Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects modifications to the 'windir' registry value in the Volatile Environment. This technique is used by exploits like MiniPlasma to redirect trusted system processes to attacker-controlled paths for privilege escalation.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) to execute a batch file located within the user's AppData roaming directory. This behavior is frequently associated with the deployment of malicious payloads or dropper scripts that leverage legitimate installers to maintain persistence or execute unauthorized code.
This rule detects the execution of specific utilities (e.g., 7zip components, socket modules) originating from a non-standard directory named 'AppData\Roaming\Traiolx Custom Utils'. This pathing pattern is indicative of potential malware staging or the execution of custom tooling in an attempt to masquerade as legitimate software.
This rule detects potentially malicious activities involving Microsoft Copilot and Microsoft Graph, specifically focusing on unauthorized mailbox access via non-interactive sessions and patterns indicative of Server-Side Request Forgery (SSRF) during search operations. It monitors for anomalous interaction with the Graph API, specific Copilot search parameters, and suspicious image search requests.
Detects instances where the Windows Installer (msiexec.exe) initiates a command shell (cmd.exe) with suspicious command-line arguments, including references to batch files or execution from user-writable directories like AppData. This behavior is indicative of potential malicious payload execution or installation persistence attempts leveraging the msiexec utility.
This rule detects potential email spoofing attempts where an email claims to originate from a specific domain ('gasparinutrition.com') or is intended for external recipients, but fails critical authentication checks. Specifically, it identifies emails with DMARC failure, SPF failure, and a suspicious DKIM signing domain associated with 'gappssmtp.com', indicating an attempt to bypass sender authentication mechanisms.
Detects the LegionLoader infection chain, specifically identifying the use of dllhost.exe as a proxy to load malicious .cpl files or COM objects (e.g., COpenControlPanel) from AppData\Roaming. This rule correlates an initial msiexec.exe MSI staging event with the subsequent dllhost.exe execution and its child process spawn behavior within a 30-minute window.
Detects behavior indicative of LegionLoader where an unsigned process spawned by msiexec.exe or cmd.exe from the AppData\Roaming directory dynamically loads system DLLs (ntdll.dll, kernel32.dll, etc.) followed immediately by API function resolution via GetProcAddress. This sequence is a common technique used by malware to obfuscate function imports, evade static analysis, and hide malicious functionality.
Detects the modification of the 'fDenyTSConnections' registry key using 'reg.exe' to force-enable Remote Desktop Protocol (RDP) on a system, followed by an immediate connection attempt to port 3389. This behavior is indicative of an adversary or RMM-based tool attempting to establish unauthorized remote access for lateral movement.
Detects the execution of LuaJit.exe with a config.ini script, which acts as a Lua-based shellcode loader for BeepRAT. The loader uses Lua FFI to call Windows APIs such as VirtualAlloc and CreateThread to execute shellcode stored in temp.bin directly in memory. This pattern is indicative of fileless execution techniques employed by the BeepRAT remote access trojan.
Detects the execution of 'HFY.exe', which serves as the dropper for the BeepRAT malware. This dropper is typically distributed within a trojanized archive containing legitimate-looking DLLs, such as 'data.dll' (a disguised SQLite database), 'EPPlus.dll', and 'NPOI.dll'. The rule triggers when 'HFY.exe' is executed outside of standard program installation directories.
Detects the execution of BeepRAT, a RAT derived from DcRAT, which utilizes heavy obfuscation of class names and Base64-encoded strings that are decoded at runtime. The rule monitors command-line arguments for specific obfuscated identifier patterns and encoded strings associated with the malware's operation, while excluding files located in standard Windows or Program Files directories.
Detects the creation of specific vulnerable driver files abused by Gentlemen RaaS EDR killers. Gentlemen operators rapidly deploy new BYOVD proofs-of-concept to evade and disable host defenses by dropping known vulnerable drivers to disk.
This rule detects network connections to port 389 (LDAP) that contain specific keywords related to Active Directory trust relationships. This could indicate an adversary attempting to discover trust details within an Active Directory environment.
Detects potential local privilege escalation (LPE) attempts targeting the AnyDesk adprinterpipe named pipe. The rule monitors for the execution of known malicious indicators, unauthorized access to the adprinterpipe, AnyDesk spawning unexpected processes as SYSTEM, and the creation of services by AnyDesk child processes.
Detects the BeepRAT malware using the Tiny C Compiler (tcc.exe) to execute shellcode directly from memory. The rule identifies TCC execution from non-standard directories (specifically within %LOCALAPPDATA%\TCC) using specific flags (-nostdlib -run), and correlates this activity with the creation of an elevated scheduled task named 'WindowsUpdateTempFileCleanUp' used for persistence.
Detects Node.js processes executing with suspicious command-line arguments that include specific file extensions (.woff, .woff2, .svg, .jpeg, .png, .dict) or known suspicious file names associated with potential malicious activity or obfuscation.
Detects post-staging cleanup activities consistent with Mustang Panda (TA416) operations. This includes the deletion of staging files using Windows cmd.exe, specific file deletion events within the C:\ProgramData\IDM\logs\ directory, and the use of attrib commands to hide directories associated with known staging locations.
Detects the creation or modification of specific suspicious files (e.g., MediumInstStart.exe, SolidPDFCreator.dll, pcl2bmp.exe, ctxmui.dll) in common temporary or world-writable directories like ProgramData or Users/Public/Documents, which are often used by adversaries for staging tools or malware components.
Detects attempts to clear Windows Event Logs using wevtutil or PowerShell, and the suspicious deletion of files in sensitive directories (AppData, ProgramData, Temp, Users) using the command prompt. These behaviors are commonly associated with anti-forensics and data destruction activities used by adversaries to hide their tracks during an intrusion.
Detects usage of the Windows Event Utility (wevtutil.exe) with the 'cl' command-line flag, which is commonly used to clear specific Windows Event logs such as Security, System, Application, or Setup. This behavior is frequently associated with attackers attempting to remove forensic artifacts and log entries after unauthorized activity.
Page 321 of 864