Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,130 detections
Filters
Last updated
All Time
Detection languages
6,549
6,210
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,130
15,658
12,604
8,415
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects in-memory execution and stack-spoofing activities associated with the SparroWocky BOF loader (RunCOFF). It monitors for suspicious remote thread creation (EventCode 8), process access with highly permissive access masks (EventCode 10), and the loading of specific suspect DLLs (EventCode 7) that are indicative of this technique.
Detects instances of process call stack spoofing, specifically techniques like SparroWocky (hooking CreateThread to report fake start addresses such as AnimateWindow) or SilentMoonwalk (forged call stacks masking API call origins as RtlUserThreadStart or BaseThreadInitThunk) used to evade EDR behavioral monitoring.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
This rule detects the repeated use of known default credentials (specifically common factory passwords) across multiple device hostnames. It monitors process command lines or event log data for password patterns matching specific hardcoded strings associated with camera device vulnerabilities. By aggregating hits across different devices, it identifies potential automated brute-force or credential-stuffing campaigns targeting IoT camera infrastructure.
Detects TLS connections where the certificate subject is 'azure.uzrailwaystax.com' and the issuer is 'TLC DV TLS CA', indicating potential impersonation of the Uzbekistan railway authority infrastructure, likely associated with SilkParasite activity.
Detects HTTP GET requests to a specific URL path containing an image file, which is associated with the delivery of the LausivLoader malware. The rule monitors for external connections to the domain 'yapw.life' requesting a PNG file, a technique often used for steganographic payload delivery.
Detects network activity related to the exploitation of Dahua P2P relay services via easy4ipcloud.com. The rule monitors for unauthorized device probing, serial number enumeration, and illicit relay authentication attempts (e.g., using DHP2P protocols and X-WSSE authentication), which are indicative of attackers attempting to abuse IoT device remote access functionality (CVE-2025-31702).
Detects the execution of PowerShell with suspicious command-line arguments (obfuscation, hidden windows, or encoded commands) directly spawned from explorer.exe. This activity is frequently associated with malicious scripts or payloads executing in the context of user activities to evade detection.
Detects malicious PowerShell scripts that perform reflective loading of .NET DLLs into memory. The rule identifies patterns associated with the 'ClickFix' or 'StealC' loaders, specifically looking for combinations of Assembly.Load, GZip decompression, and hardcoded AES encryption keys/IVs frequently used by these campaigns.
Detects WriteProcessMemory or CreateRemoteThread operations targeting csc.exe or chrome.exe. This activity is often associated with process injection techniques used to execute code within the context of a legitimate or compiler-related process.
Detects WriteProcessMemory or CreateRemoteThread operations targeting csc.exe or chrome.exe. This activity is often associated with process injection techniques used to execute code within the context of a legitimate or compiler-related process.
This rule detects suspicious process injection activity directed at Chrome or Edge browser processes, followed immediately by file access to sensitive browser data files like 'Login Data' or 'Cookies'. This pattern is indicative of an adversary attempting to steal credentials or session cookies from a user's web browser memory and disk storage.
This rule detects PowerShell command lines that include .NET API calls typically used for anti-debugging and anti-analysis evasion, such as 'Debugger.IsAttached', 'Debugger.IsLogging', 'CheckRemoteDebuggerPresent', and 'Environment.FailFast'. These checks are common in malicious loaders and implants to determine if the process is being analyzed or monitored, allowing the malware to modify its behavior accordingly.
Detects the use of the [Reflection.Assembly]::Load method within PowerShell command lines. This method is often abused by attackers to reflectively load malicious .NET assemblies directly into memory, bypassing disk-based security controls.
Detects the use of PowerShell commands that perform decryption (AES-256-CBC) and decompression (Gzip) of data, followed by the reflective loading of a .NET assembly into memory using [Reflection.Assembly]::Load. This behavior is indicative of fileless malware execution where a payload is hidden in an obfuscated or compressed format and unpacked at runtime.
Detects PowerShell instances performing suspicious memory operations like thread injection (e.g., VirtualAllocEx, WriteProcessMemory, CreateRemoteThread) targeting common processes such as csc.exe, browser processes (chrome.exe, msedge.exe), and system processes like SearchIndexer.exe. This activity is indicative of malicious code injection often used in stealth execution and credential harvesting campaigns.
Detects the use of the native Windows utility cipher.exe with the /w flag. This command is designed to overwrite free disk space with random data to sanitize it and make previously deleted files irrecoverable. While this is a legitimate administrative feature, adversaries may utilize it as a form of anti-forensics or to perform data destruction.
Detects the use of the native Windows utility cipher.exe with the /w flag. This command is designed to overwrite free disk space with random data to sanitize it and make previously deleted files irrecoverable. While this is a legitimate administrative feature, adversaries may utilize it as a form of anti-forensics or to perform data destruction.
Detects instances of PowerShell being launched directly from Windows Explorer (explorer.exe) using suspicious command-line arguments. This pattern is commonly associated with malicious scripts, remote access trojans, or fileless execution techniques where an adversary executes code through shell-based file interaction.
Page 121 of 864