Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,404 detections
Filters
Last updated
All Time
Detection languages
3,122
2,726
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,694
1,319
905
813
749
Platforms
5,930
913
885
299
280
Products / Services
1,617
1,400
1,089
454
419
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects an unusually high number of registry access events initiated by common Windows system utilities such as 'reg.exe', 'regsvcs.exe', or 'regasm.exe' within a one-hour window. A count of 5 or more registry access events from these processes is considered suspicious and may indicate malicious activity like persistence, defense evasion, or privilege escalation through registry modification.
Detects when a single user account performs 5 or more account creations (EventID 4720) or account enables (EventID 4722) within a one-hour period. This activity could indicate malicious behavior, such as an attacker establishing persistence or expanding access, or it could be a sign of automated account provisioning.
Detects potential Remcos RAT activity utilizing the CMSTPLUA COM interface for UAC bypass. The rule identifies instances where suspicious processes (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed from non-standard locations such as ProgramData, AppData, or Temp folders, which is characteristic of Remcos execution flows.
This rule detects persistence mechanisms and fileless execution patterns commonly associated with the MYRA malware family on Linux systems. It specifically monitors for malicious cron job creation, LD_PRELOAD library manipulation, unauthorized shell profile modifications, and memfd-based execution spawned from Node.js or npm processes.
This rule detects potential process injection behavior associated with the Remcos Remote Access Tool. It monitors for suspicious parent-child process relationships where 'remcos.exe' is identified as a parent of 'svchost.exe' or 'explorer.exe', or where Internet Explorer components (iexplore.exe, ieinstal.exe, ielowutil.exe) are executed in a manner inconsistent with typical Windows system process hierarchies.
Detects instances where ImageMagick (magick.exe, convert.exe, or mogrify.exe) launches a Ghostscript executable (gswin64c.exe, gswin32c.exe, gs.exe, or gsx.exe) from a file path outside of the standard installation directories. This behavior is indicative of a Ghostscript delegate path hijacking exploit, which can be leveraged to achieve arbitrary code execution when processing malicious PostScript (PS/EPS) or PDF files.
Detects the creation or modification of WMI event subscriptions via EventID 5861 from the Microsoft-Windows-WMI-Activity log. This activity, involving EventFilters, EventConsumers, or FilterToConsumerBindings, is a well-known technique used by adversaries to establish persistence and achieve execution triggered by system events, often resulting in elevated SYSTEM privileges.
Detects injection of malicious DYLIB libraries via LC_LOAD_DYLIB mechanism
Detects updates or deletions of Azure Active Directory (Entra ID) Conditional Access policies that occur outside of typical business hours (Monday-Friday 08:00-18:00 UTC). Such modifications can be an indicator of an adversary attempting to circumvent security controls or maintain persistent, unauthorized access.
Detects the execution of ServiceModelReg.exe followed by suspicious network or file system activity. ServiceModelReg.exe is a legitimate Windows utility that may be abused by adversaries for process hollowing or masquerading to evade defenses.
Detects potential UAC bypass attempts using common Windows auto-elevate binaries (fodhelper.exe, computerdefaults.exe, eventvwr.exe) that execute suspicious child processes, or by detecting the creation of related registry keys (ms-settings) used for these bypass techniques.
Detects the AlphVector executable loading specific DLL modules (opera_elf.dll or WebView2Loader.dll) from a suspicious directory (C:\ProgramData\service\), which is a characteristic behavior of DLL side-loading to bypass security controls.
Detects the creation of a scheduled task where the action references an executable file located in common user-writable directories (ProgramData, AppData, Users\Public, or Temp) shortly after that file was created on the disk. This pattern is characteristic of persistence mechanisms used by threat actors associated with Operation Turb00, such as the Wingo or HijackLoader malware families, which use scheduled tasks to maintain persistence via dropped binaries.
Detects a signed host process (VirtualAr.exe, NeuroManag.exe) loading a .tmp file as an executable image. This behavior is indicative of a process-hollowing variant where a malicious payload is mapped directly into memory from a cached, non-flushed temporary file, a technique observed in campaigns like Operation Turb00 involving Vidar infostealer.
Detects the Operation Turb00 SnappyClient delivery and persistence mechanism, characterized by the execution of a malicious AlphVector.exe process that loads a trojanized opera_elf.dll and WebView2Loader.dll. The rule also identifies the creation of specific persistence artifacts, including a legacy Task Scheduler 1.0 .job file named 'socket_dispatcher_v2.job' in the Windows Tasks directory and a malicious shortcut 'prompt_analyzer_debug.lnk' within the user Startup folder.
This rule identifies endpoints identified as EMS or FortiClient that exhibit an unusually high number of login events (greater than 20) or a high number of unique accounts logging in (greater than 10) within a specific timeframe. This behavior may indicate unauthorized access attempts, automated password spraying, or potential lateral movement activity directed at remote access infrastructure.
Detects a process interacting multiple times with VMware Tools (vmtoolsd.exe) followed by multiple interactions with WMI Restrictions registry keys within a 15-minute window. This behavioral pattern is indicative of potential privilege escalation or environment discovery techniques where an adversary attempts to modify security restrictions while masquerading or interacting with legitimate virtualization management components.
Detects DLL side-loading activity associated with Operation Turb00's IDAT Loader, used to deploy the Vidar infostealer. The rule identifies specific legitimate host binaries (e.g., AlphVector.exe, ssh-add.exe) executing from non-standard directories like ProgramData, AppData, or Temp and loading unsigned or untrusted DLLs known to be trojanized.
Detects automated post-compromise activity associated with Bluekit Browser-in-the-Middle (BitM) attacks. The rule identifies a pattern of a successful user login followed rapidly (within 10 minutes) by a password change and new passkey enrollment, indicating an adversary is securing their persistence after initial session hijacking.
Detects the creation of a scheduled task named 'OneDriveHealth', which is associated with APT28 activity. This task is used for persistence via COM hijacking; it executes 60 seconds after registration, kills and restarts explorer.exe to facilitate the loading of a hijacked COM object, and subsequently removes itself.
Detects suspicious OpenProcess calls initiated by common user applications (explorer.exe, winword.exe, outlook.exe) targeting svchost.exe, followed by an outbound network connection from the target svchost.exe to the file sharing service filen.io within a 30-minute window. This behavior is indicative of process injection used to facilitate network communication or data exfiltration under the guise of a system process.
Page 48 of 401