Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the creation of specific system mutexes commonly used by malware for persistence or to avoid multiple infections (Mutual Exclusion). It monitors for both a specific hardcoded mutex and a pattern-based approach (15-20 alphanumeric characters) initiated by executables from common temporary or user-writable directories, which is a frequent indicator of malicious secondary payloads or droppers.
This rule detects the creation of specific system mutexes commonly used by malware for persistence or to avoid multiple infections (Mutual Exclusion). It monitors for both a specific hardcoded mutex and a pattern-based approach (15-20 alphanumeric characters) initiated by executables from common temporary or user-writable directories, which is a frequent indicator of malicious secondary payloads or droppers.
This rule monitors for processes named 'msedge.exe' executing from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. The rule filters out legitimate Edge update processes and common browser command-line arguments to isolate potentially malicious masquerading attempts by identifying binaries that share the name of a legitimate application but reside in unexpected, often non-standard locations.
Detects a multi-stage cloud attack sequence involving a sign-in anomaly, modification of user authentication methods (e.g., registering an attacker-controlled device), reconnaissance using Microsoft Graph API, and subsequent abnormal data access/download, typically observed in Storm-3121 and Storm-3032 activities.
Detects evidence of the MovieReaper loader technique. This behavior involves registering or rewriting Vectored Exception Handlers, allocating memory with EXECUTE_READWRITE protection, and triggering debug-break exceptions to redirect execution into raw NtProtectVirtualMemory syscalls, effectively bypassing user-mode API hooks often used for monitoring.
Detects bulk file deletion activities (three or more files deleted or moved to the recycle bin) within SharePoint or OneDrive by a specific user within a 30-minute window, which may indicate malicious activity or data destruction.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
Detects a suspicious pattern where a user registers a new PhoneAppOTP MFA method and subsequently logs in using this method after a significant time delay (exceeding 3 days). This behavior is indicative of an attacker who has gained temporary access, registered their own MFA device to ensure persistent future access, and returned later to utilize it.
This rule detects successful sign-in activity to the 'My Sign-Ins' application where the device is not marked as trusted or the sign-in carries a non-zero risk level. This behavior may indicate an adversary attempting to gain access to account security settings or sensitive portal information using compromised or unmanaged devices.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
This rule detects the execution of a process named 'WhatssApp.exe' from a non-standard location ('C:\ProgramData\Drivers\Whatsapp\'), which is indicative of masquerading. It further correlates this activity with the prior termination of the legitimate 'whatsapp.exe' process within a 30-minute window, a pattern often associated with 'WhatsappCheker' or similar malicious tools designed to hijack legitimate application sessions.
This rule detects the execution of a process named 'WhatssApp.exe' from a non-standard location ('C:\ProgramData\Drivers\Whatsapp\'), which is indicative of masquerading. It further correlates this activity with the prior termination of the legitimate 'whatsapp.exe' process within a 30-minute window, a pattern often associated with 'WhatsappCheker' or similar malicious tools designed to hijack legitimate application sessions.
This rule detects the execution of a process named 'WhatssApp.exe' from a non-standard location ('C:\ProgramData\Drivers\Whatsapp\'), which is indicative of masquerading. It further correlates this activity with the prior termination of the legitimate 'whatsapp.exe' process within a 30-minute window, a pattern often associated with 'WhatsappCheker' or similar malicious tools designed to hijack legitimate application sessions.
Detects instances where a process named MsCache.exe deletes files within the Google Chrome User Data directory. This pattern may indicate unauthorized activity by a process masquerading as a cache-related utility to modify or delete browser-related artifacts.
Detects instances where the VLC Media Player process (vlc.exe) acts as the parent to common LOLBAS (Living Off the Land Binary and Script) executables such as cmd.exe, powershell.exe, and others. This pattern is often indicative of exploitation attempts or malicious activity where a compromised or trojanized application triggers secondary payloads.
Detects potential exploitation of a CrowdStrike Falcon remediation process vulnerability ('FalconFlank'). The rule identifies either direct execution of the PoC binary or the suspicious combination of a CrowdStrike remediation process loading an unsigned or untrusted DLL from a user-writable path followed by the same process spawning a command shell in the SYSTEM context within 15 minutes.
This rule detects DNS queries for specific lookalike domains (e.g., *uzrailwaystax.com, *devon-uz.com) known to be used as Command and Control (C2) infrastructure by the threat actors associated with BloodAlchemy and the SpiceRAT malware.
Detects the use of .NET reflection assembly loading techniques (e.g., Assembly.Load, [Reflection.Assembly]::Load) within the command line arguments of known LOLBAS (Living Off the Land Binary and Script) processes. This behavior is frequently associated with fileless malware execution or the loading of malicious assemblies directly into the memory space of trusted Windows binaries.
This rule detects PowerShell commands that enumerate system, security, or virtualization-related artifacts. It specifically looks for the usage of WMI and PowerShell cmdlets (e.g., Get-Process, Get-WmiObject) to query for known analysis tools, debuggers, or virtualization software strings, which is a common behavior of malware attempting to identify and evade sandbox or analyst environments.
Detects persistence mechanisms associated with BabylonRAT that utilize Windows Registry Run or RunOnce keys. The rule specifically identifies instances where a file named 'firefox.exe' is executed from the 'ProgramData' directory, which is a common indicator of a masqueraded malicious binary attempting to achieve persistence.
Page 136 of 864