Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
This rule detects suspicious process injection activity where an untrusted process attempts to inject code into common trusted Windows processes (svchost.exe, explorer.exe, notepad.exe, rundll32.exe, dllhost.exe, taskhost.exe, taskhostw.exe) using a combination of VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread API calls. This behavior is often associated with malware, such as StealC, attempting to evade detection and maintain persistence.
Detects various post-exploitation activities associated with the Amadey loader, including the execution of its persistence mechanism (nudwee.exe), dropping and executing secondary payloads in temporary directories, using PowerShell download cradles, creating scheduled tasks for persistence, and silent MSI installations. This rule aims to identify the delivery of secondary payloads like StealC and Lumma Stealer.
Detects a potential logging sink hijack in Google Cloud Platform (GCP) by identifying the deletion of a logging sink's destination bucket followed by the creation of a new bucket with the same name in a different project. This technique could allow an attacker to redirect logs to an attacker-controlled bucket, impairing defenses and potentially exfiltrating sensitive log data.
Detects suspicious named pipe server creation by Medium/Low integrity processes followed by a SYSTEM-level process spawned from the same initiating process within a short correlation window. This behavior is indicative of an attacker attempting to escalate privileges using named pipe impersonation.
Detects the sc.exe utility creating a kernel-mode driver service pointing to a newly dropped .sys file in a temporary user directory. This activity is indicative of Bring Your Own Vulnerable Driver (BYOVD) techniques, often used by attackers to gain kernel-mode privileges and bypass security solutions.
Detects the loading of specific vulnerable drivers (Huawei, Topaz Antifraud, Tower of Fantasy, K7 Security) abused by DragonForce ransomware in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security software.
Detects Vidar Stealer scanning the memory of a forked browser process for the Chromium KeyRing 32-byte pattern using NtReadVirtualMemory and NtQueryVirtualMemory to locate the v20_master_key across MEM_COMMIT and MEM_PRIVATE regions.
Detects registration of malicious DLLs as LSASS drivers for credential theft
Detects process doppelganging using NTFS transactional operations
Detects registration of malicious time provider DLLs for SYSTEM persistence
Detects deployment of AppDomainManager hijack assemblies for .NET execution
Detects writing to /proc/self/mem for in-memory code injection on Linux
Detects the execution of the SharpGPOAbuse utility or the use of its specific command-line arguments intended for manipulating Active Directory Group Policy Objects (GPOs) to achieve privilege escalation or persistence.
Detects the modification of Windows registry run keys (HKCU or HKLM) by SystemSettings.exe or msiexec.exe. This activity is often associated with persistence mechanisms where an adversary attempts to maintain execution across system reboots by registering malicious code in startup locations.
Detects behavior patterns associated with the SharkLoader malware, specifically monitoring for anomalous thread creation, potential modification of primary tokens, and suspicious loading of SystemSettings.dll from non-standard directories (e.g., AppData, ProgramData). This rule aims to identify evasive techniques used to bypass Windows Loader Lock detection.
This rule detects potential credential capture by monitoring for unauthorized usage of Windows API functions associated with keyboard hooking, such as SetWindowsHookEx and GetAsyncKeyState. It specifically flags suspicious process activity, such as the execution of the 'Pillager' tool or processes interacting with specific suspicious file paths, while excluding common legitimate processes that routinely perform keyboard hooking.
Detects potential SharkLoader shellcode injection patterns, where a suspicious executable (e.g., sideloaded SystemSettings.exe) from specific non-standard directories initiates cross-process memory operations like VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread into critical system processes such as svchost.exe or explorer.exe.
Detects modification of Azure management groups to bypass governance policies
Detects abuse of native Windows API calls for process injection and execution
Detects malicious installer packages with custom actions for persistence
Detects the creation of scheduled tasks or command-line execution of task scheduling utilities (schtasks.exe, at.exe) that reference known SharkLoader persistence paths, file names, or task naming conventions.
Page 98 of 401