Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the creation of image-related files with generic names in common temporary or user download directories that fall within a specific file size range (100KB-1000KB). These characteristics are often indicative of steganography where malicious payloads or data are embedded within seemingly benign image files to bypass security controls.
Detects potential Cobalt Strike Beacon process injection activity by monitoring Sysmon events for suspicious cross-process access (EID 10) and remote thread creation (EID 8). The rule specifically targets high-value host processes (svchost.exe, explorer.exe, rundll32.exe, notepad.exe) and filters common legitimate behaviors such as antivirus memory scanning and JIT compilation to reduce false positives.
Detects the unauthorized access or copying of the Active Directory NTDS.dit database file, a common credential harvesting technique. The rule monitors for the execution of ntdsutil.exe or vssadmin.exe with arguments typically used to create shadow copies or extract the NTDS database, specifically when executed by cmd.exe or powershell.exe.
Detects the use of the SharpGPOAbuse tool, typically used for modifying Group Policy Objects for persistence or privilege escalation, in conjunction with rapid Active Directory group enumeration (using net.exe or net1.exe) on the same host within a 5-minute window. This behavior is highly indicative of an adversary performing post-exploitation reconnaissance and privilege escalation activities.
This rule detects instances where the Windows Update service (wusvc.exe) loads a module or file while simultaneously initiating a process. This behavior is often associated with process injection or the misuse of legitimate system binaries (LOLBins) to facilitate malicious activities by proxying execution through trusted services.
This rule monitors for the execution of 'wusvc.exe' (a potential disguise for malicious binaries) when performed by users or on hostnames containing keywords associated with security research, sandboxing, or testing such as 'sandbox', 'malware', 'virus', or 'sample'.
Detects file write or delete operations involving cmd.exe by processes potentially associated with the TrymeLocker ransomware, specifically looking for indicators of ownership or permission modification (takeown, icacls) and suspicious file paths.
Detects processes located outside of standard Windows system directories (System32 and SysWOW64) that load the advapi32.dll library. Advapi32.dll is a core Windows API library frequently used for security-related functions, including service control and registry manipulation; its loading by non-system binaries can be indicative of masquerading or malicious activity.
Detects suspicious execution patterns involving Windows file management utilities (takeown.exe, icacls.exe) or the deletion of command-line interpreter binaries through cmd.exe. These patterns are often associated with unauthorized modifications of file permissions or attempts to clear forensic evidence during an intrusion.
This rule detects file creation or modification events associated with the Miasma campaign. It identifies specific payload files (e.g., .claude/setup.mjs, .vscode/tasks.json), the use of specific marker strings in file metadata or origin URLs, and obfuscated task configurations in VS Code directories that leverage bun or node to execute base64-encoded or character-encoded commands.
Detects instances where rundll32.exe is used to execute a file with a suspicious non-DLL extension (such as .tmp, .dat, .bin, .jpg, etc.) by specifying an exported function via an ordinal number. Adversaries often use this technique to proxy malicious code execution while attempting to evade security tools that only look for standard .dll extensions.
Detects suspicious processes attempting to query specific registry keys related to system locale settings (HKLM\SYSTEM\ControlSet001\Control\Nls\CustomLocale\en-US). This behavior is characteristic of the Grixba infostealer performing geofencing or locale-based checks to determine if the environment is a target of interest.
Detects instances of rundll32.exe being executed with command-line arguments that suggest malicious activity, specifically loading modules from remote UNC paths, using the javascript: protocol, or explicitly invoking ShellExec_RunDLL via shell32.dll. This rule filters out legitimate signed Microsoft binaries to focus on potentially unauthorized or malicious proxies.
Detects the execution of MAVInject.exe (Microsoft Application Virtualization Injector) with the /INJECTRUNNING parameter, a technique used to inject malicious code into a running process to evade detection.
Detects unauthorized attempts to terminate, stop, or access Endpoint Detection and Response (EDR) or Antivirus agent processes. This is identified by monitoring command-line utilities like taskkill, net, and sc targeting known security service names, as well as detecting suspicious cross-process access (e.g., OpenProcess) by unauthorized processes targeting security agent PIDs.
Detects the creation, reading, or execution of payloads stored within NTFS Alternate Data Streams (ADS). This technique is commonly used by adversaries to hide malicious content within file metadata to evade security tools. The rule monitors process command-line arguments for ADS syntax, identifies usage of utilities like type, Get-Content, wmic, or various LOLBins (e.g., regsvr32, rundll32) interacting with ADS paths, and flags anomalous file creation/modification events that involve ADS, excluding known system-generated streams.
Detects the creation of scheduled tasks using schtasks.exe that exhibit suspicious characteristics. This includes tasks referencing external URLs, those containing base64-encoded or obfuscated command strings, and tasks pointing to binaries or scripts in user-writable paths (e.g., AppData, Temp). The rule specifically targets tasks intended to run with SYSTEM privileges or those using common persistence triggers, while excluding known legitimate administrative software.
Detects the execution of PowerShell commands intended to suspend BitLocker encryption. Adversaries may attempt to disable or suspend disk encryption to facilitate data exfiltration or to modify protected system files.
Detects reconnaissance activity associated with Pay2Key ransomware, specifically sandbox or environment checks. This includes process lineage originating from 7ZipSfx temporary directories combined with registry queries for S-1-5-19 (SYSTEM account) or direct file system access to Avast installation directories to verify the presence of security software.
Detects the execution of 7-Zip self-extracting archive components (specifically a specific version of 7ZSfxMod) extracted to a temporary directory structure mimicking Google Chrome updates. This pattern is associated with the Pay2Key ransomware infection chain, where setup.cmd and 7za.exe are dropped to facilitate malicious activity.
Detects behavior patterns consistent with Remcos RAT, specifically: 1) unauthorized process injection (CreateRemoteThread/ProcessInjection) into common host processes, 2) spawning of browser-related processes (iexplore.exe, ieinstal.exe, ielowutil.exe) from non-standard parent processes, and 3) anomalous outbound network connections from these injected processes over non-standard ports.
Page 315 of 864