Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects the creation or modification of scheduled tasks using utilities like schtasks.exe or at.exe that are followed by the execution of script-based interpreters (PowerShell, CMD, or WScript). This pattern is commonly indicative of an attacker establishing persistence by scheduling malicious scripts to run automatically.
Detects the creation or modification of the 'Debugger' registry value under the 'Image File Execution Options' (IFEO) key. This technique is often used by adversaries to establish persistence, achieve privilege escalation, or hijack the execution of specific applications, including security tools.
Detects the creation of Image File Execution Options (IFEO) registry entries that associate a debugger with common security-related or monitoring binaries (e.g., Sysmon, SetACL, Filebeat). Attackers use this technique to hijack the execution flow of these security tools, effectively disabling or impairing their functionality (a form of defense evasion).
This rule detects command line patterns associated with Cobalt Strike Beacon injection, specifically looking for indicators of 'beacon.dll', 'beacon.exe', or 'injection' strings being executed by suspicious parent processes such as explorer.exe, svchost.exe, or winlogon.exe. This activity is indicative of post-exploitation behavior and potential lateral movement or persistence attempts.
Detects instances where the process MpExtMs.exe loads suspicious DLLs (e.g., EndpointDlp.dll, version.dll) or spawns child processes, which is consistent with DLL sideloading patterns associated with the Backdoor.Mistic malware.
Detects attempts to inject code into browser processes (Chrome, Edge, Brave) using various API calls associated with process injection techniques. This rule specifically looks for calls like QueueUserApcRemoteApiCall, NtQueueApcThreadApiCall, CreateRemoteThreadApiCall, and WriteProcessMemoryApiCall, especially when combined with specific functions like CryptUnprotectMemory or NtQueueApcThread, within a short time frame.
This rule detects potential persistence mechanisms and execution associated with Amadey or StealC malware. It identifies the creation of scheduled tasks (`schtasks.exe /create`) targeting suspicious directories or known Amadey/StealC paths, as well as Task Scheduler Event ID 4698 (task created) referencing these paths. Additionally, it looks for direct execution of 'nudwee.exe' (an Amadey component) and shell processes (`cmd.exe`, `powershell.exe`) spawned by scheduled tasks from suspicious locations or referencing Amadey/StealC paths.
This rule detects attempts to establish persistence by modifying Registry Run keys or creating files in Startup folders, specifically when the initiating process is 'explorer.exe'. This behavior is often associated with malware injecting into explorer.exe to maintain persistence.
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
Detects the use of reg.exe to add persistence via the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key. This rule specifically looks for the addition of 'NvmProtocal', 'protocal.cjs', or 'NodePackages' which are associated with a backdoor.
Detects the creation, deletion, or starting of a Windows service named 'MixedSvc' via sc.exe. This activity is associated with the 'Operation DragonReturn' campaign, where adversaries leverage a service masquerading as legitimate Windows Media Player components to maintain persistence.
Detects Millenium RAT attempting to bypass User Account Control (UAC) by spawning cmd.exe with the 'runas' verb via ShellExecuteExW. The rule specifically looks for cmd.exe processes running in High integrity, spawned from non-standard parent processes, while executing commands such as 'whoami'.
Detects malicious process injection behavior attributed to Operation DragonReturn, where an illegitimate executable named 'Mixed Reality.exe' located within a 'Windows Media Player' directory spawns 'svchost.exe'. This activity is indicative of a DcRAT payload attempting to inject fileless .NET code into a legitimate system process using techniques such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
Detects the creation or modification of Windows services related to 'MixedSvc' or 'MixedRealitySvc' registry keys performed by non-standard processes. The rule specifically flags registry keys that point to suspicious directories such as AppData, Temp, ProgramData, or Windows Media Player, which is indicative of persistence mechanisms used by malware like DcRAT.
Detects a suspicious sequence where a non-Microsoft signed process running from a user-writable path (e.g., Temp, AppData) spawns a high-integrity or SYSTEM process, followed immediately by persistence activity (modifying Run keys) or the creation of suspicious services/modification of security preferences.
Detects the use of the Windows Service Control Manager (sc.exe) to create, start, or delete a service named 'MixedSvc'. The rule includes specific checks for binPath configurations, which can be indicative of persistence or privilege escalation attempts using services.
Detects modifications to Windows Registry Run keys associated with the persistence mechanism of Millenium RAT, specifically looking for indicators such as the 'Liu5GgJiKiKqe2Qs' folder or suspicious 'MsEdgeUpdate' entries pointing to executable files in the AppData directory.
This rule monitors for the creation or modification of Windows Registry Run/RunOnce keys by executables residing in non-standard, user-writable directories (e.g., AppData, Temp, Downloads). It triggers when an initiating process performs this action while using masquerading names (matching common system binaries), using suspicious lure-themed naming, or when the run key value points to AppData for a file lacking version metadata, which are patterns observed in Millenium RAT activity.
Detects evidence of UAC bypass via ShellExecuteExW runas elevation from medium-integrity processes located in user-writable paths, followed by the creation of a persistent 'MixedSvc' service using sc.exe, as observed in the Operation DragonReturn campaign involving DcRAT.
Detects cross-process injection (Process Injection) from a specifically identified 'Mixed Reality' process into svchost.exe, followed by suspicious module loads (non-system32 DLLs) within that svchost.exe instance. This behavior pattern is consistent with DcRAT and XenoRAT deployment activities using masquerading or hijacked processes.
Detects potential DcRAT activity characterized by a process spawning under a svchost.exe parent, subsequent loading of GDI display libraries for screen capturing, and outbound network communication on non-standard ports, which indicates data exfiltration.
Page 85 of 401