Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,130 detections
Filters
Last updated
All Time
Detection languages
6,549
6,210
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,320
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,130
15,658
12,604
8,415
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the execution of specific suspicious binaries (HFY.exe or tcc.exe) or registry queries looking for common virtual machine guest additions (VMware or VirtualBox artifacts). These activities are often associated with malware attempting to detect if it is running within a virtualized or sandboxed analysis environment.
Detects suspected sandbox evasion techniques commonly utilized by BeepRAT malware. The rule monitors for WMI queries related to hardware/OS virtualization artifacts (e.g., CIM_Memory, Win32_OperatingSystem), registry enumeration of virtualization keys (VMware/VirtualBox), and suspicious child process spawning of wmiprvse.exe by known loader components (HFY.exe, tcc.exe, LuaJit.exe).
Detects the execution of HFY.exe, a known component of the BeepRAT malware family, along with the presence of its associated sideloaded or dependency DLL files (e.g., data.dll, SQLite.Interop.dll). The rule monitors both process creation events and file system artifacts indicative of the malware's deployment.
This rule detects activities associated with the BeepRAT malware, including the execution of LuaJit.exe with specific command-line arguments (config.ini, temp.bin), the creation of staging files in the TCC local AppData directory, and parent-child process relationships involving a known dropper (HFY.exe). It also utilizes specific SHA256 hashes to identify known malicious BeepRAT binaries.
This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.
This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.
Detects the use of the Tiny C Compiler (TCC) to compile or execute shellcode associated with BeepRAT malware. The rule monitors for characteristic TCC command line arguments ('-nostdlib', '-run') and specific file names ('temp.bin', 'config.ini.c') within the TCC deployment path that are indicative of staging and executing malicious code while attempting to bypass defensive mechanisms like AMSI, ETW, and WLDP.
Detects WMI activity used by the BeepRAT loader to query system information (Win32_OperatingSystem, CIM_Memory), which is characteristic of virtualization and sandbox evasion techniques. The rule correlates process creation and WMI event logs with known indicators associated with BeepRAT deployment.
Detects the execution of tcc.exe with command-line arguments indicative of file operations often associated with UAC bypass techniques. The rule also monitors for the loading of UAC-related DLLs or child processes by tcc.exe, which further suggests activity aimed at gaining elevated privileges.
Detects instances where image processing utilities (ImageMagick's magick.exe or convert.exe) launch Ghostscript binaries (gs, gswin64c.exe) from non-standard directories (such as temp, user profile, or appdata folders) or utilize suspicious command-line arguments that attempt to bypass security policies. This activity is often associated with exploitation of image processing vulnerabilities where attacker-supplied files trigger arbitrary command execution.
Detects UAC bypass activity associated with BeepRAT (Operation DragonClone) which involves modifying registry keys associated with auto-elevating Windows binaries (fodhelper, eventvwr, sdclt, ComputerDefaults), followed by the execution of these binaries and the subsequent loading of DLL/bin payloads from user-writable AppData directories. The rule also detects reads of the 'Creeper' registry key used for BeepRAT C2 configuration.
Detects evidence of BeepRAT malware performing in-memory AMSI or ETW bypass techniques via process command line arguments (e.g., AmsiUtils, AmsiScanBuffer, EtwEventWrite) originating from volatile directories like AppData or Temp, followed by the execution of suspicious processes (PowerShell, csc.exe, msbuild.exe) within a 5-minute window on the same host.
Identifies attempts to exclude the C drive or powershell from Defender scanning, often associated with malware like AsyncRAT. The rule specifically looks for PowerShell commands using 'Add-MpPreference' with '-ExclusionPath' or '-ExclusionProcess' targeting 'C:\' or 'powershell.exe'.
Detects BeepRAT malware exhibiting anti-analysis behavior by performing a sequence of environment-fingerprinting checks within a 60-second window. The rule monitors for a combination of registry queries targeting virtualization artifacts (VMware, VirtualBox) and WMI queries for system hardware/OS information (Win32_OperatingSystem, CIM_Memory), which are common techniques used by BeepRAT to detect virtual machines and sandboxes before execution.
Detects behavioral indicators of the SystemBC (Coroxy) malware, including suspicious task scheduling, hidden PowerShell relaunch routines, use of staging binary names, and anomalous svchost.exe injection patterns. This rule focuses on detecting the multi-stage persistence and proxy behavior typical of SystemBC in pre-ransomware intrusion chains.
This rule detects potentially malicious activities related to the manipulation of Group Policy Objects (GPOs) within an Active Directory environment. It identifies the execution of scripts or processes that create, modify, or force GPO updates (e.g., using 'gpupdate /force'), the deployment of suspicious GPO-related files like 'deploy_gpo.ps1', the manual modification of 'ScheduledTasks.xml' within the SYSVOL directory, and the use of PowerShell to disable real-time monitoring via GPO configuration changes.
Detects suspicious PowerShell command lines that utilize Base64 encoded commands combined with memory-execution primitives such as Invoke-Expression (IEX) or DownloadString. The rule specifically flags commands longer than 100 characters to reduce noise from short administrative tasks.
Detects unauthorized cross-process handle requests to sensitive Windows authentication processes (lsass.exe and winlogon.exe) by non-system and non-whitelisted processes. This behavior is commonly associated with credential dumping techniques and malicious process injection aimed at stealing sensitive authentication data.
Detects the execution of mshta.exe with arguments that indicate the loading of remote HTML applications (HTA) via HTTP/HTTPS, UNC paths, or the execution of inline JavaScript/VBScript commands. This behavior is a common technique used by attackers to proxy execution through a trusted Windows binary to bypass security controls or fetch malicious payloads.
Detects the execution of Windows command-line utilities (icacls, cacls, attrib, takeown) used to modify file permissions or attributes, specifically when these operations are directed at sensitive system or temporary directories (e.g., ProgramData, Temp, AppData, etc.) and executed by non-system service accounts.
Detects unauthorized cross-process handle requests to sensitive Windows authentication processes (lsass.exe and winlogon.exe) by non-system and non-whitelisted processes. This behavior is commonly associated with credential dumping techniques and malicious process injection aimed at stealing sensitive authentication data.
Page 373 of 864