Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects anomalous registry activity associated with the JFMBackdoor, specifically when the legitimate Windows utility fltMC.exe is used for registry modification or enumeration. This rule looks for high-frequency registry operations performed by fltMC.exe, particularly targeting common persistence locations or other registry paths, indicating potential malicious use following DLL side-loading.
Detects the creation or modification of files within the 'C:\ProgramData\Windows Multimedia' directory, a path associated with JFMBackdoor's screen capture output. The rule specifically monitors for this activity when initiated by 'fltMC.exe', which is known to be used by this malware for DLL side-loading.
Detects execution and staging activity associated with the NUKESPED (zlrenu8.exe) backdoor. The rule monitors for direct process execution from ProgramData, malicious DLL registration using rundll32, the creation of staged payload files in ProgramData, and suspicious memory operations (VirtualProtect) by the backdoor process, which are indicative of reflective loading or shellcode execution.
Detects malicious activity associated with the Kimsuky threat group's NUKESPED JSE loader, including the use of wscript/cscript to execute .jse files, drop encoded payloads via ADODB.Stream, and spawn hidden PowerShell processes for decoding stages (targeting .a9oc files in ProgramData). The rule also detects the creation and execution of the NUKESPED secondary payload zlrenu8.exe.
Detects network connection attempts or successes from critical Windows processes (System, svchost.exe, lsass.exe) targeting the localhost interface (127.0.0.1 or ::1) on non-standard ports (above 1024, excluding SMB ports 445/139). This behavior is often indicative of local process injection, credential dumping activity, or unauthorized inter-process communication used by malware to bypass network security controls.
Detects Linux processes masquerading as common system utilities (e.g., sshd, cron, smbd) by executing from non-standard, often high-risk directories such as /tmp, /var/tmp, /dev/shm, /opt, or various home and dot-directories. This behavior is indicative of Velvet Ant's TTPs used to blend malicious binaries with standard system processes to maintain persistence and evade detection.
Detects a common self-deletion pattern used by the StealC infostealer. The malware attempts to clean up its own traces by launching cmd.exe with a command sequence involving a timeout delay, followed by the forced deletion of files within temporary or application data directories.
Detects a suspicious PowerShell execution chain where a script host (wscript.exe or cscript.exe) spawns PowerShell to perform a file decoding operation via 'certutil' using a path in 'ProgramData'. This pattern is associated with the Kimsuky threat group's NUKESPED JSE loader, which uses path traversal or obfuscated filenames to stage malicious secondary payloads.
Detects anomalous registry activity by wscript.exe, specifically targeting keys associated with file association, COM object registration, or run-time startup locations. A high count of registry open operations by a scripting engine often indicates persistence installation or reconnaissance of system configuration.
Detects execution of fltMC.exe when located in the Temp directory, or execution of processes matching known malicious file hashes associated with this filename.
Detects execution of PowerShell commands that reflectively load a .NET assembly into memory using System.Reflection.Assembly::Load. The rule specifically flags behavior associated with the 'ROOTBOY' implant, which involves invoking the 'Extension.SubRoutine' class method 'Run2' and communicating with the C2 domain 'hellolargeworld.com'.
Detects instances of the MYRA RAT process masquerading as the systemd-userdbd daemon. The detection identifies the malicious payload being executed from the /usr/lib/systemd/systemd-userdbd path with command-line arguments typically used by the legitimate system utility, indicating that the Node.js binary has been replaced or copied to evade detection.
Detects the execution of 'sudo npm install -g apintergrationpost', a known command pattern utilized by the MYRA RAT. This pattern leverages sudo for elevated privilege installation via a malicious npm package hook, facilitating potential privilege escalation.
Detects the in-memory execution of the MYRA RAT on Linux systems. The rule identifies suspicious process activity where a process masquerades as the legitimate 'systemd-userdbd' service, while utilizing memfd_create or related file descriptor paths (e.g., /proc/self/fd/ or /memfd:) to load and execute malicious code directly from memory, thereby avoiding traditional file-based detection.
This rule detects suspicious activities related to AWS S3 buckets that could indicate a bucket hijacking attempt or unauthorized replication to an external account. Specifically, it looks for two scenarios: 1) an S3 bucket being deleted and then recreated by a different AWS account within a one-hour window, suggesting a namespace hijacking, or 2) an S3 bucket being deleted while a PutBucketReplication event references an external AWS account, indicating an attempt to exfiltrate data or maintain access through replication.
Detects the node.exe process deleting its own executing script file 'setup.cjs' located within an 'easy-day-js' node_modules directory. This behavior is indicative of the anti-forensics self-deletion mechanism used by the easy-day-js supply chain dropper to remove its footprint after executing a subsequent malicious payload.
Detects potential GCP logging sink bucket hijacking by monitoring for the deletion of a Google Cloud Storage bucket followed closely by an update to a logging sink configuration that points to a GCS destination. This pattern is characteristic of attackers attempting to intercept cloud log streams by recreating a target destination bucket in an environment they control.
Detects a multi-stage infection chain associated with HijackLoader delivered via ErrTraffic ClickFix lures. The rule identifies a sequence where a web browser spawns a PowerShell process that subsequently creates a large archive file (binary bloating), followed by the execution of suspicious processes (often associated with process injection/hollowing) from the extracted context.
Detects the loading of an unsigned DLL by 'quick_share.exe', 'NearbyShare.exe', or 'nearby_sharing.exe' from suspicious directory paths such as User Temp, AppData, or Downloads folders. This behavior is highly indicative of DLL side-loading attempts where an adversary leverages a legitimate, known process to execute malicious code.
Detects unexpected registry modifications (creation, deletion, or modification) performed by processes associated with 'Nearby Share' (quick_share.exe, nearby_sharing.exe). Legitimate registry activity related to Google Nearby Share or Windows native Nearby Sharing is excluded from this alert.
Detects the ClickFix infection chain where a web browser process spawns PowerShell to execute obfuscated ScriptBlock content. This activity is correlated with network connections to identified ErrTraffic C2 infrastructure (/api/index.php?a=ctx) used for distributing various malware payloads including Vidar, Stealc, and others.
Page 360 of 864