Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects AutoHotkey scripts injecting into legitimate .NET binaries for defense evasion, specifically targeting processes associated with AsyncRAT. The rule looks for AutoHotkey.exe or command lines containing '.ahk' initiating processes that are known .NET binaries like AddInProcess32.exe, AppLaunch.exe, or aspnet_compiler.exe.
Detects indicators of the MYRA Linux RAT, including fileless execution via memory-based techniques (memfd_create/fexecve), process masquerading as systemd-userdbd, and persistence mechanisms leveraging LD_PRELOAD and malicious cron jobs.
Detects Key Vault access policy or role changes that grant secret-reading capabilities.
Detects administrative mail, forwarding, or content compliance rule changes performed from an IP address classified as an anonymous proxy. This behavior is often associated with threat actors like UNC6508, who use obfuscation networks and proxies to access administrator accounts and exfiltrate data.
Detects access to App Service Kudu deployment or command endpoints by an identity not normally associated with deployment operations.
This rule detects suspicious process execution patterns on Linux systems, specifically looking for processes running from anonymous memory mappings (memfd), execution via /proc/self/fd (fexecve pattern), and processes masquerading as 'systemd-userdbd' from unexpected file paths. These techniques are often used by adversaries for evasion and persistence.
Detects access to Azure App Service Kudu deployment or command endpoints by an identity not normally associated with deployment operations. This could indicate an attacker using compromised credentials to interact with the application's underlying infrastructure.
Detects removal of registered authentication methods shortly after a password reset, a sequence that can prevent the legitimate user from recovering the account. This rule specifically looks for successful 'Delete user authentication method' or 'Remove authentication method' operations in AuditLogs.
Correlates the executing Matanbuchus DLL performing process hollowing or injection into legitimate Windows binaries (e.g., svchost.exe, dllhost.exe) to execute AstarionRAT. This rule specifically looks for 'rundll32.exe' as the initiating process, targeting 'svchost.exe', 'dllhost.exe', or 'WerFault.exe' as the child process, and where the command line of the child process does not contain typical command-line arguments (hyphens or slashes), which can be indicative of process hollowing where the legitimate binary is started without its usual parameters before being injected.
Identifies AstarionRAT establishing persistence by writing itself into the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key, specifically looking for an executable in an AppData path, initiated by rundll32.exe.
Detects the creation of a Windows service using administrative tools (sc.exe or net.exe) followed closely by an instruction to start that service within a 5-minute window. This behavior is often associated with the execution of malicious payloads or lateral movement.
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
This rule detects scripts that load a driver and subsequently attempt to remove its associated service and source artifacts. It specifically looks for the presence of 'NtLoadDriver' API calls, 'sc delete' commands for service removal, 'reg delete' commands for registry cleanup, and references to specific filenames like 'fsdiskbit.sys' and 'msidiskserver', which are associated with the Sprysocks malware.
Identifies the creation or execution of a scheduled task named 'GoogleErrorReport', which is used by the threat group Dropping Elephant (also known as Patchwork or FIN13) to run their side-loading chain every minute. This rule detects both the command-line invocation of schtasks.exe to create or modify tasks and the Windows Security Event ID 4698 for scheduled task creation, specifically looking for the 'GoogleErrorReport' string.
This rule detects persistence mechanisms associated with the Turla STOCKSTAY backdoor. It monitors for the creation or modification of Registry Run keys, the execution of msiexec for suspicious MSI package installations (DiplomacyEduAI.msi, Copia.msi), and the presence of known STOCKSTAY component executables (e.g., MicrosoftUpdateOneDrive.exe, SMEditor.exe) in the %LOCALAPPDATA%/Programs/SMN/ directory.
Detects a script process (wscript.exe or cscript.exe) creating files in a specific HP-themed directory (e.g., 'Programs\HP\Printer\Driver') and subsequently establishing persistence by creating a Run key in the registry that points to an executable within that same HP-themed path. This behavior is indicative of the Turla Kazuar VBScript dropper.
Detects persistence established via the Windows Run registry key, specifically looking for an entry named 'WindowsHost' that launches a Node.js binary (node.exe). This technique is often used by adversaries to maintain access to a system after reboot or user login.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Page 135 of 401