Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the creation or modification of user accounts on Windows systems by monitoring Security Event IDs 4741 (A security-enabled local group was created) and 4742 (A computer account was changed). It summarizes the count of such changes per hour by the subject user name, which can help identify unusual or excessive account management activities.
Detects SPECTRALVIPER malware attempting process injection into OneDrive.Sync.Services.exe by monitoring for specific sideloading chains (IntelAudioService.exe, Genuine.exe, Updater.exe, AutoCad242.exe) and cross-process indicators like handle access with write permissions or remote thread creation.
Detects the use of administrative tools like wmic.exe, powershell.exe, or pwsh.exe to invoke WMI event subscription components such as ActiveScriptEventConsumer, CommandLineEventConsumer, or FilterToConsumerBinding. This behavior is a common technique for establishing persistence or elevating privileges by executing malicious code when specific system events occur.
Detects the ConfigurationRemotingServer.exe process spawning the Windows Service Control Manager (sc.exe). This pattern is often associated with the manipulation of Windows services, which can be an indicator of service-based persistence or command execution.
Detects the execution of 'runas.exe' with the '/savecred' or '/netonly' parameters. The '/savecred' parameter allows the use of credentials previously stored in the credential manager, while '/netonly' allows the use of credentials for remote network resources without authenticating locally. Both flags can be abused by adversaries to persist or move laterally with compromised or cached credentials while evading local authentication monitoring. The rule excludes common system-signed processes originating from the Windows System32 directory.
Detects modifications to Windows Registry Run keys that are initiated by processes related to the Windows Package Manager (winget), specifically ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe, or by PowerShell scripts spawned by these processes. This behavior may indicate an attempt to establish persistence.
Detects SPECTRALVIPER lateral movement activity utilizing the XGU Pivot Shadow technique. The rule monitors for named pipe creation or connection events involving specific host processes (IntelAudioService.exe and OneDrive.Sync.Services.exe) used to orchestrate inter-instance command and control distribution. It also flags potential sideloading behavior where IntelAudioService.exe is executed from an anomalous path within the user profile.
Detects network traffic over SMB targeting the SYSVOL or NETLOGON network shares that includes the transfer or reference of common executable file extensions. This behavior is indicative of an adversary attempting to stage malicious payloads for deployment via Group Policy Objects (GPOs), a common method for lateral movement and persistence.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Detects a suspicious parent-child process relationship where IntelAudioService.exe spawns OneDrive.Sync.Services.exe or OneDrive.Sync.Service.exe. This activity is indicative of the SPECTRALVIPER backdoor injection utilized by the OceanLotus (APT32) group, specifically documented in their Blazing Furnace campaign, which leverages a DLL sideloading chain involving DtlCrashCatch.dll.
Detects the creation of Windows services initiated by ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This behavior is indicative of the abuse of the Windows Package Manager (WinGet) DSC configuration engine to install persistent malicious services, potentially leveraging PSDscResources.
Detects unauthorized, unauthenticated API activity targeting the ServiceNow 'related_list_edit' Scripted REST resource. The rule specifically alerts on requests originating from the 'Guest' account or where authentication requirements have been disabled, which are known indicators of exploitation.
Detects network traffic over SMB targeting the SYSVOL or NETLOGON network shares that includes the transfer or reference of common executable file extensions. This behavior is indicative of an adversary attempting to stage malicious payloads for deployment via Group Policy Objects (GPOs), a common method for lateral movement and persistence.
Detects the SPECTRALVIPER actor's malicious activity where IntelAudioService.exe is utilized to sideload the unauthorized 'DtlCrashCatch.dll' library, which then performs reflective code injection into the 'OneDrive.Sync.Services.exe' process for in-memory payload execution.
Detects the creation or modification of Windows Registry Run keys, which are common persistence mechanisms, by processes related to Desired State Configuration (DSC) (e.g., ConfigurationRemotingServer) or the Windows Package Manager (winget, WindowsPackageManagerServer). This rule flags entries in HKLM or HKCU Run keys created by these specific administrative or provisioning processes.
Detects suspected process injection activities characterized by specific OceanLotus sideloading binaries and SPECTRALVIPER-associated target processes. The rule monitors Sysmon Event IDs 8 (CreateRemoteThread) and 10 (ProcessAccess) for suspicious cross-process memory access, thread creation, and high-privilege access rights.
This rule detects potential lateral movement and privilege escalation activity associated with the SPECTRALVIPER framework. It identifies suspicious process launch events where method names indicative of token manipulation (e.g., StealToken, MakeToken, Impersonate_ThisThread) are present in the command line, or where the OneDrive Sync Service process is used as an indicator of this specific activity.
Detects instances where ConfigurationRemotingServer.exe spawns sc.exe, which is indicative of Windows service creation or modification occurring via WinGet Desired State Configuration (DSC) abuse to establish persistence.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects artifacts related to the ValleyRAT malware family, specifically identifying markers such as 'Phantom Persistence Module', 'RegisterApplicationRestart', and specific 'RSL_' strings within process command lines, image paths, or module loads using Windows Event Logs and Sysmon data.
Page 79 of 401