Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,130 detections
Filters
Last updated
All Time
Detection languages
6,549
6,210
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,130
15,658
12,604
8,415
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of mshta.exe from common initial access vectors like document viewers (WinRAR), web browsers (Outlook, Thunderbird), or the Windows Shell (explorer.exe). Additionally, detects instances where mshta.exe subsequently spawns wscript.exe or cscript.exe, which is indicative of a multi-stage script execution chain often used to execute malicious payloads.
This rule monitors for patterns associated with the Gamaredon (ACTINIUM) threat group's PowerShell loaders (e.g., Ptero-family) and the Kazuar backdoor. It specifically detects indicators such as malicious PowerShell command lines, NTFS alternate data stream manipulation, and suspicious scheduled task creation.
This rule detects execution patterns associated with the Gamaredon (Shuckworm) group's Ptero-family of malware. It specifically monitors for encoded PowerShell commands, the use of Invoke-Expression, and the execution of mshta.exe or wscript.exe spawned by Office applications or email clients, which is characteristic of Gamaredon's HTML smuggling and malicious document delivery techniques.
Detects the behavior of the Remcos RAT watchdog process, which monitors the main malware execution. The rule identifies the creation of a specific registry marker (HKCU\SOFTWARE\{MUTEX}\WD) used by the watchdog for state tracking, combined with the malicious process spawning a target executable (svchost.exe, rmclient.exe, or fsutil.exe) from a standard Remcos installation directory.
Detects the creation of Electron runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual subfolders within the AppData\Local directory. This behavior is indicative of potential malware, specifically referencing the 'super', 'max', or 'util' patterns in the path, which have been associated with campaigns like ClickFix.
This rule detects when Microsoft Office applications (Word, Excel, Equation Editor, PowerPoint) spawn common LOLBAS processes such as mshta, wscript, cscript, powershell, or cmd. It includes additional filtering for command-line arguments containing indicators of HTA or RTF exploitation patterns, which are typical of malicious Office documents attempting to execute secondary payloads.
This rule detects potential abuse of Group Policy Objects (GPOs) by identifying multiple changes (3 or more) to GPO-related objects within a short timeframe. It specifically looks for Event ID 5136 (Directory Service Changes) where the ObjectClass is either 'groupPolicyContainer' or 'gPCFileSysPath'. This could indicate an adversary modifying GPOs to achieve persistence, privilege escalation, or other malicious objectives.
This rule detects an unusual number of software uninstall activities on a system within a one-hour window. It specifically looks for command lines containing 'uninstall' or 'remove' along with 'KB' (Knowledge Base update) or 'package', which could indicate an attempt to remove security updates or other software.
Detects a high volume (10 or more within an hour) of file creations or modifications within the 'Program Files' directory where the filename contains the string 'update'. This could indicate legitimate software updates, but also potentially malicious activity attempting to masquerade as an update process, or an application writing to protected directories.
Detects the execution of common security scanning executables such as Microsoft Malicious Software Removal Tool (MSRT) and generic 'scan.exe'. This rule counts the occurrences of these executions per device per hour, which can indicate legitimate security operations or potential adversary activity if used for discovery or defense evasion.
This rule detects a high frequency (3 or more within an hour) of command-line executions containing keywords like 'antivirus', 'defense', or 'endpoint' on a Windows system. This activity could indicate an adversary attempting to interact with, disable, or tamper with security software to evade detection.
This rule detects a high volume (10 or more within an hour) of registry modifications to keys related to 'Run' or 'Services'. Such modifications can indicate attempts to establish persistence, alter system behavior, or install/modify services for malicious purposes. Event ID 4657 specifically logs a registry value being modified.
This rule detects repeated command-line executions that contain keywords 'signing' or 'certificate' within a one-hour window on the same computer and by the same account. This behavior could indicate an adversary attempting to manipulate code signing, bypass certificate validation, or otherwise interfere with security mechanisms. The threshold of 3 or more occurrences within an hour aims to reduce false positives from legitimate, infrequent activities.
This rule detects the execution of a process named 'systemd-userdbd' that is either spawned from suspicious parent contexts (such as Node.js or npm, or from locations like /tmp/, /var/tmp/, node_modules, or .peer/) or is running from a non-standard file path. This behavior is indicative of malware, specifically the MYRA RAT, which uses this process name as a masquerade to evade detection.
This rule detects an unusual number of local or remote interactive logons (LogonType 2 or 10) by the 'SYSTEM' account within a one-hour window. While the SYSTEM account is legitimate, direct interactive logons are rare and multiple occurrences could indicate an attempt to escalate privileges or maintain persistence by an attacker.
This rule detects suspicious activity related to Node.js applications that may indicate malicious manipulation of the environment or persistence mechanisms. It monitors for the loading of a specific hidden library (.libcache.so), usage of the LD_PRELOAD environment variable by node/npm processes, modifications to profile scripts, and irregular crontab entries associated with node execution. This behavior is indicative of dynamic linker hijacking or unauthorized task scheduling for persistence.
Detects fileless execution of the MYRA Linux RAT, which utilizes memfd_create and fexecve to load an ELF binary directly into memory. The detection identifies malicious payloads masquerading as the systemd-userdbd process when spawned by non-standard parent processes such as shell interpreters, node, or npm, as well as abnormal command-line arguments.
Detects cross-process injection techniques associated with Remcos RAT, such as VirtualAllocEx, WriteProcessMemory, and remote thread creation. The rule identifies suspicious interaction with critical Windows system processes (e.g., explorer.exe, svchost.exe) by non-system processes, often indicative of malware injecting code to maintain persistence or evade detection.
Detects persistence mechanisms used by the MYRA Linux RAT, specifically targeting the modification of /etc/ld.so.preload, the deployment of a malicious library (.libcache.so) to /usr/local/lib/, and suspicious shared object file creation in temporary directories (/tmp or /dev/shm) initiated by Node.js or npm processes. This behavior was observed in the Polymarket Trap npm supply chain campaign.
Detects a malicious post-install technique where an npm package utilizes node.exe to perform an 'npm pack' and overwrite critical files within the node_modules directory. This behavior, observed in the Miasma/Polymarket Trap, is designed to bypass static analysis performed during initial installation by swapping legitimate files with malicious variants after the fact.
Detects instances where a non-SYSTEM parent process spawns a child process running as SYSTEM, characteristic of 'Potato' family exploits (e.g., JuicyPotato, PrintSpoofer) leveraging SeImpersonatePrivilege to elevate privileges. The rule specifically filters for known legitimate SYSTEM process spawners while highlighting suspicious parent-child process relationships.
Page 366 of 864