Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects unauthorized ISO or virtual disk mounting activity combined with the creation of a working directory using the 'RP_' prefix under the system temporary folder. This pattern is indicative of the RoguePlanet exploit staging process, which often uses NTFS junction redirection to bypass security controls like Windows Defender quarantine.
Detects the RoguePlanet quarantine artifact hijack technique, which involves two primary signals: the staging of 'wermgr.exe' within temporary 'RP_*' working directories and the unauthorized creation or modification of 'wermgr.exe' in 'C:\Windows\System32' by processes other than trusted Windows system components.
Detects unauthorized access to wermgr.exe residing within Volume Shadow Copy paths or staged in specific temp directories. This behavior is associated with the RoguePlanet exploit, which uses this pattern to obtain SYSTEM-readable handles for subsequent oplock placement and TOCTOU (Time-of-Check Time-of-Use) race conditions to achieve privilege escalation.
Detects unauthorized attempts to place an exclusive byte-range lock on the wermgr.exe executable when accessed via Volume Shadow Copy (VSS) or temporary paths, which is characteristic of the RoguePlanet exploit. This technique is designed to stall Windows Defender's clean-up operations, creating a time-of-check to time-of-use (TOCTOU) race window for further exploitation.
Detects the loading of amsi.dll by potentially malicious Python-based processes (e.g., PyInstaller, scripts) or cross-process memory writes from such processes, which are indicative of in-memory patching of AMSI (AmsiOpenSession) or ETW (EtwEventWrite) to evade detection. The rule monitors for unsigned processes like 'python.exe' or 'winupdate.exe' performing these actions.
Detects a Google account completing an OAuth or MFA challenge and then generating a new session from a different client fingerprint (different source IP or user agent) within a 10-minute window. This behavior can indicate a session hijack or an adversary bypassing MFA.
Detects the RoguePlanet exploit chain where an attacker-planted binary masquerading as wermgr.exe is executed by the QueueReporting scheduled task under SYSTEM integrity and spawns an interactive shell process (conhost.exe, cmd.exe, powershell.exe). Legitimate wermgr.exe instances related to error reporting do not spawn interactive console processes.
Detects anomalous execution of chrome.exe as a child process of Python interpreters or PyInstaller-compiled binaries running from non-standard, user-writable directories. This pattern is indicative of the Glove Stealer malware attempting to perform a Chrome App-Bound Encryption (ABE) bypass by injecting a decryption helper DLL into a suspended chrome.exe process to exfiltrate master keys.
Detects the loading of amsi.dll into processes running from user-writable, temporary, or PyInstaller-specific staging directories. This behavior is indicative of the Glove Stealer payload attempting to disable security telemetry by patching AmsiOpenSession and EtwEventWrite to blind AMSI and ETW monitoring.
Detects unauthorized processes attempting to interact with the elevation_service.exe (the Chrome App-Bound Encryption service) via COM mechanisms. This activity is a known indicator of the Glove Stealer 'five-tier ABE bypass' technique, which is used to decrypt browser-stored credentials and session cookies by abusing the service's interface.
Detects the creation of UUID-named files within RoguePlanet staging directories (RP_<UUID>) under the %TEMP% path. This activity is indicative of Poseidon thread I/O saturation, a technique used to artificially extend the TOCTOU (Time-of-Check to Time-of-Use) race condition window against the Microsoft Defender service (MsMpEng.exe) as part of an exploit for CVE-2026-50656.
This rule detects suspicious file activity involving Alternate Data Streams (ADS) and file names containing 'WDFOO' or 'wermgr.exe' within specific 'RP_' staging directories. Such activity is often associated with file-based staging, persistence, or potential obfuscation techniques using NTFS streams.
This rule detects high-frequency file creation events where files are named with potential UUIDs within subdirectories of the 'Temp' folder matching the 'RP_' pattern. This activity is indicative of automated staging or data manipulation by a user-mode process, filtering out activity from system-level accounts.
This rule monitors for suspicious activity involving wermgr.exe and Windows Defender quarantine directory. It detects wermgr.exe being written to or executed from non-standard temporary paths (often associated with potential junction-redirected payload execution), non-MsMpEng processes writing to the Windows Defender quarantine folder, and the creation of NTFS Alternate Data Streams (ADS) named :WDFOO within temporary directories.
Detects the loading of amsi.dll by processes frequently associated with PyInstaller or potential AMSI patching attempts. This rule monitors EventCode 7 (ImageLoad) events specifically identifying instances where amsi.dll is loaded by processes containing '_mei' (a common temporary directory prefix for PyInstaller), python executables running from temporary directories, or processes named 'winupdate.exe'. Such activity is often observed during the execution of obfuscated or packaged malicious binaries attempting to disable or bypass AMSI (Antimalware Scan Interface).
This rule detects suspicious activities commonly associated with the Yuta/Glove information stealer, including the creation of specific file paths in AppData, the execution of binaries from user-writable directories, and potential process hollowing or side-loading behaviors. It monitors process creation (Event ID 1) and file creation (Event ID 11) for indicators like winupdate.exe, PyInstaller-related temporary directories, and known malicious file hashes.
Detects the Yuta/Glove Stealer malware (winupdate.exe) performing environment checks by querying Windows registry keys associated with virtualization software (VMware, VirtualBox, QEMU). This behavior is indicative of sandbox evasion techniques used to detect analysis environments before executing secondary payloads.
Detects instances where known Windows binaries frequently abused for User Account Control (UAC) bypass (fodhelper.exe, eventvwr.exe) spawn unexpected child processes. These binaries are trusted system utilities that, when used as an actor for launching other processes, often indicate malicious activity aimed at privilege escalation.
Detects attempts to clear Windows event logs using built-in utilities including wevtutil.exe, PowerShell, or through direct event log event ID triggers (1102, 104). This activity is often associated with adversaries attempting to remove evidence of their presence on a system.
This rule monitors for the execution of QEMU processes and the creation of virtual disk files (.qcow2, .vmdk) in non-standard locations. It also identifies potentially disguised VM images by detecting files with suspicious extensions (.db, .dll) created in sensitive paths like Temp or AppData, which may indicate an attempt to hide virtualized environments or disk images.
Detects instances where critical Windows host processes (svchost.exe, explorer.exe, or lsass.exe) spawn a new process, which is a common behavioral indicator of process injection or post-exploitation activity. The rule excludes common, legitimate system-level causality chains.
Page 352 of 864