Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Identifies Node.js process decrypting embedded payload via custom XOR algorithm.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects the Drun/Chromelevator loader (drun.exe) performing cross-process memory allocation and remote thread creation via direct syscalls (NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) to bypass EDR user-mode API hooking during reflective payload injection. The rule specifically looks for 'drun.exe' initiating these syscalls.
This rule detects common security product executables (MsMpEng.exe, SenseNdr.exe, csfalconservice.exe, CylanceSvc.exe) that are running from file paths inconsistent with their legitimate installation directories. This behavior is indicative of an adversary attempting to masquerade as trusted security software to evade detection or achieve persistence.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects rapid failed local Windows account logon attempts consistent with Pony malware's built-in dictionary brute-force routine. The rule identifies a high volume of type-2 interactive logon failures against multiple local accounts in a short time window, indicative of brute-force activity using LogonUserA.
Detects memory writes to ntdll.dll's NtTraceEvent function patched with a single RET (0xc3) byte, disabling ETW-based tracing across the host — a precision anti-forensics technique used by the SilverFox loader chain.
Detects creation or modification of SilverFox/Sauron campaign-specific registry keys (Software\ODBDC, SOFTWARE\JDBCC, SOFTWARE\Sauron) and the 'revbs' value name used as infection state tracking markers.
Detects common shell and utility processes spawning as children of the AutoGen Studio process, indicating potential remote code execution via the AutoJack exploit chain.
Detects the execution of AutoHotkey or AutoIt automation scripts, particularly when these tools spawn suspicious child processes (e.g., cmd.exe, powershell.exe, wmic.exe), initiate commands from non-standard directories (Temp, AppData, Downloads), or run from locations outside of the standard Program Files installation directory.
Detects Vidar Stealer using NtQueueApcThreadEx2 with QUEUE_USER_APC_FLAGS_SPECIAL_USER_APC to immediately execute CryptUnprotectMemory in a live browser thread for ABE v20_master_key extraction, preceded by thread enumeration via CreateToolhelp32Snapshot, Thread32First/Next, and NtOpenThread.
Detects the execution of AutoHotkey or AutoIt automation scripts, particularly when these tools spawn suspicious child processes (e.g., cmd.exe, powershell.exe, wmic.exe), initiate commands from non-standard directories (Temp, AppData, Downloads), or run from locations outside of the standard Program Files installation directory.
Detects the execution of 'rundll32' attempting to load 'installer.dll' and invoke its 'Begin' export function. This activity is often associated with malware, specifically the Clickfix campaign, which uses PowerShell's 'Invoke-WebRequest' to download the DLL.
This rule correlates multiple low-to-medium confidence signals across file, process, network, and registry events to detect potential ransomware activity. The rule identifies suspicious behaviors including mass file renames, creation of known ransom note file types in multiple directories, shadow copy deletion via system utilities, disabling of antivirus and security monitoring, large archive staging, unauthorized outbound network connections, and suspicious process injection. Alerts are generated based on the aggregation and frequency of these signals, indicating a high probability of ransomware-related malicious activity.
Detects successful non-interactive token acquisitions using specific Microsoft first-party application IDs known to bypass Entra Conditional Access Policies through Nested App Authentication (NAA/BroCI). The detection specifically targets sign-ins to the Microsoft Graph resource.
Detects regsvr32.exe loading DLLs from user-writable directories such as Temp, AppData, ProgramData, Downloads, Desktop, and Public. Legitimate DLL registration runs from System32 or Program Files - execution from these paths indicates LOLBin abuse for proxy execution, DLL sideloading, or defense evasion commonly used to launch malware payloads.
This rule detects suspicious command-line activity involving 'cmd.exe' that echoes content into a batch file within the 'C:\Windows\TEMP\' directory and subsequently deletes it. This pattern can be indicative of various malicious activities, including temporary file creation for execution, evasion, or cleanup after execution.
Detects the creation of a mutex with a persistent suffix '!&fse?%AS!'. This string has been observed across multiple versions and campaigns of OysterLoader (also known as Broomstick/CleanUp).
IoT botnet malware family used for DDoS and proxy infrastructure
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Page 347 of 864