg.exe' to modify these persistence locations.
Detects the loading of DLLs from suspicious locations such as AppData, Temp, or ProgramData into common browser processes. This activity is often associated with process injection techniques like Cobalt Strike's keylogging jobs or other credential theft attempts.
Detects instances where suspicious, non-Windows-standard processes (residing outside of System32 or SysWOW64) spawn or interact with critical system processes like svchost.exe or explorer.exe. This activity is indicative of process injection techniques used by malware loaders, such as SharkLoader, to execute malicious code within the context of trusted system processes to maintain persistence or elevate privileges.
The detection monitors for the loading of specific files ('SyncRes.dat' or 'DscCoreR.mui') that are known to be used as side-loading targets for malicious DLLs. These file names are frequently associated with various malware campaigns leveraging DLL search order hijacking to execute malicious code within the context of trusted applications.
Detects anomalous file activity and process execution associated with the SharkLoader malware family. The rule looks for the loading of specific component files (DscCoreR.mui, SyncRes.dat, SystemSettings.dll) from suspicious directories, as well as the execution of SystemSettings.exe from non-standard AppData or ProgramData paths, which indicates a beacon injection or execution chain.
Detects instances where the legitimate Windows process SystemSettings.exe loads specific DLL files (SyncRes.dat, SystemSettings.dll, or DscCoreR.mui). While these files have benign names, the context of monitoring for their loading by SystemSettings.exe is often used to detect potential DLL hijacking or sideloading attempts where an attacker replaces legitimate system DLLs with malicious ones to achieve code execution.
Detects the installation of a Windows service associated with the TrymeLocker ransomware strain. The rule monitors System and Security event logs for specific service names ('rageservice') or file paths ('win_guard_', 'ragecore_') indicative of this malware's persistence mechanism.
Detects the Windows Update Service (wusvc.exe) loading advapi32.dll or performing suspicious API calls like GetProcAddress to resolve GetUserNameA. This behavior is atypical for the legitimate Windows Update service and may indicate process injection, credential harvesting, or tampering attempts.
Detects the creation of new Windows services that masquerade as or use names associated with the Windows Update Service (wusvc), specifically looking for service binaries located in suspicious paths or containing 'wusvc.exe' in the name. This pattern often indicates an adversary attempting to establish persistence or masquerade malicious processes as legitimate system services.
Detects the creation of a scheduled task named 'RageGuard' or containing 'RageGuard' in its command line, often associated with TrymeLocker malware. The rule monitors for Task Scheduler Event IDs 4698 and 106, as well as schtasks process command line arguments used to create such tasks.
This rule detects potentially malicious Android applications masquerading as security updates that request 'Device Administrator' permissions. Such apps often attempt to gain elevated privileges to maintain persistence, prevent uninstallation, or perform unauthorized administrative actions on the device.
Detects modifications to the 'Run' registry key that include suspicious command-line arguments often used by malware for persistence and evasion. Specifically looks for '-ExecutionPolicy Bypass', '-WindowStyle Hidden', or references to 'AppData\Local\Temp' in the registry data.
Detects the creation or modification of scheduled tasks that either utilize user-writable directories (e.g., AppData, Temp) for task execution or mimic the naming convention of 'OneDrive Standalone Update' tasks. This behavior is indicative of persistence mechanisms used by the StrikeShark campaign to deploy SharkLoader and related payloads, such as Cobalt Strike.
Detects potential Cobalt Strike Beacon behavior where a process originating from AppData or ProgramData injects into a legitimate Windows process (e.g., svchost.exe, explorer.exe, notepad.exe, msiexec.exe). This is followed by the injected host process establishing an outbound HTTPS network connection to an external, non-RFC1918 IP address within 60 seconds.
Detects indicators of the SNOWLIGHT dropper establishing persistence by either creating a malicious Windows service named 'wusvc', modifying the Windows registry to add a service entry for 'wusvc', or executing a 'wusvc.exe' binary from a non-standard file path (outside of System32 or SysWOW64).
Detects the execution of wusvc.exe (Windows Update service) from non-standard locations, specifically the user Downloads folder or locations other than the authorized C:\Windows\System32\ directory. This pattern is commonly used to masquerade malicious payloads as legitimate system services.
Detects modifications to the Winlogon Shell or Userinit registry keys. These keys define the processes that run upon user logon. Adversaries modify these values to achieve persistence by pointing them to malicious binaries or scripts, often identified in this rule by the string 'win_guard_'.
Detects evidence of the SNOWLIGHT dropper establishing persistence by registering malicious services (e.g., 'wusvc', 'RageService') or executing known malicious binaries (e.g., 'wusvc.exe', 'win_guard_0.exe') via service creation utilities or registry modifications.
This rule detects suspicious activity involving the loading of amsi.dll in conjunction with memory protection changes (VirtualProtectApiCall) that often signify an attempt to patch or disable the Antimalware Scan Interface (AMSI) in memory. It specifically monitors for remote thread creation, memory protection modifications involving 'AmsiScanBuffer', and executable memory page allocation within 30 seconds of loading amsi.dll, excluding known trusted Microsoft processes.
Page 132 of 401