Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the modification or creation of Windows Registry Run keys that point to a 'browser.exe' executable located within a user's AppData Local directory. The rule specifically looks for paths matching a UUID pattern, which is characteristic of certain automated malware persistence mechanisms, such as those associated with the Pay2Key ransomware.
This rule monitors process events for the combined usage of multiple Windows security APIs associated with access token manipulation. Specifically, it flags processes that call two or more of the following functions: AdjustTokenPrivileges, LookupPrivilegeValueW, SetTokenInformation, OpenProcessToken, DuplicateTokenEx, or GetTokenInformation. This behavior is indicative of token stealing or impersonation attempts, often used by malware such as Vile Ransomware to escalate privileges or bypass security controls. The rule also includes heuristic filtering for common system processes.
This rule detects the registration of a Vectored Exception Handler (VEH) by specific process names (gt_net.exe, grixba) or processes running from suspicious paths (e.g., C:\Users\Public\Music). This behavior is associated with the Grixba component of Play ransomware, which uses VEH for anti-debugging and execution hijacking.
This rule detects potentially malicious activity associated with process injection, specifically identifying memory regions allocated as Read-Write-Execute (RWX) or the loading of sensitive DLLs (amsi.dll, wldp.dll) from unbacked memory regions, which is a common indicator of process injection or shellcode execution.
Detects the creation or modification of a Windows Registry run key ('browser') that points to an executable located in the AppData\Local directory. This behavior is indicative of an adversary establishing persistence by masquerading a malicious process as a browser.
Detects modifications to the 'Debugger' registry value for the 'agntsvc.exe' executable under 'Image File Execution Options'. This technique, known as IFEO injection, is used by adversaries to gain persistence or privilege escalation by forcing a malicious binary to run whenever a specific process is launched.
Identifies Azure Active Directory (AAD) logins from new or unusual locations followed immediately by the creation of inbox rules designed to delete incoming emails. This behavior is indicative of an attacker gaining access to an email account and attempting to disrupt communication or hide their activities by automatically deleting legitimate emails.
Correlates the fake VPN installer creating a scheduled task pointing to the high-entropy AppData directory to ensure the stealer runs on boot.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
Detects 'gp_v6_exec.py', a script automating GodPotato privesc for MuddyWater. This rule specifically looks for the execution of this Python script via its command line.
Identifies the fake VPN installer executing process hollowing, spawning suspended legitimate .NET binaries (RegAsm.exe, InstallUtil.exe) to inject the Vidar or Lumma stealer payload.
Detects the creation of scheduled tasks using 'schtasks.exe' with names that mimic legitimate Microsoft services such as 'RealtekAudio', 'CoreUIComponents', 'OneDriveHealthTask', or 'WindowsUpdate'. This technique is often used by adversaries for persistence.
Detects memory allocation anomalies where VirtualAllocEx is used with PAGE_EXECUTE_READWRITE protection by common scripting engines such as Python, Node.js, WScript, CScript, PowerShell, and AutoHotkey. This behavior can be indicative of process injection or other malicious memory manipulation techniques.
Detects the ClickOnce handler itself creating Run/RunOnce registry persistence mechanisms.
Detects an executing ClickOnce package dropping a secondary malicious script directly into the Startup folder.
This rule detects the execution of processes associated with VMware or suspicious files mimicking legitimate VMware components, particularly when spawned from web servers (w3wp.exe) or command-line interpreters (cmd.exe, powershell.exe). It monitors for specific file names and paths that may indicate persistence, lateral movement, or evasion attempts involving VMware-related binaries or configurations.
Detects the modification of Windows Registry run keys by node.exe. This activity is often used by adversaries to establish persistence, where a malicious Node.js script or application is set to automatically execute upon user logon.
Detects the creation of scheduled tasks using schtasks.exe that masquerade as common update tasks (Google, Microsoft) or point to suspicious file paths often associated with malware (e.g., C:\ProgramData\VMware\). The rule monitors for tasks created with high privileges or triggers, which are indicative of persistence mechanisms.
Detects the Go binary executing Windows token manipulation APIs to duplicate tokens and elevate to SYSTEM. Specifically looks for 'setup.exe' performing 'DuplicateTokenExApiCall' or 'SetThreadTokenApiCall'.
This rule detects multiple indicators of suspicious activity on Linux systems, including LD_PRELOAD hijacking, memfd_create fileless execution, suspicious process masquerading, periodic cron task execution, and the creation of configuration files associated with common IDEs and AI tools. These patterns are frequently used to establish persistence, hide malicious activity, or facilitate lateral movement by compromising development environments.
Detects the creation or modification of Windows Registry Run keys that point to Node.js related files or JavaScript/module scripts, specifically excluding those signed by Microsoft or the OpenJS Foundation. This is a common technique used by attackers to maintain persistence by executing scripts automatically upon user logon.
Page 137 of 401