Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects registration of malicious network provider DLLs to capture credentials
Detects the execution of the SharpGPOAbuse utility or the use of its specific command-line arguments intended for manipulating Active Directory Group Policy Objects (GPOs) to achieve privilege escalation or persistence.
Detects instances where SystemSettings.exe is spawned from non-standard directories often associated with the SharkLoader malware family, such as AppData roaming subdirectories or KasperskyLab program folders. This behavior is indicative of masquerading and malicious staging.
Detects behavior patterns associated with the SharkLoader malware, specifically monitoring for anomalous thread creation, potential modification of primary tokens, and suspicious loading of SystemSettings.dll from non-standard directories (e.g., AppData, ProgramData). This rule aims to identify evasive techniques used to bypass Windows Loader Lock detection.
This rule monitors inbound emails that exhibit signs of phishing, specifically looking for failures in email authentication protocols (DKIM, DMARC), the use of specific invoice-themed subject lines, and the inclusion of redirection links pointing to known third-party collaboration platforms (HolaBrief, LoopedIn). It also identifies cases where the sender's envelope domain differs from the header's 'From' domain, which is a common indicator of email spoofing used in identity-based attacks.
Detects the deployment of SharkLoader components into suspicious directories (%APPDATA%\xwreg, %APPDATA%\xgdf, or %ProgramData%\KasperskyLab) followed by the execution of SystemSettings.exe from these locations. This rule also tracks the loading of encrypted DLL payloads like DscCoreR.mui or SyncRes.dat by these processes, which is indicative of a DLL sideloading execution chain.
This rule detects potential credential capture by monitoring for unauthorized usage of Windows API functions associated with keyboard hooking, such as SetWindowsHookEx and GetAsyncKeyState. It specifically flags suspicious process activity, such as the execution of the 'Pillager' tool or processes interacting with specific suspicious file paths, while excluding common legitimate processes that routinely perform keyboard hooking.
Detects potential SharkLoader shellcode injection patterns, where a suspicious executable (e.g., sideloaded SystemSettings.exe) from specific non-standard directories initiates cross-process memory operations like VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread into critical system processes such as svchost.exe or explorer.exe.
Detects the execution of suspected StrikeShark-related binaries (SystemSettings.exe and FScan) when they are found running from non-standard directories or masquerading as legitimate system processes. The rule specifically monitors for instances where these binaries are executed from user-writable paths like AppData or Temp, while excluding legitimate Windows paths and processes associated with Windows Update.
Detects SEO poisoning pages with hidden keywords to manipulate search rankings
Detects modification of Azure management groups to bypass governance policies
Detects clearing of network connection history to remove forensic evidence
Detects execution of Control Panel CPL files for LOLBin proxy execution
Detects the spawning of suspicious command-line interfaces or utility processes (e.g., cmd.exe, powershell.exe, curl.exe) by an AutoGen Studio Python process. This pattern is indicative of potential exploitation attempts where an adversary leverages AutoGen Studio's capabilities to achieve arbitrary code execution on the underlying host.
Detects executable content served with incorrect MIME type for masquerading
Detects abuse of native Windows API calls for process injection and execution
Detects creation of virtual file system containers for hiding malware
Detects attempts to clear Windows event logs using the built-in 'wevtutil.exe' utility or PowerShell cmdlets 'Clear-EventLog'. Adversaries often perform this action to remove evidence of malicious activity from the host.
This rule monitors process creation events (Sysmon Event ID 1) to identify suspicious executables that masquerade as common software updaters (GoogleUpdateStepup, AnyConnect, AutoUpdate) or attempt to run the Windows SystemSettings.exe binary from non-standard directories. It further flags these instances when they are launched with specific command-line indicators such as cmd.exe or PDF file paths, which are common patterns for droppers or malicious execution chains.
Detects processes invoking common Windows API functions typically used to detect the presence of debuggers (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess, GetTickCount) when these processes are executed from suspicious locations (such as specific AppData subdirectories) or masquerading as system binaries (SystemSettings.exe). These behaviors are commonly used by malware to detect analysis environments or debuggers and alter execution flow to evade detection.
Detects the execution of SharpGPOAbuse or usage of its associated command-line arguments. This tool is frequently used by attackers to modify Group Policy Objects (GPOs) in an Active Directory environment to achieve privilege escalation or persistent access.
Page 340 of 864