Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of Microsoft Application Virtualization Injector (mavinject.exe) with the '/injectrunning' command-line argument. This utility is frequently abused by adversaries to inject malicious DLLs into target processes, facilitating arbitrary code execution while potentially bypassing security detections due to the binary's legitimate provenance.
Detects the execution of 'runas.exe' with the '/savecred' or '/netonly' parameters. The '/savecred' parameter allows the use of credentials previously stored in the credential manager, while '/netonly' allows the use of credentials for remote network resources without authenticating locally. Both flags can be abused by adversaries to persist or move laterally with compromised or cached credentials while evading local authentication monitoring. The rule excludes common system-signed processes originating from the Windows System32 directory.
Detects network activity associated with the SPECTRALVIPER malware family attributed to OceanLotus (APT32). The rule monitors for connections to known malicious C2 infrastructure (IPs and domains) and behavioral anomalies where the 'OneDrive.Sync.Services.exe' process makes outbound network connections to non-private addresses, which is indicative of process injection.
This rule detects the creation of a Windows service where the service type is set to 'kernel' via the sc.exe command-line utility. This behavior is indicative of an attempt to load a kernel driver or perform low-level system modifications, which is often used by rootkits or malicious drivers. The rule filters out known trusted publishers to reduce noise.
Detects OceanLotus-related DLL sideloading and code injection techniques. This rule monitors for masqueraded executables (IntelAudioService, HP Toolbox variants) launched with suspicious flags (appmodel/StateRepository, -uiDll), the loading of the SPECTRALVIPER loader module (DtlCrashCatch.dll), and cross-process injection attempts from known malicious sideloading binaries.
Detects cross-process memory operations and remote thread creation associated with the SPECTRALVIPER sideloading chain. It specifically flags injections originating from IntelAudioService.exe into OneDrive or svchost processes, the loading of the DtlCrashCatch.dll module, and general suspicious remote thread or memory write operations against these targets, excluding known system processes and security software.
Detects modifications or creation of 'InprocServer32' registry keys within 'HKEY_CURRENT_USER\Software\Classes\CLSID'. This pattern is frequently used for COM hijacking to achieve persistence or execute arbitrary code when a COM object is invoked by an application or the OS.
Detects modifications or creation of 'InprocServer32' registry keys within 'HKEY_CURRENT_USER\Software\Classes\CLSID'. This pattern is frequently used for COM hijacking to achieve persistence or execute arbitrary code when a COM object is invoked by an application or the OS.
Detects GreenBlood ransomware attempting to establish persistence by creating a new Windows service. This rule identifies suspicious 'sc.exe' commands that include 'green' or 'blood' in the service name, or 'sc.exe' commands creating services from common temporary/application data paths. It also looks for direct registry modifications to the Services key with 'green' or 'blood' in the key name.
This rule detects suspicious remote thread creation events (Sysmon Event ID 8) where a process initiates a thread in high-value system processes like lsass.exe, svchost.exe, explorer.exe, or winlogon.exe. It specifically filters out activity originating from common Windows system directories, highlighting potential process injection attempts by unauthorized binaries.
Detects when the SSH daemon or associated client binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp) are overwritten or newly created on a Linux system. This is a highly suspicious activity often associated with rootkits, backdoors, or persistence mechanisms aimed at intercepting credentials or maintaining unauthorized remote access.
This rule detects suspicious remote thread creation events (Sysmon Event ID 8) where a process initiates a thread in high-value system processes like lsass.exe, svchost.exe, explorer.exe, or winlogon.exe. It specifically filters out activity originating from common Windows system directories, highlighting potential process injection attempts by unauthorized binaries.
This rule monitors for suspicious activities related to Pluggable Authentication Modules (PAM) and authentication daemons. It detects unauthorized modifications to PAM configuration and shared object files, unexpected child processes spawned by sshd, the use of LD_PRELOAD in authentication contexts, and the tracing of authentication binaries (e.g., sshd, login, sudo) via strace.
Detects high-frequency registry modification activity by Windows script hosts (wscript.exe or cscript.exe) targeting common persistence locations such as Run keys and file association command keys. This behavior is indicative of malicious scripts attempting to establish persistence or hijack system execution flows.
Detects the use of fltMC.exe to spawn service control commands (sc.exe) or command processor (cmd.exe) with arguments for starting, stopping, creating, deleting, or configuring Windows services. This activity may indicate an attempt to manipulate drivers or services to impair system defenses or achieve persistence.
Detects the JFMBackdoor utility masquerading as fltMC.exe by executing from a non-standard location (typically %TEMP%) and performing timestomping operations via SetFileTime. This technique is used to manipulate MACE timestamps as an anti-forensic measure.
Detects a multi-stage attack pattern associated with the Qilin ransomware, beginning with suspicious VPN authentication (potential credential stuffing or bypass), moving through lateral movement attempts (SMB/RDP/WMI), and culminating in ransomware behaviors such as shadow copy deletion, mass file encryption, and ransom note creation.
Detects the creation of a Windows service using the 'sc.exe' utility where the service executable is located in a potentially untrusted directory such as Temp, AppData, ProgramData, Users\Public, or Downloads. This behavior is frequently used by adversaries to establish persistence or execute malicious code with elevated privileges.
Detects potential token manipulation attacks using SMB loopback connections. The rule identifies processes executing with privileges commonly associated with token impersonation (SeImpersonatePrivilege, SeAssignPrimaryTokenPrivilege) or running as SYSTEM that are not expected system processes, correlated with an SMB network connection to the local loopback address on port 445.
Detects the DRAYN malware which masquerades as a VSCode or Microsoft installer. The rule looks for a silent 7ZipSfx installation that drops a temporary file (agent.tmp), performs C2 communication over WebSockets to a specific IP address (34.244.31.76), and establishes persistence via a RunOnce registry key using a modified vcredist_x86.exe execution.
Detects the creation of a scheduled task via schtasks.exe that executes a command interpreter or script engine (e.g., PowerShell, cmd, wscript) where the parent process is not signed by Microsoft. This behavior is often associated with the execution of malicious payloads, persistence mechanisms, or lateral movement.
Page 58 of 401