Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of built-in Windows utilities such as ntdsutil.exe, vssadmin.exe, and diskshadow.exe, often used by attackers to dump the Active Directory database (NTDS.dit) or manipulate volume shadow copies for credential theft or data staging/destruction purposes.
Detects the loading of 'SystemSettings.dll' by 'SystemSettings.exe' when the process is launched from an unusual path, specifically within the user's AppData directory. This behavior is indicative of potential DLL sideloading, where an attacker attempts to masquerade as or hijack the execution flow of a legitimate Windows utility by placing a malicious DLL in an untrusted, user-writable directory.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring memory protection changes (VirtualProtect) targeting the AmsiScanBuffer function within the amsi.dll module. Attackers often modify this function's memory permissions to PAGE_EXECUTE_READWRITE to inject code or patch the function, effectively disabling AMSI scanning capabilities.
Detects the use of taskkill to forcefully terminate critical system processes, administrative utilities, or security-related software. The rule tracks command-line patterns involving common targets such as task manager, registry editor, PowerShell, security agents, or attempts to terminate wininit.exe which can trigger a system crash.
Detects a process running at SYSTEM integrity level spawned by a parent process that is not typically associated with SYSTEM-level process creation (e.g., services.exe, lsass.exe). This behavior is characteristic of token impersonation or process spawning abuse (e.g., CreateProcessWithTokenW) used by post-exploitation frameworks like Cobalt Strike or tools involved in the StrikeShark campaign to escalate privileges.
Detects spinning up of virtual machines to conduct malicious activity in isolation
Detects the execution of a process named 'wusvc.exe' located outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. Attackers often rename malicious binaries to look like legitimate system services (such as Windows Update service) to evade detection and maintain persistence.
Detects the loading of ntdll.dll or amsi.dll by the Windows Update Service (wusvc.exe). This pattern is often observed in the context of advanced techniques like SNOWLIGHT, which uses direct syscall table enumeration to bypass security controls. Monitoring for these modules in this specific process context can indicate memory-resident malicious activity or evasion attempts.
Detects the Windows Update service (wusvc.exe) or any process with environment strings (command line or folder path) containing sandbox-related keywords such as 'sandbox', 'malware', 'virus', or 'sample'. This behavior is characteristic of malware attempting to detect if it is running within an analysis, sandbox, or virtual machine environment.
This rule detects instances of the SNOWLIGHT dropper (wusvc.exe) initiating or interacting with processes identified as common debugger or system analysis tools. The rule monitors for the simultaneous presence of wusvc.exe and a blacklist of tools like processhacker.exe, ida.exe, and wireshark.exe within a 120-second window on the same device.
Detects the execution of a malicious file named wusvc.exe, known as the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update Service. The rule identifies instances where this file is run from suspicious locations (e.g., Downloads folder) or triggers UAC elevation despite not being associated with recognized Windows update processes.
Detects execution and suspicious memory operations by 'wusvc.exe', a known dropper for the SNOWLIGHT malware. The rule monitors for direct syscalls (NtAllocateVirtualMemory, NtProtectVirtualMemory) and remote thread injection attempts (CreateRemoteThread, QueueUserApc) typical of evasion techniques used to bypass EDR hooks and execute payloads. It further filters for anomalies based on execution path (e.g., Temp, Downloads) or specific process file hashes.
Detects execution of compiled HTML help files containing malicious scripts
Detects the forceful termination of web browsers using taskkill.exe, a common behavior for info stealers attempting to unlock browser databases.
Detects instances where a process named wusvc.exe is executed from suspicious directories (such as Downloads, AppData, Temp, or Public folders) instead of the legitimate Windows system directories (System32 or SysWOW64). It further restricts the scope to processes spawned by common user applications like web browsers or explorer.exe, indicating potential masquerading or execution of malicious binaries disguised as the Windows Update service.
Detects potential Asynchronous Procedure Call (APC) injection by monitoring for processes running from user-writable directories that request broad access (PROCESS_ALL_ACCESS) to other processes, or by detecting the initiation of QueueUserAPC or NtQueueApcThread remote thread creation.
Detects the SNOWLIGHT dropper (UNC5221) masquerading as the Windows Update service (wusvc.exe). It monitors for the creation of a Windows service named 'wusvc' or 'Windows Update Service' located outside of standard system directories, and the execution of 'wusvc.exe' from user-writable directories like AppData, Temp, or Downloads, indicating potential malicious persistence or dropper activity.
Detects suspicious self-deletion patterns associated with TrymeLocker malware. This includes processes spawning cmd.exe to execute file deletion commands (cmd /c del) or the use of batch scripts to remove the originating process executable and subsequently delete themselves.
Detects activity associated with the SNOWLIGHT malware, specifically the dropping of a malicious executable named 'wusvc.exe' or 'WindowsUpdate' into user-writable directories (Downloads or AppData), followed by the creation of an automatically starting Windows service that executes the dropped file. This rule correlates process creation/service registration events with SCM event 7045 entries.
This rule detects EDR evasion techniques associated with the SNOWLIGHT dropper used by UNC5221. It identifies two specific behaviors: the manual loading of ntdll.dll from non-standard Windows directories, which suggests an attempt to bypass EDR hooks through manual mapping and direct syscalls, and the loading of amsi.dll by processes running from user-writable directories (e.g., Temp, Downloads), indicative of an in-memory AMSI bypass.
Detects sandbox evasion behavior where a process enumerates virtual machine-specific registry keys (e.g., VirtualBox, VMware) or attempts to access known virtualization service processes. This pattern is characteristic of malware attempting to identify if it is running in an analysis environment to alter its behavior.
Page 341 of 864