Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule monitors for the creation or modification of Windows Registry Run/RunOnce keys by executables residing in non-standard, user-writable directories (e.g., AppData, Temp, Downloads). It triggers when an initiating process performs this action while using masquerading names (matching common system binaries), using suspicious lure-themed naming, or when the run key value points to AppData for a file lacking version metadata, which are patterns observed in Millenium RAT activity.
Detects anomalous PowerShell process execution by monitoring for indicators of obfuscation, use of download cradles, and execution from suspicious parent processes. This detection specifically aligns with techniques associated with the Millenium RAT C++ v4.x stagers, flagging processes that exhibit multiple risk indicators simultaneously.
Detects evidence of UAC bypass via ShellExecuteExW runas elevation from medium-integrity processes located in user-writable paths, followed by the creation of a persistent 'MixedSvc' service using sc.exe, as observed in the Operation DragonReturn campaign involving DcRAT.
Detects cross-process injection (Process Injection) from a specifically identified 'Mixed Reality' process into svchost.exe, followed by suspicious module loads (non-system32 DLLs) within that svchost.exe instance. This behavior pattern is consistent with DcRAT and XenoRAT deployment activities using masquerading or hijacked processes.
Detects potential DcRAT activity characterized by a process spawning under a svchost.exe parent, subsequent loading of GDI display libraries for screen capturing, and outbound network communication on non-standard ports, which indicates data exfiltration.
Detects the registration of a new device or MFA authentication method in Microsoft Entra ID from an IP address geolocated to Morocco. This is a persistence tactic used by the Jingle Thief group (also tracked as Atlas Lion and STORM-0539).
Detects Chrome launch with specific crash recovery evasion flags indicative of FlutterShell.
Detects the execution of known Windows privilege escalation tools commonly referred to as 'potato' exploits (e.g., JuicyPotato, SweetPotato, PrintSpoofer). These tools typically exploit service account misconfigurations or Windows APIs to achieve local privilege escalation to SYSTEM.
Detects the execution of the dllhost.exe process with command-line arguments referencing .cpl files or the 'COpenControlPanel' string. This behavior is indicative of potential malicious activity where attackers use Control Panel files (which are essentially DLLs) to proxy code execution, potentially to bypass security controls or masquerade as legitimate system activity.
Detects instances where the Windows Installer (msiexec.exe) initiates potentially suspicious child processes such as cmd.exe, rundll32.exe, or 7z.exe, particularly when these executions involve paths commonly associated with staging or executing malicious payloads, such as the AppData directory, temporary folders, or MSI installer subdirectories.
Detects the use of 7-Zip (7z.exe) to archive files named 'data.dat' or files within the 'Traiolx Custom Utils' directory, when initiated by command-line interpreters like cmd.exe or the Windows Installer (msiexec.exe). This pattern is often indicative of data staging or collection activities prior to exfiltration.
This rule monitors for processes running from a specific directory under 'AppData\Roaming\traiolx custom utils\' that load critical Windows system libraries ('user32.dll' or 'kernel32.dll'). This behavior is indicative of DLL side-loading or masquerading where an executable in a non-standard, user-writable directory attempts to load core system components, a common tactic used by malware to establish persistence or run malicious code.
Detects instances where msiexec.exe or related processes modify sensitive Windows Registry keys often associated with security settings, Internet Explorer configuration, or system identification. This behavior may indicate an attempt to tamper with security controls or prepare for further malicious activity.
This rule detects when known DLL files (7z.dll or normaliz.dll) are loaded by a process from a file path containing 'Traiolx Custom Utils'. This pattern is often indicative of DLL side-loading or hijacking, where an adversary places malicious or proxy DLLs in a custom directory to be loaded by a legitimate application.
Detects instances where the svchost.exe process is associated with multiple occurrences of indicators categorized as 'Misc', potentially indicating malicious activity or process abuse that bypasses standard detection signatures.
Detects email thread fabrication by the Latin-placeholder phishing kit, which embeds specific, non-business job titles and recipient-domain email addresses into the message body to manufacture the appearance of legitimate internal correspondence.
This rule detects potentially malicious modifications to registry keys associated with Internet Explorer, Windows Internet Settings, or Windows NT configuration. It specifically looks for activity involving processes running from suspicious locations (e.g., AppData) or common abuse vectors like cmd.exe and msiexec.exe that perform these registry changes repeatedly, which may indicate persistence mechanisms or defense evasion.
Detects instances of rundll32.exe being spawned by msiexec.exe or cmd.exe where the command line arguments involve loading DLLs from AppData paths, specific libraries like normaliz.dll or 7z.dll, or paths associated with LegionLoader staging activity. This behavior is indicative of malware loaders attempting to execute secondary payloads from writable user directories.
Detects a specific attack chain involving the movement of 'update.zip' to the temporary directory, its extraction using 'tar -xf', and the subsequent execution of 'update.bat'. This chain is associated with Clickfix attacks.
Detects script content that invokes 'mshta.exe' from the 'SysWOW64' directory to access a remote resource ending with '.7z' via HTTP or HTTPS. This pattern is associated with the Animateclipper malware, which uses MSHTA for initial access or execution of malicious scripts.
Detects Amadey loader executing its credential-theft plugin (cred.dll) via rundll32.exe with the Main export, triggered by Amadey backdoor command 0x15 after downloading cred.dll from the C2 /Plugins/ path.
Page 320 of 864