Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the addition of Microsoft Defender exclusions (Path, Extension, or Process) via WMIC or PowerShell, followed by a file creation event within a suspicious directory (e.g., Temp, AppData, ProgramData) within 15 minutes. This behavior is indicative of an adversary attempting to bypass antivirus detection for malicious payloads.
Detects the use of conhost.exe with the --headless flag to execute Node.js payloads silently. This technique is used by EtherRAT to run its malicious JavaScript payloads without displaying a console window to the user.
This rule detects command line patterns associated with Cobalt Strike Beacon injection, specifically looking for indicators of 'beacon.dll', 'beacon.exe', or 'injection' strings being executed by suspicious parent processes such as explorer.exe, svchost.exe, or winlogon.exe. This activity is indicative of post-exploitation behavior and potential lateral movement or persistence attempts.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key LoLBin technique used in the CrashFix campaign.
Detects instances where the process MpExtMs.exe loads suspicious DLLs (e.g., EndpointDlp.dll, version.dll) or spawns child processes, which is consistent with DLL sideloading patterns associated with the Backdoor.Mistic malware.
Detects reads of HKLM\SYSTEM\CurrentControlSet\Control\SystemStartOptions, the value that stores boot parameters (e.g. NOEXECUTE=OPTIN vs SAFEBOOT:MINIMAL). Ransomware including Snatch and Qilin query this key to determine whether the host is already in Safe Mode before forcing a reboot and encrypting with AV/EDR unloaded.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
Treat as a high-interest hunting lead when paired within minutes with Safe Mode staging:
bcdedit /set safeboot, reg add under SafeBoot\Minimal or SafeBoot\Network, or
shutdown /r.
This rule detects suspicious activity indicative of virtualization or sandbox evasion. It looks for the loading of 'mpr.dll' in conjunction with specific registry keys related to VirtualBox ('HARDWARE\ACPI\DSDT\VBOX_'). Additionally, it identifies processes executing with command lines containing strings associated with Sandboxie ('sbiedll.dll'), network connection functions ('WNetAddConnection2W'), or queries for video controller information ('SELECT CurrentRefreshRate FROM Win32_VideoController'), which are often used by malware to detect analysis environments. The rule also correlates 'mpr.dll' and 'sbiedll.dll' loads within the same process.
Detects attempts to inject code into browser processes (Chrome, Edge, Brave) using various API calls associated with process injection techniques. This rule specifically looks for calls like QueueUserApcRemoteApiCall, NtQueueApcThreadApiCall, CreateRemoteThreadApiCall, and WriteProcessMemoryApiCall, especially when combined with specific functions like CryptUnprotectMemory or NtQueueApcThread, within a short time frame.
This rule detects a suspicious sequence of events: the enablement of Remote Desktop Protocol (RDP) via registry modification, followed by the creation of a new local administrator account with password expiration disabled, potentially accompanied by a netsh firewall rule modification to allow RDP. This combination of actions is highly indicative of an adversary establishing persistent remote access and creating a backdoor account.
This rule detects the execution of 'vaultsvc.exe' or executables starting with 'WindowsVault' and ending with '.exe' from suspicious, non-standard directories such as AppData, ProgramData, or Temp. It also flags execution from any non-system path if not in System32, SysWOW64, or Program Files. A known malicious hash for 'vaultsvc.exe' is specifically identified.
Detects the execution of the 'RevS.ps1' PowerShell reverse shell, identified by its filename, SHA256 hash, or characteristic command-line arguments such as encoded commands or the use of 'ExecutionPolicy Bypass' combined with download cradle patterns (IEX, Invoke-Expression, DownloadString).
Detects attempts to bypass User Account Control (UAC) using PowerShell's Start-Process cmdlet with the -Verb RunAs parameter, often seen in techniques like Operation Poisson. This method attempts to trigger the Windows consent dialog for privilege escalation, potentially leveraging auto-elevating binaries like fodhelper.exe, eventvwr.exe, sdclt.exe, or cmstp.exe.
Detects instances where 'node.exe' accesses browser extension LevelDB directories (associated with cryptocurrency wallets in Chrome, Edge, or Brave) or executes with suspicious command-line arguments such as 'protocal.cjs', 'NodePackages', or 'nvmconf'. This behavior is indicative of potential malware attempting to exfiltrate sensitive browser data or execute malicious code.
Detects the use of PowerShell to modify Windows Defender settings by adding the root C:\ directory to the exclusion list. This behavior is indicative of Millenium RAT attempting to evade detection and maintain persistence on a compromised host.
Detects suspicious PowerShell activity characterized by command-line obfuscation (including BigInteger patterns) or network connections to suspicious 'photo-*.cfd' domains often associated with malicious file downloads.
Detects Millenium RAT attempting to bypass User Account Control (UAC) by spawning cmd.exe with the 'runas' verb via ShellExecuteExW. The rule specifically looks for cmd.exe processes running in High integrity, spawned from non-standard parent processes, while executing commands such as 'whoami'.
Detects malicious process injection behavior attributed to Operation DragonReturn, where an illegitimate executable named 'Mixed Reality.exe' located within a 'Windows Media Player' directory spawns 'svchost.exe'. This activity is indicative of a DcRAT payload attempting to inject fileless .NET code into a legitimate system process using techniques such as VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread.
Detects attempts to terminate security product processes, either through cross-process termination or by executing taskkill.exe targeting security product image names. This behavior is indicative of an attacker attempting to disable endpoint protection software to evade detection.
Detects a suspicious sequence where a non-Microsoft signed process running from a user-writable path (e.g., Temp, AppData) spawns a high-integrity or SYSTEM process, followed immediately by persistence activity (modifying Run keys) or the creation of suspicious services/modification of security preferences.
This rule detects unauthorized modifications to the Antimalware Scan Interface (AMSI) in memory. It specifically monitors for calls to VirtualProtect or VirtualProtectEx when directed at amsi.dll or attempting to patch AmsiOpenSession, which is a common technique used by malware to disable AMSI scanning capabilities and evade EDR/AV inspection.
Detects the use of PowerShell commands 'Add-MpPreference' or 'Set-MpPreference' to add the entire C drive as an exclusion path for Windows Defender. This is a common technique used by attackers to disable security monitoring for the entire file system.
Page 319 of 864