Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects instances where rundll32.exe is spawned by common command-line or installer processes (cmd.exe or msiexec.exe), often associated with malicious script execution or payload deployment from user-writable directories (AppData\Roaming) or using batch files.
Detects the loading of the system dynamic link library USER32.dll by a process executing from a suspicious directory within AppData\Roaming\Traiolx Custom Utils\. This behavior is consistent with potential DLL side-loading or process injection attempts where a process residing in a non-standard or user-writable location attempts to interact with critical OS system modules.
Detects inbound emails from external domains that leverage generic automated sender display names (e.g., 'DocuSign', 'No-Reply') and deliver PDF attachments with lure filenames commonly associated with document-based phishing campaigns (e.g., 'Agreement', 'Settlement'). The rule specifically monitors for these indicators when the subject line also contains executive-level keywords, indicating a targeted phishing attempt against C-Suite personnel.
Detects the execution chain where msiexec.exe spawns rundll32.exe, a pattern observed in LegionLoader to proxy malicious DLL execution. The rule monitors for rundll32.exe command lines referencing common user-writable or staging directories such as AppData, Temp, or ProgramData, which are often used to host malicious payloads, while excluding known legitimate DLLs.
Detects a behavioral pattern associated with LegionLoader malware, where a process running from the 'AppData\Roaming' directory loads 'user32.dll' or 'kernel32.dll'. This pattern is frequently used to dynamically resolve GUI interaction APIs (such as MessageBoxA) via GetProcAddress as an anti-analysis and obfuscation technique.
This rule detects email spoofing attempts where the sender's display name is set to 'Monitoring', but the sender's email address does not contain 'monitoring', specifically targeting activity associated with the 'gasparinutrition.com' domain. This behavior is indicative of an impersonation attempt, commonly used in phishing campaigns to establish trust.
This rule monitors for incoming emails that pass DKIM authentication but fail DMARC verification, specifically where the signing domain is associated with Google Apps (gappssmtp.com). This pattern is often indicative of email spoofing, where an attacker sends mail from a legitimate provider's infrastructure but fails the domain alignment requirements of DMARC.
This rule detects various behaviors associated with the LegionLoader malware, including suspicious process execution (msiexec/cmd spawning cmd/rundll32/dllhost via AppData), anti-debugging API calls (IsDebuggerPresent, SetUnhandledExceptionFilter), and specific registry modifications targeting Internet Explorer security settings used for sandbox evasion.
This rule detects potentially malicious activity where msiexec.exe is used to drop payloads or cmd.exe is used to execute batch scripts located within the user's AppData Roaming directory. This pattern is commonly associated with malware staging and execution, including specific indicators linked to LegionLoader.
Detects the execution of 'msiexec.exe' where the installer package is located in suspicious or user-writable directories such as AppData, Temp, or Downloads. It specifically targets MSI files that do not follow standard naming conventions or use suspicious filename patterns, which is a common indicator of dropper or delivery behavior by adversaries.
Identifies the execution of WindowsBackstageShell.exe used to create the invisible alternative desktop environment, as observed in Operation SilentCanvas.
Detects PowerShell executing a reflective .NET assembly load, potentially indicative of a backdoor, initiated by a Node.js process. The detection specifically looks for keywords related to .NET Reflection, assembly loading, byte arrays, and a specific C2 domain (hellolargeworld.com:443) or invocation method (Extension.SubRoutine.Run2) within the PowerShell command line. The initiating process is expected to be 'node.exe'.
This rule detects command line patterns associated with Cobalt Strike Beacon injection, specifically looking for indicators of 'beacon.dll', 'beacon.exe', or 'injection' strings being executed by suspicious parent processes such as explorer.exe, svchost.exe, or winlogon.exe. This activity is indicative of post-exploitation behavior and potential lateral movement or persistence attempts.
Detects the suspicious use of the legitimate Windows utility CertUtil.exe for downloading files from remote URLs or for encoding/decoding files. These actions are common techniques used by adversaries to bypass security controls, download malicious payloads, or obfuscate staging files.
This rule detects the use of Regsvr32.exe to execute remote scriptlets (.sct files) from external HTTP/HTTPS URLs by loading the scrobj.dll module. This technique, commonly known as 'Squiblydoo', is used to bypass application allowlisting (such as AppLocker) and proxy execution of malicious code.
Detects attempts to terminate security-related processes or stop security services using common Windows command-line utilities such as taskkill, tskill, or the net stop command. This behavior is indicative of an adversary attempting to impair defensive measures on a compromised system.
Detects suspicious execution of MSBuild.exe originating from non-standard parent processes or loading project/xml files from unconventional directories such as user-writable or temporary locations. This behavior is indicative of an attempt to bypass application whitelisting and execute arbitrary inline C# code via MSBuild's task functionality.
This rule detects potentially malicious usage of the BGInfo.exe utility, a legitimate Sysinternals tool used for desktop configuration information. The detection focuses on two primary attack vectors: 1) BGInfo.exe spawning scripting interpreters like wscript.exe or cscript.exe, which is anomalous behavior for a configuration tool; and 2) Execution of BGInfo.exe with a .bgi configuration file located in non-standard, potentially user-writable, or temporary directories, indicating potential abuse of the configuration file to execute arbitrary payloads.
Detects the execution of msiexec.exe where the command line points to a remote resource via HTTP, HTTPS, or a UNC path. This behavior is indicative of an adversary using msiexec to download and execute a malicious MSI package, leveraging it as a proxy for malicious code execution.
Detects the suspicious use of the legitimate Windows utility CertUtil.exe for downloading files from remote URLs or for encoding/decoding files. These actions are common techniques used by adversaries to bypass security controls, download malicious payloads, or obfuscate staging files.
Detects instances of rundll32.exe being executed with command-line arguments that suggest malicious activity, specifically loading modules from remote UNC paths, using the javascript: protocol, or explicitly invoking ShellExec_RunDLL via shell32.dll. This rule filters out legitimate signed Microsoft binaries to focus on potentially unauthorized or malicious proxies.
Page 371 of 864