Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,130 detections
Filters
Last updated
All Time
Detection languages
6,549
6,210
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,130
15,658
12,604
8,415
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects instances of rundll32.exe being executed with command-line arguments that suggest malicious activity, specifically loading modules from remote UNC paths, using the javascript: protocol, or explicitly invoking ShellExec_RunDLL via shell32.dll. This rule filters out legitimate signed Microsoft binaries to focus on potentially unauthorized or malicious proxies.
Detects the creation of scheduled tasks using schtasks.exe, where the command line arguments reference known LOLBins (Living Off the Land Binaries) such as certutil, regsvr32, mshta, wscript, cscript, rundll32, or encoded command execution via cmd.exe. This activity often indicates an attempt to establish persistence or execute malicious code using trusted system binaries.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell by searching for common memory patching techniques, such as modifying AmsiUtils, AmsiScanBuffer, or related reflection-based obfuscation in process command lines.
Detects incoming emails that claim to be from a 'Monitoring' display name associated with the gasparinutrition.com domain or specific accounting sender address, which may indicate a spearphishing or impersonation attempt.
Detects registry queries targeting Internet Explorer security configuration keys, such as 'WarnOnHTTPSToHTTPRedirect' or those within the 'Internet Explorer\Security' path. These queries may indicate an attempt to identify or modify security settings to facilitate malicious activities like bypassing security warnings or weakening browser protection.
This rule monitors for processes executing from within the 'AppData\Roaming\Traiolx Custom Utils\' directory that subsequently load specific DLLs (7z.dll, normaliz.dll, or user32.dll). This behavior pattern is indicative of potential malicious activity, such as side-loading or execution of masqueraded binaries.
Detects the creation or usage of specific DLLs and batch files within a directory path containing 'Traiolx Custom Utils'. This pattern often suggests the deployment or execution of components related to specific tools or potentially malicious software, leveraging DLL side-loading or path-based execution.
Detects registry queries targeting Internet Explorer security, Windows NT versions, and Internet settings, which are commonly used by LegionLoader for environment fingerprinting and sandbox evasion during the initial staging phase.
Detects the execution of msiexec.exe or batch files from the AppData Roaming directory, as well as msiexec.exe spawning cmd.exe. These behaviors are frequently associated with staging and executing malicious payloads in user-writable directories.
Detects instances where msiexec.exe spawns suspicious child processes such as cmd.exe, powershell.exe, wscript.exe, or other common LOLBins, often associated with LegionLoader activity. The rule looks for suspicious command-line arguments (e.g., silent install flags, AppData paths, or specific artifacts like xupdate.bat or data.dat) indicative of malicious MSI-based proxy execution.
Detects msiexec.exe being launched with installation flags (/i, /quiet, /q) from user-writable directories (AppData, Temp, Downloads), correlated with file creation in AppData\Roaming subdirectories. This pattern is characteristic of the LegionLoader malware, which drops and executes MSI installer packages to facilitate further infection stages.
Detects a suspicious execution chain associated with LegionLoader, where a malicious DLL (e.g., normaliz.dll or 7z.dll) is staged in the AppData\Roaming directory followed by the execution of rundll32.exe spawned by msiexec.exe or cmd.exe to load the staged DLL.
Detects a suspicious execution chain associated with LegionLoader, where msiexec.exe is observed spawning cmd.exe to execute batch scripts located in temporary directories such as AppData\Roaming or system temp folders. This rule correlates an initial msiexec process initiation with a subsequent suspicious child process creation event on the same host.
Detects the LegionLoader malware behavior where a password-protected .dat archive is created in the AppData\Roaming directory followed by the execution of 7z.exe or 7za.exe to extract the hidden payload.
Detects rapid staging of multiple files (3+ within 1 minute) with varying executable and script extensions (.dll, .bat, .dat, .exe, .pyd) in a non-standard subdirectory under AppData\Roaming. This behavior is characteristic of LegionLoader and Traiolx Custom Utils payload staging activities. The rule excludes common system processes to minimize noise.
Detects suspicious enumeration of Internet Explorer security zone registry keys, a known sandbox and debugger fingerprinting technique used by LegionLoader. The detection triggers when processes originating from AppData/Roaming or descending from msiexec.exe perform multiple registry reads on sensitive IE configuration keys within a one-minute window.
Detects the LegionLoader malware using a malicious normaliz.dll staged in user-writable directories (AppData\Roaming\Traiolx Custom Utils) to perform DLL sideloading. The rule correlates this malicious module load with suspicious LOLBin behavior where msiexec.exe executes cmd.exe, forming a known infection chain.
Detects the LegionLoader malware execution chain, specifically identifying the side-loading of a malicious 7z.dll file placed in user-writable directories (e.g., AppData, Temp) instead of legitimate 7-Zip installation paths. This rule correlates the file creation event with the suspicious behavior of msiexec.exe launching cmd.exe, a characteristic pattern of the LegionLoader LOLBin execution flow.
Detects LegionLoader malware performing environmental fingerprinting by querying specific Windows registry keys (Internet Settings Zones and CentralProcessor) in rapid succession. This behavior is indicative of a multi-stage check to identify sandbox or virtual machine environments before executing the final payload.
This rule detects scenarios where an unknown or suspicious executable (named HFY.exe) interacts with Windows binaries commonly used for User Account Control (UAC) bypass attacks, such as eventvwr.exe, fodhelper.exe, and consent.exe. The detection monitors process creation events (Sysmon Event ID 1 or Windows Event ID 4688) for direct execution or parent-child relationships involving these binaries, which are often used to elevate privileges without user interaction.
Detects suspicious process execution patterns associated with the 'HFY.exe' utility, including potential User Account Control (UAC) bypass attempts via auto-elevating Windows binaries like eventvwr, fodhelper, and sdclt, as well as specific command-line parameters for 'tcc.exe'.
Page 372 of 864