Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,407 detections
Filters
Last updated
All Time
Detection languages
3,122
2,729
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,695
1,319
905
813
749
Platforms
5,933
913
885
299
280
Products / Services
1,617
1,401
1,090
454
419
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects behaviors associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks, including the dropping of .sys driver files into non-canonical directories, the registration and execution of kernel services via sc.exe, the use of fltMC to load filter drivers, and the loading of driver modules from non-standard locations.
Detects behavior consistent with the SharkLoader malware, including the creation of malicious components in %APPDATA% subdirectories (xwreg, xgdf), the execution of SystemSettings.exe from these non-standard directories, and the execution of commands via cmd.exe initiated from these paths. It also identifies file staging activities in %TEMP%\aswerf.
This rule detects two primary indicators of potentially malicious activity involving the Windows Explorer process: 1) Suspicious process parentage, where explorer.exe is spawned by a parent other than the standard winlogon.exe, userinit.exe, or explorer.exe, or where explorer.exe spawns unusual child processes like cmd.exe, powershell.exe, or others. 2) Possible Parent PID (PPID) spoofing, identified by the presence of specific API-related keywords in the command line (e.g., SeImpersonatePrivilege, CreateProcessWithToken) within process creation events.
This rule detects the creation of scheduled tasks using schtasks.exe that exhibit characteristics associated with the SharkLoader malware. Specifically, it identifies tasks using suspicious names like 'OneDrive Standalone Update Task' or those referencing components dropped in %APPDATA% directories (e.g., \xwreg\, \xgdf\), or tasks masquerading as 'SystemSettings.exe' or 'KasperskyLab' directories.
Detects potential Cobalt Strike Beacon process injection activity by monitoring Sysmon events for suspicious cross-process access (EID 10) and remote thread creation (EID 8). The rule specifically targets high-value host processes (svchost.exe, explorer.exe, rundll32.exe, notepad.exe) and filters common legitimate behaviors such as antivirus memory scanning and JIT compilation to reduce false positives.
Detects registry run key and logon persistence modifications commonly used by the StrikeShark campaign. This rule monitors for entries in standard Windows autorun registry keys and Winlogon persistence locations where the associated file path is located in user-writable directories (AppData, Temp, Public) or contains suspicious file extension patterns, which are indicative of malware such as Sharkloader.
Detects the use of the SharpGPOAbuse tool, typically used for modifying Group Policy Objects for persistence or privilege escalation, in conjunction with rapid Active Directory group enumeration (using net.exe or net1.exe) on the same host within a 5-minute window. This behavior is highly indicative of an adversary performing post-exploitation reconnaissance and privilege escalation activities.
This rule detects instances where the Windows Update service (wusvc.exe) loads a module or file while simultaneously initiating a process. This behavior is often associated with process injection or the misuse of legitimate system binaries (LOLBins) to facilitate malicious activities by proxying execution through trusted services.
Detects the execution of VBScript files containing 'ragecore' in the command line, specifically when launched via wscript.exe or cscript.exe from common staging or persistence directories such as Windows Temp, Users Public, or Startup folders.
Detects potential persistence attempts by TrymeLocker malware, specifically monitoring for malicious StubPath values written to Active Setup registry keys. The rule correlates this behavior with other indicators of compromise such as malicious Debugger values set within Image File Execution Options (IFEO) keys or suspicious service creation, effectively identifying high-confidence persistence activity.
Detects processes located outside of standard Windows system directories (System32 and SysWOW64) that load the advapi32.dll library. Advapi32.dll is a core Windows API library frequently used for security-related functions, including service control and registry manipulation; its loading by non-system binaries can be indicative of masquerading or malicious activity.
Detects the execution of MAVInject.exe (Microsoft Application Virtualization Injector) with the /INJECTRUNNING parameter, a technique used to inject malicious code into a running process to evade detection.
Detects the creation of scheduled tasks using schtasks.exe that exhibit suspicious characteristics. This includes tasks referencing external URLs, those containing base64-encoded or obfuscated command strings, and tasks pointing to binaries or scripts in user-writable paths (e.g., AppData, Temp). The rule specifically targets tasks intended to run with SYSTEM privileges or those using common persistence triggers, while excluding known legitimate administrative software.
Detects the creation of scheduled tasks named 'RageGuard' or utilizing 'win_guard' binary paths in suspicious directories (Temp, AppData, ProgramData), correlated with concurrent registry modifications to Winlogon (Shell/Userinit) or Image File Execution Options (Debugger) using the same binary, indicative of the TrymeLocker ransomware persistence mechanism.
Detects the creation or modification of a registry run key under the 'Run' hive where the target executable is located within a GUID-named subdirectory inside the user's AppData/Local folder. This pattern is commonly used by malicious software to maintain persistence by masquerading as a legitimate browser or application process.
Detects the creation of user accounts or modifications to sensitive groups (Event IDs 4720, 4728, 4732, 4756) where the account name matches naming conventions typically associated with backup service accounts or elevated administrative roles (e.g., prefix 'backup_', 'bkp_' or suffix '_da', '_ea'). This activity can indicate an attacker attempting to establish persistence or escalate privileges via compromised or newly created accounts.
Detects modifications to Windows Registry Run keys that are indicative of Remcos RAT establishing persistence. The rule monitors for registry values being set or keys created in standard Run and Policy-based startup locations, specifically flagging entries that reference suspicious file paths (such as AppData or Temp) or contain known Remcos-related strings.
Detects behavior patterns consistent with Remcos RAT, specifically: 1) unauthorized process injection (CreateRemoteThread/ProcessInjection) into common host processes, 2) spawning of browser-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe) from non-standard parent processes, and 3) anomalous outbound network connections from these injected processes over non-standard ports.
Detects the creation or modification of Windows Registry keys or values within the 'CurrentControlSet\Services' path that refer to 'rustdesk'. This typically indicates the installation or configuration of the RustDesk remote access tool as a system service, which may be unauthorized or used for persistence by an adversary.
Detects indicators of the MYRA rootkit, specifically the creation of a hidden shared library in /usr/local/lib/, persistence via a shell script in /etc/profile.d/, and the execution of processes utilizing the LD_PRELOAD environment variable to load the malicious library.
Detects the creation of scheduled tasks using schtasks.exe that point to the ProgramData directory, which is a common persistence location for malware like SystemBC. The rule excludes common, benign software installers and updaters that frequently use this directory to avoid false positives.
Page 82 of 401