Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects PowerShell processes initiated where the command line contains references to specific files ('vile_Decryptor.lnk' or 'vile_icon.ico'), which are indicative of suspicious shortcut file execution or associated malware staging activity.
Detects persistence mechanisms used by the Turla STOCKSTAY malware, specifically identifying the use of Registry Run keys (masquerading as 'MicrosoftUpdateOneDrive' or referencing the %LOCALAPPDATA%\Programs\SMN\ directory) and modifications to the AppInit_DLLs registry key.
Detects credential abuse patterns from FortiGate logs including administrative changes, tunneling activity, and anomalous source-IP behavior.
Detects use of scheduled tasks to break process trees and hide parent relationships
This rule detects the execution of specific suspicious files (nvdaHelperRemote.dll or Mixed Reality.exe) when they originate from within the 'Windows Media Player' directory. Such behavior is indicative of potential DLL search order hijacking or masquerading attempts, where an adversary places malicious files in a predictable location to intercept execution.
Detects unauthorized or suspicious AWS CLI operations and sensitive IAM API calls initiated from developer tooling processes like VS Code (including the Amazon Q extension host). This behavior is often associated with the exploitation of MCP (Model Context Protocol) auto-execution vulnerabilities, where attackers attempt to use compromised developer environments to escalate privileges or exfiltrate cloud credentials.
Detects a suspicious UAC bypass pattern associated with the DcRAT malware, where a process relaunches itself using the 'runas' verb via ShellExecuteW to escalate privileges. The rule specifically monitors for instances where an executable triggers a secondary process launch of itself, filtering out standard Windows administrative utility parents.
Detects suspicious process execution patterns associated with the exploitation of CVE-2026-46300 (Fragnesia). The rule monitors for the combination of user namespace creation via unshare, network tunnel configuration via ip, and kernel module loading related to ESP or rxrpc, which are indicative of an attempt to trigger a privilege escalation vulnerability in the Linux kernel.
Detects deletion of persistence registry keys after successful execution
This rule detects suspicious process spawning patterns where cmd.exe appears as a child of svchost.exe, which is indicative of PPID spoofing (often associated with Cobalt Strike's spawn-to and token impersonation techniques). It validates the relationship by checking if the grandparent process is the legitimate services.exe.
Detects SharkLoader malware staging its encrypted PE payload, 'DscCoreR.mui', to directories outside legitimate Windows MUI locations. The rule monitors both file creation and module loading events, excluding known legitimate Windows servicing processes while accounting for MSI installer activities.
Detects the creation of scheduled tasks using schtasks.exe initiated from potentially suspicious parent directories (C:\Users\Public\ or C:\Windows\Temp\) or parent processes containing 'win_guard_'. This behavior is often associated with malware attempting persistence.
Detects the modification of Image File Execution Options (IFEO) registry keys to assign a debugger to critical Windows accessibility binaries (e.g., sethc.exe, utilman.exe, osk.exe). This technique is a common method for achieving persistence or privilege escalation by executing arbitrary code when these accessibility features are triggered, often at the Windows login screen.
This rule detects processes that load 'amsi.dll' followed by a call to 'VirtualProtectApiCall' with 'PAGE_EXECUTE_READWRITE' memory protection flags within a 30-second window. This behavioral pattern is frequently used in fileless execution techniques to disable Antimalware Scan Interface (AMSI) or to facilitate the execution of shellcode by modifying memory permissions.
Detects the creation of a Windows scheduled task using 'schtasks.exe' that triggers on system startup or login, while simultaneously referencing specific keywords ('RageGuard', 'win_guard_', 'RageCore_') in the command line, suggesting the persistence of a specific malicious utility.
Detects modification of the Windows Registry 'Shell' value within the Winlogon key to an executable other than 'explorer.exe'. This technique is commonly used by malware, such as TrymeLocker, to achieve persistence by replacing or augmenting the default Windows shell with a malicious payload that executes upon every user login.
This rule detects potential process injection by monitoring a sequence of API calls (VirtualAllocEx, WriteProcessMemory, and QueueUserAPC/NtQueueApcThread) originating from common system processes like wusvc.exe, rundll32.exe, or regsvr32.exe. The sequence indicates that memory with RWX permissions is being allocated in a target process, written to, and then triggered for execution via an APC, which is a common pattern for malicious code injection.
Detects the installation and execution of known APT36 Ghazwa spyware variants (com.ghazwa.updates, com.chragall, or com.chagall) that are sideloaded (not from the official Google Play Store) and attempt to request or activate Device Administrator privileges via intent actions or receiver class activation.
Detects behavior indicative of the SNOWLIGHT dropper, which uses direct syscalls to perform memory allocation (VirtualAlloc/VirtualProtect with PAGE_EXECUTE_READWRITE) and subsequent process access to LSASS or other critical security processes (MsMpEng.exe, csrss.exe, winlogon.exe). The detection specifically looks for the absence of ntdll.dll in the call stack during these operations, signaling an EDR bypass attempt via direct syscalls within a 60-second window.
This rule detects a sequence of Windows API calls indicative of process injection behavior associated with the VSHELL RAT (UNC5221). The detection monitors for the combination of VirtualAllocEx (with page permissions allowing execution), WriteProcessMemory, and QueueUserAPC or NtQueueApcThread targeting common Windows system processes (svchost.exe, explorer.exe, notepad.exe) from the same source process within a one-minute window.
Detects a coordinated persistence effort by a single process, involving the creation of a scheduled task, modification of the HKCU Run registry key, and modification of the Active Setup registry key within a 5-minute window. This behavior is indicative of a complex persistence mechanism typically associated with malicious software.
Page 65 of 401