Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,662
12,606
8,417
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects PowerShell scripts that contain custom bit-reversal and XOR decoding routines used to deobfuscate an embedded byte blob, followed by the reflective loading of that blob into memory as a .NET assembly using [Reflection.Assembly]::Load. This behavior is associated with loaders like cap.ps1 used to deploy RATs such as AsyncRAT.
Detects PNG image files that contain an embedded ZIP archive appended after the IEND chunk. This technique is commonly associated with Ousaban malware, which uses steganography to conceal malicious payloads (such as an executable named 'SysMain.exe') within image files to evade detection during delivery.
Detects a malicious PNG file used by the Ousaban VBS downloader that embeds a ZIP archive containing a payload named 'SysMain.exe' appended after the PNG IEND chunk.
Detects file creation or write operations involving file paths containing the string 'SysMain_5874288'. This pattern is often associated with adversary attempts to drop, stage, or modify files using names designed to masquerade as legitimate system components or services, potentially to maintain persistence or evade detection.
Detects the creation of the 'MixedSvc' Windows service, which is used by DcRAT malware in Operation DragonReturn for persistence. The malware masquerades as 'Windows Mixed Reality Service' and sets the service's binPath to 'C:\Program Files\Windows Media Player\Mixed Reality.exe'.
Detects Reynolds ransomware's technique of ntdll loader hijacking for process injection, bypassing userland API hooks. This rule identifies suspicious activity by looking for the loading of GDI32.dll alongside ntdll internal loader routines, combined with API calls such as WriteProcessMemory, NtCreateSection, NtMapViewOfSection, and RtlEncodeRemotePointer, which are consistent with loader-level injection techniques. It also filters out common legitimate processes to reduce false positives.
Detects attempts by the GreenBlood ransomware to disable Windows Defender's real-time monitoring by modifying the registry. This rule specifically looks for 'reg.exe' commands that add 'DisableRealtimeMonitoring=1' to the Windows Defender policy key.
This rule detects the OXLOADER malware's technique of hijacking the CRT initializer table. It identifies an unsigned process loading a randomly named .ocx file (a copy of dui70.dll with an injected .xtext section) from a temporary or download path. The detection is further refined by correlating this with multiple VirtualAlloc calls, consistent with the malware's three rolling-XOR decryption stubs activated via the RegisterClipboardFormatW CRT initializer hook.
Detects suspicious API calls related to remote thread creation, memory allocation, and screen capturing, along with image loads of GDI32.dll from unusual paths and specific file activity. This rule also identifies processes associated with known malicious software product names.
Detects the creation of a scheduled task named 'SoftwareProtection' that executes a Python script. This technique is used by the CrashFix variant to establish persistence for its Python-based RAT, mimicking a legitimate Windows service to blend in. The detection specifically looks for the task name 'SoftwareProtection', a command line containing 'python.exe', 'pythonw.exe', or 'run.exe' along with 'udp.pyw', and the path '\windows\SoftwareProtectionPlatform\', indicating the malware's attempt to masquerade as a legitimate system component.
Detects sign-ins by Global Administrators using a Temporary Access Pass (TAP) to the Azure Portal. This activity is indicative of potential credential abuse, especially in cross-tenant scenarios, as TAP can bypass MFA. The rule identifies instances where a Global Administrator role is assigned or where a user with 'globaladmin' in their UPN signs in with a TAP.
Detects the use of 'rm' or 'unlink' commands to forcefully delete specific files or directories within the '/tmp' directory. The targeted files/directories ('osalogging.zip', '/tmp/sync', '/tmp/macsync_') could indicate cleanup activities after a malicious operation or system compromise, potentially related to macOS systems.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects instances where the legitimate Windows utility 'Fondue.exe' (Features on Demand) loads the control panel library 'APPWIZ.cpl' from non-standard locations such as C:\Users\Public or AppData directories. It also identifies the staging phase where 'APPWIZ.cpl' is written to 'C:\Users\Public', which is indicative of a DLL side-loading attack sequence, often associated with the Elephant malware dropper.
Detects the SHEETCREEP RAT (vaultsvc.exe) creating the 'Global\WinSync_' mutex, often from non-standard locations. This rule correlates process image paths with named object events to identify suspicious activity.
Detects the SHEETCREEP malware's melt function, which uses a hidden 'cmd.exe' process to forcibly delete executables. This is characterized by 'cmd.exe' spawning with a specific command line pattern involving 'choice /C Y /N /D Y /T 2' for a delay, followed by 'del /f /q' to delete an .exe file. The rule also looks for file deletion events of .exe files initiated by 'cmd.exe' outside of the C:\Windows\ directory with 'del /f' or 'del /f /q' in the command line.
This rule detects potentially malicious activities within or involving Docker containers on Linux systems. It specifically monitors for the use of 'docker cp' with archive flags, the execution of custom scripts ('poc.sh') involving docker-related commands, or the use of 'docker-cp-copyout' strings, which may indicate data staging, exfiltration, or container-based persistence and lateral movement.
This rule detects the loading of suspicious DLL files (commonly associated with MinGW or image processing libraries) from user-writable directories such as AppData or Temp. Loading these libraries from these non-standard locations, particularly when not initiated by a known legitimate process, may indicate DLL side-loading or execution of masqueraded malicious binaries.
Detects instances where the Ghidra reverse engineering tool (via java.exe or javaw.exe) spawns suspicious child processes. This behavior is considered anomalous as Ghidra typically does not require launching command shells, scripting interpreters, or other system binaries directly from its process tree. Such activity often indicates that an attacker is using the Ghidra environment to execute secondary payloads or perform post-exploitation tasks.
Detects the use of 7za to extract archives into the Avast Software directory, a behavior observed in Pay2Key ransomware campaigns to perform DLL hijacking for execution, persistence, or privilege escalation.
Detects the execution or creation of files named GT_NET.exe or Gt_net.exe, which are associated with the Grixba ransomware (Play Ransomware group). The rule also identifies files that masquerade as SentinelOne by utilizing SentinelOne-related product, company, or description metadata but are located outside of the legitimate SentinelOne installation directory.
Page 328 of 864