Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring the creation of processes for 'fodhelper.exe', 'computerdefaults.exe', or 'slui.exe' when their parent process is not 'explorer.exe' or 'svchost.exe'. These executables are known to be used in UAC bypass techniques to elevate privileges without user interaction.
Detects modifications to the Windows Svchost registry key adding 'Brn_Agent', a technique used by Vidar to load its malicious DLL via svchost.exe. This specific registry modification indicates an attempt to establish persistence.
This rule detects the execution of 'VmwareSampling.exe' with a command line containing 'victimtoolsalla.dll'. This specific combination is indicative of the NIGHTFORGE loader, which often leverages DLL side-loading techniques to execute malicious payloads. The presence of 'victimtoolsalla.dll' suggests an attempt to load a malicious DLL via a legitimate VMware process.
This rule detects potential DLL sideloading activity by monitoring process creation events where specific executables ("Setup_File_75.593.2113.exe" or "SystemSettings.exe") are launched with a command line containing "borlndmm.dll". It then correlates this with file events to confirm the presence of "borlndmm.dll" on the same device. This pattern is indicative of the OnyxC2 malware attempting to load a malicious DLL.
Detects a component combining spooler token access and CreateProcessAsUser, often indicative of the Sprysocks malware. The rule specifically looks for the presence of 'spoolsv.exe' along with API calls 'OpenProcessToken', 'DuplicateTokenEx', and 'CreateProcessAsUser', which are used to elevate privileges or impersonate other users by duplicating a token from the print spooler service and then launching a new process with that token.
Detects vcpktsvr.exe loading a local libcef.dll associated with the non-standard cef_api_mash export used by ZiChatBot.
This rule detects attempts to establish persistence for 'vds.exe' (Virtual Disk Service) by modifying the Image File Execution Options (IFEO) registry key to point its debugger to an executable located within the Windows Fonts directory. This technique is often used by adversaries to maintain access or elevate privileges, as the Fonts directory is typically writable by standard users and can be used to hide malicious executables.
This rule detects the creation of a file named 'config.dat' within the Windows printer color profile directory (typically 'C:\Windows\System32\spool\drivers\color'). This activity is suspicious because 'config.dat' in this specific location is often targeted by malware, such as the SprySocks backdoor, to maintain persistence or store malicious configurations. Legitimate modifications to this file are rare and usually associated with printer driver installations or manual color profile adjustments, which should be investigated as potential false positives.
Udm Hola Monitor Service
YARA-L
This rule detects modifications to the Windows Registry related to the 'hola_monitor_svc' service. Specifically, it looks for registry keys containing 'services\hola_monitor_svc' and registry value data or process command lines that include 'holamonitorservice.exe'. This activity indicates the configuration or presence of the Hola Monitor Service, which could be associated with the Hola VPN application.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Detects schtasks creating a one-time task on another host using supplied credentials and a batch file under Windows Temp, executed as SYSTEM. This behavior is indicative of an adversary establishing persistence or lateral movement by scheduling malicious code to run with high privileges on a remote system.
This rule detects the registration of a Windows service named 'msidiskserver' or a service whose ImagePath ends with 'fsdiskbit.sys'. This activity is associated with the 'FISHMONGERS' threat actor group and their 'SprySocks' malware, which uses a transient driver for persistence. The rule focuses on registry events related to service creation or modification.
This rule detects the creation or modification of scheduled tasks that launch executables from the Windows Fonts directory with SYSTEM-level persistence. It specifically looks for `schtasks` or `powershell` commands that include patterns indicative of an executable in the Fonts directory and a startup trigger (e.g., 'onstart', 'atstartup', '/ru system'). The XQL view provides actor and causality fields for investigation.
Detects the execution of the legacy ntvdm.exe with a hex parameter, utilized for process injection and legacy compatibility layers.
Detects the legitimate Microsoft binary Fondue.exe loading APPWIZ.cpl from a non-standard public directory (C:\Users\Public\), indicating DLL side-loading, a technique observed in campaigns like Dropping Elephant.
Identifies the creation of the BackupCheck scheduled task designed to repeatedly trigger the setup.exe doit sideload chain, associated with the Nimbus Manticore threat actor.
Identifies the creation of a .config file matching a newly relocated executable's name, used to force the .NET runtime to load the TOTPGuard.dll AppDomainManager. This rule specifically looks for the simultaneous creation of an executable (.exe) and a corresponding configuration file (.exe.config) in the same directory, which is a known technique used by the Nimbus Manticore threat actor for AppDomainManager hijacking.
This rule broadly hunts for instances where legitimate Microsoft update binaries (like mobsync.exe, w3wp.exe, certutil.exe, or svchost.exe) load unknown DLLs from non-standard directories, indicating potential DLL sideloading.
Detects instances where common Windows processes (svchost.exe, explorer.exe, or notepad.exe) spawn suspicious child processes (such as cmd.exe, powershell.exe, or wscript.exe). The rule identifies potential process hollowing or living-off-the-land techniques by correlating parent-child relationships with suspicious command-line parameters (encoding, hidden execution, or in-memory execution) or anomalous file paths (running from user-writable directories).
Page 143 of 401