Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of a scheduled task named OneDriveHealth invoking taskkill on explorer.exe to trigger a hijacked COM object. This rule specifically looks for 'svchost.exe' as the initiating process, executing 'taskkill' with 'explorer.exe' in its command line, which is indicative of a specific attack chain involving scheduled tasks and process termination.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
This rule detects potential persistence and execution of suspicious VBScript files ('Telegram_Private_Call_Session.vbs' or 'assurance.vbs'). It monitors for the creation or modification of these files within the Windows Startup folder, their execution via wscript.exe, and the creation of corresponding registry entries to ensure automatic startup.
Detects the creation of scheduled tasks using schtasks.exe with suspicious command-line patterns, specifically those containing encoded commands or specific strings related to Windows system components (WindowsColorSystem, Calibration). This technique is often used by adversaries to establish persistence or facilitate execution of malicious payloads.
Detects modifications to COM InprocServer32 registry keys under HKEY_CURRENT_USER. This activity is often associated with COM hijacking, a technique used by adversaries to achieve persistence or execute malicious code when a hijacked COM object is invoked by legitimate applications. The rule specifically flags suspicious or non-Microsoft COM registrations, particularly those pointing to files within the user's AppData/Local directory.
Detects behavior indicative of StealC or Amadey malware loading and executing in-memory by injecting code into trusted Windows system processes such as svchost.exe or explorer.exe. The rule correlates a process launch from suspicious locations like Temp or AppData with subsequent process access events targeting these host processes, typically signaling process injection for evasion.
Detects the creation of a 'protocal.cjs' file within the '~/.config/systemd/nvmconf/' directory. This activity is associated with the 'easy-day-js' supply chain attack, where a malicious Node.js script is established as a persistent user-level systemd service named 'nvmconf'.
Detects behavior attributed to the AMOS (Atomic macOS Stealer) malware, where a shell process uses 'setsid' to detach from the current terminal session, followed immediately by the execution of 'killall Terminal' to conceal the execution of malicious commands.
Detects the creation of a LaunchAgent property list file in the user's Library directory that masquerades as an Apple-related process (com.apple.*). This behavior is associated with the macOS.Gaslight malware family, which uses such files for persistence, often with specific arguments like --type=renderer.
Detects instances of Chrome, Edge, or Brave browsers being launched with specific, suspicious command-line arguments (e.g., --no-first-run, --disable-gpu, about:blank) from parent processes that are not standard browser or update launchers. This behavior is indicative of Vidar Stealer attempting to force a browser instance to generate or expose the master encryption key, facilitating the theft of browser-stored credentials.
Detects a malicious persistence mechanism where a suspicious process ('chost.exe') is registered in the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key to execute at startup. The rule specifically monitors for registry keys pointing to temporary directories or unconventional path structures often associated with this RAT, while correlating this with the execution of the process from a non-system directory (i.e., outside System32/SysWOW64).
Detects a multi-stage execution pattern involving cmd.exe spawning PowerShell to download files from storjshare.io using System.Net.WebClient, followed by a secondary PowerShell execution using 'Start-Process -Verb RunAs' to trigger a UAC bypass, characteristic of the REF8372 campaign and OXLOADER distribution.
Detects instances where known Windows binaries vulnerable to UAC bypass (eventvwr.exe, fodhelper.exe, or sdclt.exe) spawn a child powershell.exe process with the '-ExecutionPolicy Bypass' argument. This activity is indicative of an attacker attempting to elevate privileges without triggering a UAC prompt.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Detects the TuglaInsaatci steganographic loader establishing persistence via a Windows Run registry key. The rule identifies suspicious PowerShell commands (execution policy bypass, hidden window, hidden file path) pointing to a script located within the AppData\Local\Temp directory, a technique associated with the FortiBleed campaign to deliver the Remcos RAT.
Detects a registry modification to the HKCU Run key that executes a PowerShell script located in the %TEMP% directory. This behavior is associated with the TuglaInsaatci steganographic .NET loader campaign, often used to drop commodity malware such as Remcos RAT.
Detects unauthorized access to Chromium-based and Firefox browser credential stores (Login Data, Cookies, logins.json) by processes executing from temporary directories (e.g., AppData, Temp). This behavior is characteristic of infostealer malware, such as CASTLESTEALER, often delivered via process injection or hollowed processes.
Targets use of LdrCallEnclave from Python or a user-writable loader following executable-memory allocation. The UDM rule retains principal and target context for correlation.
Hola monitor service persistence
Cortex XDR
This rule detects the persistence mechanism of the 'hola_monitor_svc' service or 'HolaMonitorService.exe' being configured for automatic start. It specifically looks for registry modifications related to this service. The XQL view includes actor and causality fields to aid in investigation.
This rule detects the creation or modification of a file named 'config.dat' within the Windows print spooler's color driver directory (system32\spool\drivers\color). This activity is considered suspicious when it occurs outside of normal print workflows, as it could indicate malicious manipulation of printer configurations, potentially for persistence or privilege escalation. The rule focuses on capturing causality information to aid in investigation.
VSPMsg print processor persistence
Cortex XDR
This rule targets registry or file artifacts that install 'VSPMsg' as an x64 print processor. It specifically looks for registry modifications where the value name contains 'print processors\vspmsg' and the event subtype or actor process command line contains 'vspmsg.dll'. The XQL view retains actor and causality fields for investigation.
Page 139 of 401