Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of mshta.exe with a .hta file path located in common user-writable directories (Temp, Downloads, AppData, User Profile) accompanied by suspicious filename themes often associated with phishing or social engineering, such as military, salary, or diplomatic lures.
Detects suspicious handle requests (Sysmon Event ID 8: CreateRemoteThread, Event ID 10: ProcessAccess) targeting critical Windows processes lsass.exe, svchost.exe, and explorer.exe from unauthorized source processes. The rule specifically looks for suspicious access rights and filters out known legitimate system processes.
Detects cross-process memory injection patterns by correlating Event Tracing for Windows (ETW) logs for VirtualAllocEx (with executable protection) and WriteProcessMemory, combined with Sysmon image load events to verify the target process has loaded user32.dll, a common indicator for GUI-related processes often targeted for injection.
Detects anomalous HTTP responses containing high-entropy, potentially multi-layered obfuscated payloads. The rule specifically monitors for patterns suggesting Base64, ROT13, and Hex encoding in the response body, which is consistent with methods used to deliver obfuscated malicious AI skills or scripts via web traffic.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
This rule detects two suspicious behaviors associated with the TinyRCT malware family: the execution of common installer or archiver utilities in the Downloads folder that terminate within two seconds, and the use of 'choice.exe' for self-deletion of an executing process within a short timeframe.
This rule detects potentially malicious activity involving the Windows binaries Regasm.exe and Regsvcs.exe, which can be abused to proxy the execution of arbitrary code. It specifically identifies three suspicious behaviors: spawning of common command shells or script engines by these binaries, execution of these binaries when located in or loading assemblies from user-writable directories (e.g., Temp, AppData, Downloads), and module loading of DLLs from those same writable locations, especially when the binary is not Microsoft-signed.
Detects suspicious network activity originating from the InstallUtil.exe process. InstallUtil is a legitimate Windows .NET utility that can be abused as a LOLBin (Living-off-the-Land Binary) to proxy the execution of malicious payloads, potentially bypassing application control mechanisms.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects SMB authentication attempts using NTLM with a blank Lan Manager (LM) hash. This specific pattern is often associated with Pass-the-Hash attacks where tools inject malformed or blank hashes to initiate authentication, a common indicator of lateral movement attempts.
Detects attempts to clear Windows Event Logs using either the wevtutil command-line utility, PowerShell Clear-EventLog cmdlets, or by monitoring specific Windows Security Event IDs 1102 and 104 which indicate logs have been cleared.
Detects the creation or modification of specific DLL and data files associated with the SharkLoader malware (e.g., SystemSettings.dll, DscCoreR.mui) within designated hidden directories (%APPDATA%\xwreg or %APPDATA%\xgdf). These paths are indicative of the StrikeShark campaign, which utilizes DLL side-loading to target diplomatic and government entities.
Detects BQTLock ransomware anti-analysis checks, specifically looking for processes named 'start.exe' or 'BQT.exe' that exhibit characteristics of PyInstaller environments (via environment variables) or log anti-debugging failure messages. This rule helps identify the initial stages of BQTLock execution where it attempts to evade analysis.
Detects behaviors associated with ransomware attempting to evade sandbox or virtual machine environments. This rule specifically looks for checks against the 'OOBEInProgress' and 'SystemSetupInProgress' registry values under '\Registry\Machine\System\Setup', and the presence of '_CLUSTER_NETWORK_NAME_' in process command lines. These checks are often performed by malware, such as Reynolds ransomware, to determine if it is running in an analysis environment before proceeding with malicious activities like encryption.
Hunts for the TiFlux agent executing commands to modify Windows Defender or Firewall registry keys to lower security postures.
Detects attempts to disable the Windows Firewall using the netsh command-line utility or PowerShell cmdlets, as well as registry modifications related to firewall profiles. Adversaries often perform this action to impair host-based security controls and facilitate unauthorized inbound or outbound network traffic.
This rule detects suspicious HTTP request bodies containing the 'LD_PRELOAD' environment variable assignment, targeting common temporary or writable directories. This behavior is indicative of an attempt to perform dynamic linker hijacking on a Linux system to inject malicious shared libraries into target processes.
This rule detects the use of the 'msiexec.exe' utility to fetch and potentially execute an '.msi' installer package directly from a remote source via HTTP. This behavior is a known technique for bypassing application control by abusing a signed system binary to download and install malicious packages.
Detects modern phishing tradecraft where malicious JavaScript is embedded inside SVG image files. The browser evaluates the SVG, decodes a Base64 payload, and drops a secondary archive or executable directly to disk via Blob/Data URIs. This rule specifically looks for file creation events in the Downloads folder for common executable or archive file types, correlated with browser processes (Chrome, Edge, Firefox) accessing local SVG files.
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
This rule detects potentially malicious use of the Windows Installer binary (msiexec.exe) by monitoring for command-line arguments involving remote network resources (HTTP/HTTPS/UNC paths) or suspicious local directories (Temp, AppData, Downloads). Such patterns are indicative of living-off-the-land techniques used to proxy execution, download and install payloads, or perform silent/unauthorized software installations.
Page 362 of 864