Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the creation of a scheduled task named 'RageGuard' correlated with commands known to inhibit system recovery, such as modifying boot configuration with bcdedit or deleting volume shadow copies/backups using vssadmin or wbadmin, within the same process execution chain.
This rule detects unauthorized modifications to the ImagePath registry value for the Windows Update service (wusvc). By changing this path to a non-standard executable or DLL, an attacker can achieve persistence and elevate privileges by having their code execute when the service starts.
This rule detects potential malicious activity by tracking the aggregation of multiple distinct persistence mechanisms on a single host. It triggers when a single process is associated with at least four unique types of persistence-related events, such as scheduled task registration, startup folder file creation, registry run key updates, Winlogon configuration changes, IFEO modifications, or service registration.
Detects unauthorized User Account Control (UAC) bypass attempts involving the SNOWLIGHT dropper (UNC5221). The rule identifies child processes running at High or System integrity levels that were spawned by a Medium integrity parent process. It specifically triggers when the child binary contains a 'requireAdministrator' manifest, suggesting silent elevation without a user prompt, and exhibits process token impersonation capabilities.
Detects the SNOWLIGHT dropper creating a malicious Windows Service masquerading as the legitimate 'Windows Update Service' (wusvc), followed by outbound TLS network connections to non-Microsoft infrastructure within a 2-minute window. This behavior is indicative of C2 communication from a compromised system.
Detects the unauthorized deletion of cmd.exe from System32 or SysWOW64 by a non-system process, correlated with the creation of a new service or scheduled task on the same host within 60 seconds, which is characteristic of TrymeLocker malware persistence and tampering.
Detects unauthorized privilege escalation attempts within the MyBB Admin Control Panel (ACP) by monitoring limited-privilege accounts accessing restricted modules (e.g., plugins, templates, user groups). It correlates these web requests with file system changes in the plugin directory by the web server process and monitors application logs for suspicious administrative activity.
Detects the addition of a persistence mechanism by writing a registry value named 'browser' to the Windows Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run). The rule specifically looks for registry string values pointing to executables located within the user's AppData\Local directory, which is a common technique for establishing user-level persistence via masquerading as a web browser.
Detects modifications to the memory protection flags of the ntdll.dll library to PAGE_READWRITE (0x04). This behavior is commonly associated with shellcode injection, hooking, or patching of core system libraries to facilitate malicious activity or evasion.
Detects the GT_NET or Gt_net executable calling the VirtualProtectEx API to modify memory permissions to PAGE_EXECUTE_READWRITE. This behavior is a common indicator of process injection, where an attacker modifies memory to execute shellcode or malicious payloads within the context of a legitimate process.
This rule detects the creation or modification of a 'Debugger' registry value under the 'Image File Execution Options' (IFEO) key for the process 'agntsvc.exe'. This technique is commonly used by adversaries to establish persistence or intercept process execution by forcing an arbitrary executable to run whenever the target process is started.
Detects Pay2Key ransomware establishing persistence by modifying the HKLM Run registry key to execute a browser.exe file located in a GUID-named subdirectory within AppData\Local.
Detects the use of 7za.exe, executed from temporary 7ZipSfx directories, to extract encrypted data (data2.bin) into the Avast Software directory. This activity is indicative of the Pay2Key ransomware attempting to perform DLL sideloading by dropping a malicious DLL, such as powrprof.dll, into a legitimate application folder to hijack execution flow.
Detects a registry modification where the Image File Execution Options (IFEO) 'Debugger' value for the agent service process 'agntsvc.exe' is set to 'Systray.exe'. This technique is used by the Pay2Key ransomware to hijack the process execution flow, potentially to impair security or backup services.
Detects the Pay2Key ransomware displaying a ransom note by spawning notepad.exe to open a file named 'HowToRestoreFiles.txt' located in the 'C:\temp\' directory, typically as a result of execution from registry persistence keys.
Detects potential persistence attempts by the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update service (wusvc). The rule monitors for unauthorized execution of wusvc.exe, the use of sc.exe to register a wusvc service, and direct modification of registry keys associated with the wusvc service path.
Detects modifications to the Winlogon Shell or Userinit registry values, which are critical autostart locations often abused for persistence. The rule filters out legitimate system processes and flags values that point to suspicious locations such as AppData, Temp, or ProgramData, or that do not point to the expected explorer.exe binary.
Detects the creation or modification of a 'Debugger' registry value for the 'agntsvc.exe' process within 'Image File Execution Options'. This technique allows an attacker to automatically execute a specified binary (in this case, 'Systray.exe') whenever the target process is invoked, providing a mechanism for persistence or privilege escalation.
Detects token manipulation activity indicative of VILE ransomware attempting privilege escalation. The rule monitors for the usage of Windows token-related APIs such as AdjustTokenPrivileges, LookupPrivilegeValueW, DuplicateTokenEx, and SetTokenInformation, which are commonly used by malicious actors to elevate their security context.
Detects Pay2Key ransomware establishing persistence by modifying Windows registry Run keys to execute a file named 'browser.exe' located within a GUID-named subdirectory inside the user's AppData\Local folder. This behavior is indicative of multi-stage SFX archive deployment.
Detects modifications to the Windows Registry's Image File Execution Options (IFEO) to inject a debugger for 'agntsvc.exe'. This technique is used by Pay2Key ransomware to hijack and suppress backup agent services, preventing them from functioning during the encryption process.
Page 133 of 401