Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the creation or renaming of files within the '\ProgramData\doxc' directory, and correlates this with the execution of 'mklink /H' commands that point to that directory. This behavior is indicative of an adversary establishing persistence or hiding files by creating hard links.
Detects the creation or renaming of files within the '\ProgramData\doxc' directory, and correlates this with the execution of 'mklink /H' commands that point to that directory. This behavior is indicative of an adversary establishing persistence or hiding files by creating hard links.
This rule detects the execution of cmd.exe or powershell.exe where the command line arguments involve the deletion or renaming of specific file names potentially associated with unauthorized activities or malware components. It looks for common command-line utilities (del, ren) being used by command shells on specific files that may indicate artifact cleanup or staging.
Detects malicious scheduled task creation using names associated with Microsoft Edge updates, or the execution of PowerShell commands that utilize encoded arguments and known APT36 download cradles, indicating an attempt to establish persistence or retrieve secondary payloads.
This rule detects potential unauthorized access to the 'My Sign-Ins' portal in Azure AD by monitoring for logins associated with multiple unique source IP addresses or Autonomous System Numbers (ASNs) for a single user account. This behavior is indicative of session hijacking or account compromise where an adversary is accessing the account from a different network than the legitimate user.
Detects DNS queries and HTTP Host header traffic to known SilverFox malware impersonation domains. These domains utilize .com.cn TLDs and typosquatting techniques to masquerade as legitimate software or service providers.
Detects the PUROSANGUE malware loader, which achieves execution by being sideloaded as 'vsdbg.dll' alongside a legitimate debugger executable. The detection leverages YARA rules focusing on specific artifacts such as a hardcoded build path, a custom Base16 alphabet, and a structural anomaly in the PE file's .reloc section compared to the declared base relocation directory size, alongside known malicious hash values.
Detects the loading of the Alinubx.sys kernel driver or the creation of an NvFsFilter service, which are associated with a BYOVD (Bring Your Own Vulnerable Driver) attack leveraging a renamed CcProtect driver to bypass security protections such as PPL.
Detects execution of the MovieReaper initial loader binary. This malware employs advanced anti-analysis techniques, specifically manual PEB-walking to resolve APIs and evade detection by standard library loading hooks. The rule alerts on known file hashes and specific masquerading filenames.
This rule detects when the MpDlpService.exe process loads the 'mpclient.dll' library from a location other than the legitimate Windows Defender program directories. This behavior is indicative of potential DLL side-loading or hijack execution flow attempts targeting the Microsoft Data Loss Prevention service.
This rule detects malicious activity related to the exploitation of MpDlpService.exe. It looks for the execution or presence of known malicious file hashes associated with this threat, including a P-stage script, payload files, and a malicious mpclient.dll. Additionally, it identifies instances where the legitimate MpDlpService.exe binary is executed from a non-standard, suspicious directory, which is a common indicator of side-loading or persistence techniques.
This rule detects when the MpDlpService.exe process loads the 'mpclient.dll' library from a location other than the legitimate Windows Defender program directories. This behavior is indicative of potential DLL side-loading or hijack execution flow attempts targeting the Microsoft Data Loss Prevention service.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
This rule detects malicious activity related to the exploitation of MpDlpService.exe. It looks for the execution or presence of known malicious file hashes associated with this threat, including a P-stage script, payload files, and a malicious mpclient.dll. Additionally, it identifies instances where the legitimate MpDlpService.exe binary is executed from a non-standard, suspicious directory, which is a common indicator of side-loading or persistence techniques.
Detects execution of the MovieReaper initial loader, which employs specific anti-sandboxing and anti-analysis techniques. The detection relies on identified file hashes, as well as heuristic analysis of process filenames containing common media-related keywords in sensitive directories and command line arguments indicating the presence of Global mutexes.
Detects the execution of msiexec.exe to install an MSI package from a remote URL (http/https). The command line includes flags for passive installation (/passive) and an installation parameter (/i), initiated directly by Windows Explorer (explorer.exe), which is often associated with a user manually downloading and opening a malicious MSI file.
Detects a suspicious process chain where an AutoIT loader (originating from temporary directories or associated with charmap.exe command line anomalies) executes charmap.exe, followed by the loading of amsi.dll within that charmap.exe process. This behavior is indicative of AsyncRAT injection patterns, specifically where charmap.exe is used as a host process to tamper with AMSI via in-memory patching of AmsiScanBuffer.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
Detects a suspicious sequence of anti-analysis behaviors on macOS, where a process first checks for the presence of a hypervisor via sysctl (kern.hv_vmm_present) and subsequently invokes ptrace with PT_DENY_ATTACH, a technique often used to prevent debuggers from attaching to a process.
Detects PowerShell execution commands attempting to disable Antimalware Scan Interface (AMSI) by reflectively accessing System.Management.Automation.AmsiUtils. This is a common technique used by attackers to execute malicious scripts while avoiding detection by security software.
Detects Python compiled bytecode (.pyc) files that have been renamed to .cat, a common Windows Security Catalog extension. This is a masquerading technique often used by backdoors to evade detection and facilitate malicious loader execution.
Page 111 of 864