Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the presence of specific keywords within PowerShell Script Block logs (EventCode 4104) that are characteristic of Anti-Malware Scan Interface (AMSI) bypass techniques. These include attempts to manipulate the AMSI context, reflectively load assemblies to modify memory, or force scan failures.
Detects the execution of known debugger/disassembler tools (Ghidra, dnSpy, x64dbg) that exhibit suspicious network behavior. The rule specifically looks for these tools initiating network connections to destinations outside of their official update or project domains shortly after execution, and filters out known good hash signatures.
Detects specific suspicious behaviors associated with the Payouts King ransomware. It monitors for indirect command execution where cmd.exe is spawned by non-shell processes to programmatically execute schtasks, or the direct invocation of schtasks.exe to execute tasks hidden within paths mimicking Mozilla-related directories for persistence.
This rule detects the execution of QEMU binaries from non-standard locations on Windows endpoints, or the use of port-forwarding command-line flags. Adversaries, including Payouts King and BlackBasta affiliates, leverage QEMU to establish hidden virtual machines for persistent access, credential theft, and to create covert reverse SSH tunnels to bypass network security controls.
Detects unauthorized attempts to terminate security-related processes using direct syscalls (ZwTerminateProcess). The rule monitors for processes attempting to access AV/EDR security products with high-level access rights (0x0001 or 0x1fffff) while excluding authorized security processes themselves.
Detects the execution of anti-forensic techniques often associated with the Payouts King ransomware campaign. The rule monitors for the deletion of volume shadow copies via vssadmin, the clearing of Windows event logs using wevtutil, and the clearing of the recycle bin. The correlation of these events suggests an attempt to inhibit system recovery and remove indicators of compromise.
Detects instances where a user successfully authenticates from a mobile device (Android or iPhone) that exhibits a geographic mismatch (geo_country vs registered_country), and subsequently performs a sensitive credential or MFA-related action (enrollment or reset) from a different device within one hour. This pattern is indicative of a potential session hijacking or credential compromise where an attacker attempts to establish persistence by enrolling their own MFA device.
This rule detects when an executable or process loads a DLL from commonly writable locations like AppData, Temp, or ProgramData, while also correlating this activity with the loading of .NET CLR runtime components (mscoree.dll, clr.dll, etc.) and potential configuration file modifications. This behavior is indicative of .NET-based injection techniques such as AppDomainManager injection or DLL hijacking targeting .NET applications.
Detects the loading of unsigned or improperly signed DLLs by high-value/legitimate Windows binaries (e.g., mmc.exe, OneDrive.exe, teams.exe, rundll32.exe) from user-writable directories such as AppData, Temp, Downloads, or ProgramData. This behavior is indicative of DLL search-order hijacking or DLL side-loading, often used by adversaries to execute malicious code within the context of trusted applications.
Detects the execution of short-lived processes (under 5 seconds) named 'start.exe' or 'BQT.exe' that contain environment variables or flags indicative of PyInstaller. This behavior is often associated with malware attempting to evade analysis or sandbox environments by executing and terminating quickly.
Detects the BQTLock ransomware loader (start.exe) spawning the primary payload (BQT.exe), which subsequently executes WMIC to perform hardware, virtualization, and sandbox environment enumeration, a technique commonly used for evasion.
Detects the execution of known legitimate QEMU binaries (qemu-system-x86_64.exe, qemu-system-i386.exe) and ADNotificationManager.exe from non-standard, user-writable, or attacker-controlled staging directories. This behavior is indicative of DLL sideloading attacks, where adversaries place malicious DLLs alongside these binaries to achieve code execution.
This rule detects command and control (C2) communication associated with the 'easy-day-js' backdoor, which is part of the Mastra npm supply chain attack. It specifically looks for HTTP POST requests to the IP address 23.254.164.123 with a spoofed Internet Explorer 8 User-Agent string.
This rule detects the creation and subsequent deletion of a local user account within a 240-minute window. This behavior is often indicative of an adversary creating a temporary, ephemeral account for malicious activity (e.g., persistence or lateral movement) and then removing it to evade detection or cover their tracks.
Detects processes that masquerade as the legitimate 'systemd-userdbd' system service by spoofing their process name. This behavior is commonly associated with malware, such as the MYRA RAT, which uses prctl to alter its process display name to evade detection.
Detects persistence and execution behaviors associated with the MYRA Linux RAT. The rule monitors for the installation of a malicious library (.libcache.so) via shell profile modifications, and subsequent execution attempts where a process masquerades as 'systemd-userdbd' while utilizing 'LD_PRELOAD' and fileless execution techniques (memfd_create/fexecve).
Detects execution patterns associated with the Havoc C2 framework's Demon implant. This includes PowerShell loaders with encoded/non-interactive flags spawned by suspicious script interpreters, PowerShell execution spawned from explorer.exe, and suspicious remote thread injection into explorer.exe from unauthorized processes.
Detects a remote support or loader process spawning a suspended process or invoking commands associated with RunPE and hollowing. This rule specifically looks for processes initiated by 'ScreenConnect', 'SimpleRunPE', or 'ClientService' that include command-line arguments indicative of process hollowing or injection techniques such as 'CREATE_SUSPENDED', 'NtUnmapViewOfSection', 'RunPE', 'hollow', or 'process injection'.
Detects persistence and fileless execution techniques associated with the MYRA Linux RAT. This includes monitoring for the creation of persistence files such as /usr/local/lib/.libcache.so for LD_PRELOAD hijacking and /etc/profile.d/.sh.local for shell-based persistence. It also monitors for suspicious process execution patterns where 'node' spawns a 'systemd-userdbd' masquerading process or invokes syscalls indicative of fileless execution, specifically memfd_create or fexecve.
Detects command-line clearing of security, system, application, or PowerShell event logs to impede investigation. This rule specifically looks for the use of 'wevtutil.exe', 'powershell.exe', or 'cmd.exe' with command-line arguments indicative of clearing event logs, such as 'wevtutil.*(cl|clear-log)', 'Clear-EventLog', or 'Remove-EventLog'.
Detects evidence of the Havoc Demon agent performing process injection into explorer.exe. The detection looks for a sequence of events: first, a suspicious process (excluding explorer.exe and userinit.exe) opening a handle to explorer.exe, followed by a cross-process thread creation event originating from the same source process against the same target.
Page 355 of 864