Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects execution of the Payouts King ransomware by identifying malicious process hashes, the use of a specific CRC-gated command-line parameter '-i', and the use of cmd.exe for malicious pipe redirection, which is a technique used to issue tasks without leaving direct process lineage.
This rule detects potential DLL sideloading by identifying instances where a process executing from a user-writable path (e.g., \Users, \ProgramData, \Temp) loads a DLL that resides in the same directory. This pattern is commonly associated with malicious payloads delivered via phishing archives where a legitimate binary and a malicious DLL are placed in the same folder to facilitate sideloading.
This rule identifies processes masquerading as common Windows system binaries (e.g., svchost.exe, lsass.exe) by executing from non-standard, suspicious file paths like temporary directories or user profiles instead of legitimate system directories (e.g., C:\Windows\System32).
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or PowerShell cmdlets. Attackers often clear logs to remove evidence of their malicious activities after achieving persistence or executing other operations.
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
Detects a non-interactive sign-in using an existing session shortly after the user completes interactive MFA, which can indicate stolen token replay. This rule identifies scenarios where a user successfully completes an interactive multi-factor authentication (MFA) sign-in, and then, within a short time frame (1800 seconds or 30 minutes), a non-interactive sign-in occurs for the same user and session ID. This pattern is indicative of a stolen session token being replayed by an attacker, bypassing subsequent MFA prompts.
Detects malicious artifacts and behaviors associated with TA4922 (Atlas RAT, SilentRunLoader, RomulusLoader), including known malicious file hashes, DLL sideloading patterns masquerading as legitimate graphics libraries, and unauthorized execution of Python interpreters from user-writable directories.
Detects attempts to clear Windows event logs using the wevtutil.exe command-line utility or by triggering native Windows Event Log IDs 1102 (Security log cleared) or 104 (System log cleared). Clearing these logs is a common technique used by adversaries to hide indicators of malicious activity following an intrusion.
Detects execution patterns associated with Payouts King malware, characterized by specific command-line arguments, obfuscated execution flags, and execution from suspicious directories like Temp, AppData, or ProgramData. The rule uses a scoring mechanism to identify malicious behavior, including checking against known malicious SHA256 hashes.
Detects evidence of malware attempting to identify virtualized execution environments by querying specific registry keys associated with hypervisors (VMware, VirtualBox, Hyper-V) combined with WMI commands used to gather hardware and system identifiers. This behavior is indicative of environment fingerprinting used by threats like TA4922 to evade detection and analysis.
This rule identifies suspicious activity associated with PyInstaller-packaged executables (specifically 'BQT.exe' and 'start.exe'). It detects these processes directly, or any processes that initiate them while referencing anti-analysis markers like debugger checks ('IsDebuggerPresent'), internal PyInstaller environment variables, or specific path markers like '_MEIPASS'. This behavior is characteristic of malware attempting to evade sandbox or manual analysis.
Detects a User Account Control (UAC) bypass technique where an adversary modifies the registry keys (HKCU\Software\Classes\mscfile\shell\open\command) to intercept execution when eventvwr.exe is launched. The rule identifies the suspicious registry write followed by the subsequent execution of a child process (like BQT.exe or start.exe) originating from eventvwr.exe.
Detects suspicious eBPF activity characteristic of the IronWorm rootkit, including unauthorized pinning of BPF objects, loading of libbpf from non-standard user-writable directories, and malicious anti-debugging enforcement where unauthorized processes terminate security or diagnostic tools.
Open-source derived remote access trojan with plugin architecture
Clipboard hijacking malware for cryptocurrency address substitution
Open-source derived remote access trojan with plugin architecture
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
macOS malware used by JINX-0164 against cryptocurrency developers
Clipboard hijacking malware for cryptocurrency address substitution
Commodity .NET keylogger and remote access trojan
Page 353 of 864