Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects a process masquerading as 'Finder' (i.e., having a different file path than the legitimate macOS Finder) that attempts to open System Settings, System Preferences, or the 'open' command to interact with Apple System Preferences related to Full Disk Access or Security settings. This behavior is indicative of an adversary attempting to modify privacy permissions or bypass system security controls.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
This rule detects the creation or registration of scheduled tasks that involve the 'PerfWatson2.exe' utility or execution paths originating from within the local AppData directory. These patterns are often associated with persistence mechanisms used by malware or malicious scripts to maintain execution after reboots.
This rule detects HTTP POST requests to a MyBB forum administrative panel targeting the 'user-users' module, specifically attempting to assign a user to the 'Administrator' group (group ID 4). This pattern is indicative of an exploitation attempt or unauthorized administrative account manipulation.
Detects anomalous thread context manipulation events, specifically those involving multiple SetThreadContext API calls within a short period, consistent with Gargoyle-style ROP/NtContinue sleep obfuscation techniques. This method cycles memory protections during C2 beacon sleep intervals to evade point-in-time memory scanners by keeping executable memory hidden.
Detects a suspicious persistence mechanism where a LNK file in the user startup folder launches cmd.exe, which subsequently executes a hidden PowerShell process. The PowerShell process uses 'Get-Content' to read and 'Invoke-Expression' (IEX) to execute a file located at C:\ProgramData\WC3. This activity is associated with the UAC-0226 / GIFTEDCROOK delivery chain.
Detects the use of PowerShell scripts attempting to bypass AMSI by using Marshal.WriteInt64 to overwrite the pAppName pointer within the AMSI_CONTEXT_INTERNAL structure to a null value. This technique effectively causes AMSI to 'fail-open', ignoring subsequent content scanned by the engine.
Detects unauthorized modifications to SSH 'authorized_keys' files or the '/etc/ssh/sshd_config' configuration file on Linux systems. These actions can be used for persistent access (key injection) or to weaken SSH security controls (e.g., enabling root login) and are typical indicators of account manipulation or compromise.
Detects instances where a process obtains a handle with PROCESS_VM_WRITE access to another process, followed shortly thereafter by a WriteProcessMemory operation into that same target process. This behavior is indicative of potential process injection, such as hooking remote GUI processes or other memory-based manipulation techniques.
Detects modification or creation of registry run keys in HKLM or HKCU hives that point to suspicious paths (AppData, Temp, ProgramData, or specific SharkLoader directories) or filenames (SystemSettings.exe). This behavior is indicative of malware attempting to establish persistence.
This rule detects potential process injection attempts targeting the Windows Update Service (wusvc.exe). It monitors for suspicious API calls, including VirtualAlloc, VirtualProtect, WriteProcessMemory, and QueueUserAPC, or memory page protections set to PAGE_EXECUTE_READWRITE within the context of the wusvc.exe process. The detection requires multiple distinct indicators of injection to be present, reducing the likelihood of flagging benign administrative activities.
Detects techniques associated with the SharkLoader malware (StrikeShark campaign) that bypass loader locks via self-injection. It monitors Sysmon Event ID 8 (CreateRemoteThread) for suspicious self-injection from specific staging directories (\xwreg\ or \xgdf\) and Sysmon Event ID 10 (ProcessAccess) for instances where these binaries open themselves with full access rights to manipulate the loader lock prior to Cobalt Strike delivery.
Detects instances where a process launch exhibits PPID spoofing (where the reported parent PID does not match the actual creator PID) followed by that spoofed process attempting to access high-privileged system processes such as lsass.exe, services.exe, or winlogon.exe within a two-minute window. This behavior is indicative of privilege escalation attempts.
Detects a browser session that contacts an EvilTokens Device Code phishing endpoint (/api/device/status/) and then immediately navigates to onedrive.live.com. This indicates that the attacker's backend successfully returned 'status:completed' and the phishing kit executed a window.location.replace to redirect the victim to OneDrive after token capture.
Detects process creation events where the Image field lacks an absolute path,
which occurs when the backing file no longer exists on disk at the time of
logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.
which occurs when the backing file no longer exists on disk at the time of
logging - commonly caused by Process Ghosting or other unorthodox process creation techniques.
Detects the SNOWLIGHT dropper (wusvc.exe) executing process injection via CreateRemoteThread. The malicious dropper, often found in user-writable directories, mimics the legitimate Windows Update service (wusvc.exe) and utilizes advanced injection techniques, including PEB traversal for API resolution and APC injection, to deploy the VSHELL RAT.
Detects the dropping, service creation, or execution of known vulnerable drivers and associated BYOVD tools. These tools are used by The Gentlemen RaaS group to escalate privileges to kernel level and terminate endpoint security products.
Detects the creation or manipulation of WMI event subscriptions using wmic.exe, powershell.exe, or mofcomp.exe. These tools are commonly abused by adversaries to establish persistence by triggering malicious code execution via WMI event filters, consumers, and bindings.
This rule detects potential privilege escalation or backdoor creation by monitoring for two primary indicators: 1) The modification of Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, osk.exe, utilman.exe, magnify.exe, narrator.exe, atbroker.exe) to point to unauthorized debuggers, and 2) The execution of common command interpreters or suspicious binaries spawned directly by these accessibility processes, which are commonly used in lock-screen bypass attacks.
This rule detects activities associated with VILE ransomware, focusing on unsigned Go-based binaries. It flags processes performing cross-process operations, creating specific file artifacts (e.g., vile_deadlines.json, vile_Decryptor), or invoking direct NT system calls such as NtCreateWaitCompletionPacket to evade EDR hooks.
Detects instances where a guest user or an external account (identified by the #EXT# suffix) performs an operation to add a new member to a Microsoft 365 Group. This behavior can be indicative of a guest account being compromised or misused to escalate privileges or gain unauthorized access by modifying group memberships.
Page 47 of 401