Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the extraction process where specific files (empty.vbs, Profile.ps1, 1.dat, Com.dat) associated with the Dragon Weave campaign are simultaneously unzipped into a 'data' folder. This rule looks for the creation of at least three of these four files within a one-minute window by the same initiating process.
Identifies the creation of scheduled tasks for Windows System Health Monitor persistence, specifically looking for 'schtasks.exe' creating tasks with names like 'Windows System Health Monitor' or 'Windows System Health Check', in conjunction with 'RuntimeHost.exe' activity. This pattern is indicative of cryptojacking campaigns abusing ScreenConnect.
This rule correlates the creation of .config files (often used for EDR evasion via AppDomainManager bypass) with the immediate creation of scheduled tasks using schtasks.exe. This sequence of events suggests an adversary is attempting to establish persistence after an initial evasion technique.
Advanced detection correlating RuntimeHost.exe spawning suspended InstallUtil.exe to inject miner. This rule specifically looks for 'RuntimeHost.exe' initiating 'InstallUtil.exe' without command-line arguments, followed by network activity from the 'InstallUtil.exe' process, indicating potential process hollowing and cryptojacking.
Detects the sideloading of the tampered DLL 'AggregatorHost.dll' by a process named '._cache_GAME1.exe', which is associated with hijacking live Steam sessions.
This rule detects various activities associated with suspicious implants, including file creation/execution, process execution, DLL loading (potential injection), and persistence via Run registry keys. It specifically looks for files named 'senti.dll', 'Thal.exe', and mentions 'PhantomBackdoor' and 'TencShell' as suspicious artifacts.
Detects persistence mechanisms associated with 'Operation Poisson', specifically focusing on the creation of a scheduled task named 'TaskAdmin1' with highest privileges that launches 'wscript.exe' with 'sys.vbs' at logon, or the use of Registry Run keys to achieve similar persistence with 'sys.vbs'. It also detects the execution of 'wscript.exe' with 'sys.vbs'.
Identifies the creation of the specific background system service associated with TiFlux, cementing its persistence on the host. This rule specifically looks for the 'sc.exe' utility being used with the 'create' command and 'TiFlux.start= auto' in the command line, indicating the creation of a service for persistence.
This rule detects unusual parent-child process relationships for 'svchost.exe' and 'explorer.exe'. Specifically, it flags instances where 'svchost.exe' is spawned by a process other than 'services.exe', 'msiexec.exe', or another 'svchost.exe' instance. It also flags 'explorer.exe' being spawned by a process other than 'userinit.exe' or another 'explorer.exe' instance. These relationships can indicate process injection, masquerading, or other forms of malicious activity.
Detects potential Bring Your Own Vulnerable Driver (BYOVD) attacks by monitoring for known vulnerable driver files being created or loaded as kernel modules, as well as the registration of kernel-mode drivers from non-standard or user-writable locations like Temp, Tmp, AppData, or Public directories.
Detects the creation of scheduled tasks using schtasks.exe that exhibit suspicious characteristics. This includes tasks referencing external URLs, those containing base64-encoded or obfuscated command strings, and tasks pointing to binaries or scripts in user-writable paths (e.g., AppData, Temp). The rule specifically targets tasks intended to run with SYSTEM privileges or those using common persistence triggers, while excluding known legitimate administrative software.
Detects the deployment, registration, and loading of known vulnerable drivers (e.g., mhyprot2.sys, gdrv.sys, rtcore64.sys) used in Bring Your Own Vulnerable Driver (BYOVD) attacks. This rule monitors file creation, module loading, service registration via sc.exe, and registry modifications associated with service installation.
Identifies device registration events where the user agent indicates script or automated frameworks (like axios, node, undici, node-fetch) rather than native registration clients. This behavior is associated with adversaries like Tycoon 2FA, which establishes device-bound persistence (PRT) that survives standard session revocation, making this a critical post-compromise detection.
Detects MYRA Linux RAT establishing cron-based persistence by scheduling /usr/local/lib/.cache-update.sh to execute every 13 minutes with a fileless fallback chain using memfd_loader and agent_launcher. Indicative of the apintergrationpost npm supply chain attack by threat actor kimijohn01.
Detects MYRA RAT fileless execution where memfd_loader or memfd_exec loads the Node.js binary and JavaScript agent bundle into anonymous memory file descriptors via memfd_create and executes via fexecve. Resulting processes show /proc/PID/exe pointing to '/memfd:.node (deleted)' or '/memfd:.bundle' with no files on disk.
Detects the creation of WMI event subscriptions, including event filters, consumers, and bindings, performed by wmic.exe, powershell.exe, or pwsh.exe. This activity is commonly used by adversaries to establish persistence or facilitate execution via the Windows Management Instrumentation service.
Detects the creation of scheduled tasks (schtasks.exe) spawned by common scripting or social engineering-related parent processes (PowerShell, Cmd, WScript, MSHTA). The rule specifically looks for payloads associated with common attack patterns, such as downloading remote content or executing encoded commands, which indicates potential persistence or payload delivery activities.
Detects attempts by unsigned or non-Microsoft processes to perform cross-process memory injection (such as CreateRemoteThread or NtCreateThreadEx) into critical processes including browser processes (chrome.exe, msedge.exe) or the local security authority subsystem service (lsass.exe).
Detects instances where a signed process loads a dynamic-link library (DLL) from a user-writable directory, such as Temp, AppData, Downloads, or Public. This behavior is a common technique used for DLL sideloading to hijack the execution flow of trusted, signed applications.
Identifies fmapp.exe running from user-writable paths (AppData, Temp) to sideload the malicious fmapp.dll payload.
Detects a deceptive scheduled task named 'MicrosoftEdgeUpdate' executing PowerShell Net.WebClient download cradles. This rule specifically looks for the creation of a scheduled task using 'schtasks.exe' that includes 'MicrosoftEdgeUpdate' in its name and 'Net.WebClient' in its command line, indicating an attempt to download content using PowerShell's WebClient object, potentially for malicious purposes.
Page 141 of 401