Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects various suspicious activities associated with file staging and execution in the C:\Users\Public directory, including the handling of suspicious ZIP archives, renaming of executables (pythonw.exe to userscreen.exe), and the execution of specific batch scripts or obfuscated commands. These behaviors are indicative of an adversary staging tools or persistence mechanisms on a compromised system.
Detects attempts to bypass macOS Gatekeeper security controls by either removing the quarantine extended attribute or marking a file as executable using 'xattr' or 'chmod'. These techniques are used to allow untrusted or malicious applications to execute without user authorization.
Detects the sequential execution of multiple Microsoft-signed LOLBins (Living Off the Land Binaries) spawned by the same parent process (PowerShell or CMD) within a 5-minute window. This behavior is indicative of a cascading fallback mechanism used by post-exploitation tools to bypass application allowlisting or security controls.
Detects suspicious process injection attempts into browser processes (e.g., chrome.exe, msedge.exe) characterized by direct NT API syscall invocation (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) originating from a non-browser parent process. This behavior, often associated with the Remus infostealer, bypasses standard user-mode API hooking by using direct syscall stubs to chain injection actions.
Detects suspicious process injection attempts into browser processes (e.g., chrome.exe, msedge.exe) characterized by direct NT API syscall invocation (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) originating from a non-browser parent process. This behavior, often associated with the Remus infostealer, bypasses standard user-mode API hooking by using direct syscall stubs to chain injection actions.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
This rule detects PowerShell commands that utilize specific character array joining techniques (e.g., [char]nnnn -join '') often used to obfuscate malicious strings or bypass keyword-based security filters. This is a common tactic for evading detection when downloading or executing payloads.
Detects successful VPN authentication events targeting SonicWall devices during non-business hours (between 20:00 and 06:00, or on weekends). This behavior is characteristic of initial access tradecraft often employed by ransomware affiliates to gain network entry with minimal operational noise.
Detects memory regions associated with 'ntdll.dll' that are marked with Read, Write, and Execute (RWX) permissions. This pattern is commonly used in process injection techniques, such as reflective DLL injection or shellcode execution, where adversaries prepare executable memory space within a legitimate process to bypass standard security controls.
Detects potential abuse of rundll32.exe to execute commands or functions, particularly those involving references to 'WindowsUpdate.log' or direct execution with ordinal identifiers ('#1'). This rule also monitors file operations involving 'WindowsUpdate.log' initiated by common script interpreters like powershell.exe, cmd.exe, or rundll32.exe, which is often associated with obfuscated techniques to execute malicious payloads or bypass security controls.
Detects unauthorized in-memory memory modifications (specifically writing to memory segments with execute permissions) targeting critical security functions within 'amsi.dll' or 'ntdll.dll', such as 'AmsiScanBuffer' or 'EtwEventWrite'. This activity is characteristic of AMSI/ETW blinding, a technique used by threat actors to disable endpoint security scanning and event tracing capabilities.
Detects the creation of a local user account using the hardcoded 'Numlock!123' password, a characteristic artifact associated with Ransom Busters threat group operations. The rule monitors command-line activity from net.exe or net1.exe to identify attempts to add users with this specific, known malicious credential.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
Detects the execution of ServiceModelReg.exe following parent process activity involving vsdbg.dll/vsdbg.exe, coupled with cross-process access indicators consistent with COM Elevation Moniker UAC bypass and potential process hollowing. This pattern is associated with the PUROSANGUE loader chain used to execute malicious code within a high-integrity process context.
This rule monitors for network traffic related to known fake GitHub pages and malicious loader sites impersonating LastPass Authenticator. It detects attempts to access specific malicious domains and organization pages on GitHub, as well as the delivery of malicious pages containing spoofed trust badges and branding, commonly used in phishing campaigns.
Detects high-frequency, automated access to mail items via Microsoft Graph API (mail.read/MailItemsAccessed), consistent with automated scanning or exfiltration tools like ARToken's Inbox Monitor. The rule identifies suspicious patterns of repetitive access to mailbox folders or messages that may indicate Business Email Compromise (BEC) or automated credential-based harvesting.
This rule detects the execution of the legitimate Microsoft Visual Studio CoreCLR Debugger (vsdbg.exe) from an unauthorized file location. This behavior is indicative of masquerading, where the executable is renamed to appear as an installer to sideload a malicious companion vsdbg.dll, a technique observed in the Rapuncel/BoryptGrab campaign.
Detects the creation of a PowerShell process that identifies itself as being spawned by explorer.exe, while the process ID (PID) and parent process ID (PPID) relationship indicates inconsistency, often characteristic of the PSSpoof technique used by malware like SloppyRAT to evade detection by spoofing the process tree.
This rule detects two suspicious indicators related to SloppyRAT activity: an outbound network connection using the legacy Finger protocol (TCP port 79), which can be abused by binaries like 'finger.exe' for payload staging, and DNS queries resolving to the known SloppyRAT staging domain 'finger.linked4x.com'.
Detects evidence of SloppyRAT employing the Hell's Gate technique, specifically the resolution and indirect invocation of low-level NT system calls (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) designed to bypass EDR user-mode API hooking during process injection activities.
Detects instances where a user signs in via a Device Code authentication flow and subsequently adds a member to a highly privileged group (e.g., Domain Admins, Global Administrators) within one hour. This behavior is indicative of potential account compromise where an attacker uses an OAuth device code flow to establish access and then escalates privileges.
Page 116 of 864