Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
8,410 detections
Filters
Last updated
All Time
Detection languages
3,122
2,732
773
499
379
Contributors
1,502
1,474
1,085
844
510
Categories
2,697
1,321
905
813
750
Platforms
5,935
913
886
299
280
Products / Services
1,617
1,401
1,093
454
419
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
29
27
16
16
15
IDS Classtypes
97
50
21
14
8
IDS Protocols
98
93
9
1
Detects the execution of SharpGPOAbuse or usage of its associated command-line arguments. This tool is frequently used by attackers to modify Group Policy Objects (GPOs) in an Active Directory environment to achieve privilege escalation or persistent access.
Detects the loading of 'SystemSettings.dll' by 'SystemSettings.exe' when the process is launched from an unusual path, specifically within the user's AppData directory. This behavior is indicative of potential DLL sideloading, where an attacker attempts to masquerade as or hijack the execution flow of a legitimate Windows utility by placing a malicious DLL in an untrusted, user-writable directory.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring memory protection changes (VirtualProtect) targeting the AmsiScanBuffer function within the amsi.dll module. Attackers often modify this function's memory permissions to PAGE_EXECUTE_READWRITE to inject code or patch the function, effectively disabling AMSI scanning capabilities.
Detects unauthorized modifications to common Windows persistence registry keys, including Winlogon shell/userinit hijacking, Image File Execution Options (IFEO) debugger abuse, and known malicious Run key entries.
Detects a process running at SYSTEM integrity level spawned by a parent process that is not typically associated with SYSTEM-level process creation (e.g., services.exe, lsass.exe). This behavior is characteristic of token impersonation or process spawning abuse (e.g., CreateProcessWithTokenW) used by post-exploitation frameworks like Cobalt Strike or tools involved in the StrikeShark campaign to escalate privileges.
Detects potential SharkLoader persistence mechanisms where a registry 'Run' key is modified to execute a file located in AppData or ProgramData, or containing a base64-encoded command. The detection correlates the registry modification with a recent file creation event of the referenced file in the same directory paths on the same host.
Detects the loading of ntdll.dll or amsi.dll by the Windows Update Service (wusvc.exe). This pattern is often observed in the context of advanced techniques like SNOWLIGHT, which uses direct syscall table enumeration to bypass security controls. Monitoring for these modules in this specific process context can indicate memory-resident malicious activity or evasion attempts.
This rule detects unauthorized modifications to the Windows Image File Execution Options (IFEO) registry keys for accessibility binaries (sethc.exe, utilman.exe, osk.exe, magnify.exe, narrator.exe). Adversaries often replace or redirect these binaries to execute arbitrary code (often a backdoor or persistent access tool) with high privileges, typically triggered at the Windows login screen. The rule specifically looks for a 'debugger' registry value containing 'win_guard_'.
Detects unauthorized modifications to the Winlogon registry keys 'Shell' and 'Userinit'. These keys are commonly abused by adversaries to achieve persistence by executing malicious binaries or scripts upon user logon. The rule excludes modifications by the SYSTEM account and flags deviations from standard Windows configuration values (e.g., non-standard Shell values, or Userinit values that do not point to the expected system file).
Detects the execution of a malicious file named wusvc.exe, known as the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update Service. The rule identifies instances where this file is run from suspicious locations (e.g., Downloads folder) or triggers UAC elevation despite not being associated with recognized Windows update processes.
Detects execution and suspicious memory operations by 'wusvc.exe', a known dropper for the SNOWLIGHT malware. The rule monitors for direct syscalls (NtAllocateVirtualMemory, NtProtectVirtualMemory) and remote thread injection attempts (CreateRemoteThread, QueueUserApc) typical of evasion techniques used to bypass EDR hooks and execute payloads. It further filters for anomalies based on execution path (e.g., Temp, Downloads) or specific process file hashes.
Detects the modification of Image File Execution Options (IFEO) registry keys for Windows accessibility binaries (e.g., sethc.exe, utilman.exe). Adversaries frequently use this technique to hijack these binaries to launch a command shell with SYSTEM privileges when triggered from the login screen.
Detects potential Asynchronous Procedure Call (APC) injection by monitoring for processes running from user-writable directories that request broad access (PROCESS_ALL_ACCESS) to other processes, or by detecting the initiation of QueueUserAPC or NtQueueApcThread remote thread creation.
Detects the creation of suspicious scheduled tasks associated with TrymeLocker ransomware. The rule monitors for tasks named 'RageGuard' or 'win_guard', as well as tasks registered with high privileges using non-standard file paths such as AppData, Temp, or ProgramData, triggered by system logon or startup.
Detects the SNOWLIGHT dropper (UNC5221) masquerading as the Windows Update service (wusvc.exe). It monitors for the creation of a Windows service named 'wusvc' or 'Windows Update Service' located outside of standard system directories, and the execution of 'wusvc.exe' from user-writable directories like AppData, Temp, or Downloads, indicating potential malicious persistence or dropper activity.
Detects activity associated with the SNOWLIGHT malware, specifically the dropping of a malicious executable named 'wusvc.exe' or 'WindowsUpdate' into user-writable directories (Downloads or AppData), followed by the creation of an automatically starting Windows service that executes the dropped file. This rule correlates process creation/service registration events with SCM event 7045 entries.
Detects unauthorized modifications to the Winlogon Shell or Userinit registry keys. The rule specifically alerts when these keys are updated to point to a binary located outside of standard Windows system directories (System32 or Program Files), which is a common persistence technique used by the TrymeLocker ransomware and other malicious software to execute code at user logon.
Detects the use of specific Windows API functions or terms commonly associated with process hollowing, code injection, or advanced process manipulation within command-line strings. The monitored functions include NtCreateWaitCompletionPacket, NtAssociateWaitCompletionPacket, RtlGetCurrentPeb, ProcessPrng, and PowerRegisterSuspendResumeNotification.
This rule detects potential memory-resident malware or staging activity by identifying instances where a high volume of DLL, OCX, or SYS files are loaded from user-writable directories (Temp, AppData, Users) on a specific device within a one-hour window. A threshold of 5 or more unique image loads from these locations is flagged as potentially suspicious, as it may indicate an attacker loading multiple malicious components or modules.
Detects modifications to Windows Registry keys related to Component Object Model (COM) objects (CLSID or InprocServer32) where the registry value points to suspicious file paths, specifically those within temporary directories like Temp or AppData. This behavior is indicative of an attacker attempting to establish persistence or perform privilege escalation by hijacking COM object execution flow.
Detects potential ransomware activity (specifically VILE) that utilizes direct NT system calls and specific API interactions (e.g., NtCreateWaitCompletionPacket) to bypass user-mode EDR hooks. The rule monitors for a combination of suspicious process activity, unexpected image loads of ntdll.dll, and specific API calls often associated with evasion techniques in Go-based binaries.
Page 99 of 401