Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,132 detections
Filters
Last updated
All Time
Detection languages
6,549
6,212
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,736
1,393
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,132
15,660
12,605
8,416
6,238
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects persistence mechanisms associated with the MYRA Linux RAT, including LD_PRELOAD hijacking for shared library redirection, malicious cron job creation with specific scheduling (13-minute intervals), and unauthorized modifications to profile.d scripts to execute malicious code.
Detects evidence of the TinyRCT backdoor, which masquerades as legitimate VMware utilities and system binaries. The rule monitors for malicious activity including suspicious execution of vmtools.exe/vmwared.exe from ProgramData, unauthorized scheduled task creation, PerfWatson2.exe execution outside of legitimate Visual Studio installation paths, and chrome_setup.exe execution from non-standard directories.
This rule monitors for suspicious process execution and module loading events, specifically targeting file paths and configurations associated with potential AppDomain Manager injection or masquerading techniques (e.g., PerfWatson2.exe, VMware tools, or Chrome setup configurations). It correlates Sysmon and Security event logs to detect known malicious patterns or abnormal file behaviors.
Detects the execution of known tunneling binaries or binaries masquerading as common security and management agents (e.g., XDRAgent, vmtools, vmwared) with suspicious command-line arguments indicative of reverse tunnel establishment or C2 activity.
Detects the execution of 'PerfWatson2.exe' from within the user's AppData directory. This behavior is often associated with potential masquerading attempts, as legitimate instances of this file typically reside in system directories or specific application folders. The rule includes an exclusion for Microsoft Visual Studio related paths to reduce noise.
Detects the execution of 'Mixed Reality.exe' using the 'runas' command-line utility. This pattern is often used to execute binaries with elevated privileges or alternate user contexts, which can be an indicator of potential privilege escalation or lateral movement.
Detects the spawning of svchost.exe processes from parent processes associated with Windows Mixed Reality or NvdaHelperRemote, which may indicate malicious process injection or suspicious use of GDI screen capture APIs within a masqueraded service context.
This rule detects processes that load 'amsi.dll' while concurrently performing suspicious memory or API activities often associated with AMSI bypass techniques, such as calling 'VirtualProtect' to change memory permissions or using API resolution functions like 'AmsiOpenSession', 'GetProcAddress', or 'GetModuleHandleA'. This pattern is commonly used by adversaries to disable or subvert the Antimalware Scan Interface.
This rule monitors for processes with suspicious file names (specifically identified as potential obfuscated binaries) that perform API calls to 'GetTickCount64' associated with sandbox evasion techniques such as environment detection, debugger checking, and memory inspection.
Detects potential process injection attempts targeting svchost.exe by monitoring for specific memory manipulation and object handling APIs (ZwWriteVirtualMemory, NtDuplicateObject, ZwQueryAttributesFile). Also monitors for a synthetic process event containing a specific hardcoded command line string associated with potential malicious setup activity.
This rule monitors for suspicious process behaviors and module loads involving 'Mixed Reality.exe' and 'Windows Media Player' components. It detects instances where these files are launched by 'svchost.exe', load suspicious files like 'nvdaHelperRemote.dll', or are executed as a child of 'services.exe'. These behaviors are often associated with masquerading or potential process injection techniques.
Detects the creation, modification, or deletion of the 'C:\debug.txt' file, which is an artifact associated with the DcRAT malware's screen capture module. The rule specifically monitors for this file's activity and highlights when the deletion is performed by 'svchost.exe', a common process used for masquerading malicious activity.
Detects execution patterns indicative of exploitation attempts against the CVE-2024-1086 Linux kernel vulnerability. The rule identifies suspicious usage of networking tools ('tc' with 'pedit'), namespace manipulation ('unshare'), AppArmor profile bypasses ('aa-exec'), and specific malicious binary names associated with proof-of-concept exploits for this vulnerability.
Detects the use of the 'unshare' utility to create new namespaces on Linux systems. Adversaries often use 'unshare' to perform container escapes, escalate privileges, or isolate processes from host-level monitoring. This rule specifically filters out legitimate administrative or container management processes such as systemd, containerd, and runc to reduce noise.
Detects unauthorized modification of the amsi.dll memory space using process access operations such as VirtualProtect. This behavior is a common technique used by malware and scripts to disable the Antimalware Scan Interface (AMSI) in-memory, allowing for the execution of malicious payloads without triggering security product alerts. The rule specifically monitors for sensitive process access granted to amsi.dll originating from high-risk parent processes such as PowerShell, script interpreters, and Microsoft Office applications.
Detects potential DcRAT staging activity identified in Operation DragonReturn. The rule monitors for the creation of JPEG files in suspicious locations by non-browser processes (Sysmon EID 11), and the loading of .NET DLLs or files from staging directories by LOLBins such as mshta.exe, regsvr32.exe, or rundll32.exe (Sysmon EID 7).
Detects instances where the /bin/su binary is executed by a non-root process but succeeds in launching as the root user. This behavior is indicative of potential memory-based privilege escalation exploits, such as page cache poisoning (e.g., pedit COW variants), which allow unauthorized SUID binary execution without modifying the binary on disk.
Detects modification of /etc/ld.so.preload to register the MYRA RAT rootkit shared library (.libcache.so) for system-wide LD_PRELOAD injection. The MYRA npm package (apintergrationpost) copies libcache.so to /usr/local/lib/.libcache.so and appends its path to /etc/ld.so.preload, causing the rootkit to load into every new process on the system.
Detects MYRA RAT's proc_hide and agent_launcher components masquerading as systemd-userdbd by copying Node.js binary to /usr/lib/systemd/systemd-userdbd and using prctl PR_SET_NAME to overwrite process name and argv[0]. This rule identifies suspicious process activity where a process attempts to impersonate 'systemd-userdbd' by having a matching folder path or command line, but originating from an unexpected location or being associated with known MYRA RAT components like 'agent_launcher' or 'proc_hide', or Node.js.
Detects DcRAT loader attempts to disable AMSI scanning by patching the AmsiOpenSession function in amsi.dll memory using VirtualProtect, a technique associated with malware such as DcRAT and historical campaigns like Operation DragonReturn.
Detects suspicious processes accessing, reading, or deleting browser credential stores (like 'Login Data', 'cookies.sqlite'). The rule specifically monitors for patterns where non-browser processes interact with these files, particularly when both file read and deletion actions are observed, which is a technique used by Remcos RAT to wipe existing sessions and force re-authentication for harvesting.
Page 365 of 864