Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects instances where browser processes (Chrome, Edge, Firefox) directly spawn PowerShell or MSHTA. This is a behavioral indicator of the 'ClickFix' social engineering technique, where victims are tricked into copying and pasting malicious commands into a terminal, often presented as 'fixes' for fake browser error messages or verification prompts.
Detects the use of osascript to spawn fake macOS system dialogs that mimic legitimate 'System Preferences' prompts to harvest user login passwords. This activity often involves AppleScript dialog commands combined with dscl authonly checks to validate the stolen credentials.
Detects a suspicious pattern where a highly privileged on-premises synchronized user account signs into Azure Active Directory (Entra ID) and immediately performs sensitive administrative actions (role assignment or OAuth application consent grant) within a 30-minute window. This behavior is indicative of credential abuse by the Storm-2372 actor to escalate privileges within a tenant.
Detects the execution of OXLOADER (aBsvwbdas.exe) which drops a maliciously crafted .ocx file (a copy of dui70.dll) into the %TEMP% directory. This behavior is indicative of module stomping to facilitate the in-memory execution of CASTLESTEALER via techniques like DonutLoader and RunPE.
Detects anomalous Azure AD device registration events where device metadata is inconsistent, suggesting impersonation. The rule flags Linux hosts masquerading as Windows, non-Windows devices claiming AzureAD trust type, or the use of zeroed OS versions (0.0.0.0). High-frequency registrations (3+ devices per user in 30 minutes) correlate with known AADInternals-based attacks used by threat actor Storm-2372 to bypass Conditional Access policies.
Detects the creation or download of 'injection-obf.js', an obfuscated JavaScript payload associated with VVS Stealer for Discord injection. The rule captures details like source URL, referrer, and responsible process to aid in containment and scoping.
Detects the loading of .NET assemblies (DLL, OCX, EXE) from user-writable directories such as AppData\Local\Temp or AppData\Roaming by processes that are not standard .NET development tools. This behavior is often associated with malware loaders, such as OXLOADER, that perform module stomping or use steganographic techniques to execute malicious code in memory via AppDomain.Load.
Detects a User Account Control (UAC) bypass technique where eventvwr.exe is used to spawn an elevated shell (cmd.exe or PowerShell). This occurs because eventvwr.exe is an auto-elevating binary that can be manipulated to execute arbitrary commands with high integrity without displaying a UAC prompt.
This rule detects the creation or execution of files that match specific suspicious filenames associated with known malicious activity. It monitors both process creation (Event ID 1) and file creation (Event ID 11) events, targeting filenames such as 'MicrosoftUpdateOneDrive.exe', 'StockMarketView.exe', and various DLL files (e.g., 'ms-lib-math-core.dll'). These files are often masquerading as legitimate system or application components to evade detection.
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Detects the execution of mshta.exe with a .hta file path located in common user-writable directories (Temp, Downloads, AppData, User Profile) accompanied by suspicious filename themes often associated with phishing or social engineering, such as military, salary, or diplomatic lures.
Detects suspicious handle requests (Sysmon Event ID 8: CreateRemoteThread, Event ID 10: ProcessAccess) targeting critical Windows processes lsass.exe, svchost.exe, and explorer.exe from unauthorized source processes. The rule specifically looks for suspicious access rights and filters out known legitimate system processes.
Detects cross-process memory injection patterns by correlating Event Tracing for Windows (ETW) logs for VirtualAllocEx (with executable protection) and WriteProcessMemory, combined with Sysmon image load events to verify the target process has loaded user32.dll, a common indicator for GUI-related processes often targeted for injection.
Detects anomalous HTTP responses containing high-entropy, potentially multi-layered obfuscated payloads. The rule specifically monitors for patterns suggesting Base64, ROT13, and Hex encoding in the response body, which is consistent with methods used to deliver obfuscated malicious AI skills or scripts via web traffic.
Detects instances where node.exe or npm.exe processes spawn PowerShell to execute download-related cmdlets (e.g., Invoke-WebRequest, IEX) or encoded commands, followed by the execution of a process from user-writable directories (TEMP or AppData) within a one-minute window, a pattern associated with PostCSS typosquatting supply chain attacks.
Detects the loading or access of specific DLLs (Optimax.dll or System Optimizer Ultimate.dll) by processes originating from user-writable directories (AppData or Temp), which is characteristic of the TuglaInsaatci campaign utilizing steganographic techniques to deploy Remcos RAT.
Detects the TuglaInsaatci steganographic loader technique where a randomly-named executable is dropped directly into the user's AppData\Roaming directory and subsequently launched within a short timeframe. This behavior is indicative of a self-copying persistence mechanism frequently used in campaigns like FortiBleed.
Detects indicators of persistence activity associated with the MYRA RAT. This includes unauthorized modifications to shared library preload mechanisms (/etc/ld.so.preload), creation of malicious shared objects in systemd user paths by common interpreter/shell processes, suspicious modification of cron job files by those same processes, and the execution of the 'systemd-userdbd' process from non-standard, unauthorized filesystem locations.
Identifies the browser process saving a .zip file whose name explicitly spoofs an application update, matching the SocGholish social engineering lure.
This rule detects the creation or execution of files that match specific suspicious filenames associated with known malicious activity. It monitors both process creation (Event ID 1) and file creation (Event ID 11) events, targeting filenames such as 'MicrosoftUpdateOneDrive.exe', 'StockMarketView.exe', and various DLL files (e.g., 'ms-lib-math-core.dll'). These files are often masquerading as legitimate system or application components to evade detection.
Detects the execution of Python interpreters with command-line arguments that utilize common obfuscation and decoding techniques. The rule identifies a combination of Base64 decoding, codec decoding, ROT13/ROT47 rotation, and hexadecimal string conversion, which are frequently used to hide malicious scripts or payloads from static analysis.
Page 361 of 864