Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects a batch or script artifact that creates a scheduled task named 'ApphostRagistreationVerifier' (a likely typo for 'ApphostRegistrationVerifier') which is configured to execute a file located within the 'Windows\Fonts\' directory. The detection specifically looks for the presence of 'schtasks' command, 'ONSTART' trigger, and 'SYSTEM' user context, indicating a persistent scheduled task.
This rule query identifies likely post‑exploitation activity associated with React2Shell (CVE-2025-55182) in which Part 1 identifies web servers spawning unusual child processes (such as command shells or system utilities) combined with suspicious command-line patterns, which may indicate post-exploitation behavior following a compromise. and part 2 detects web servers making outbound network connections to known malicious IPs or hostnames, or to domains associated with tunneling services (e.g., trycloudflare.com), suggesting potential command-and-control activity or data exfiltration.
Detects general Entra ID sign-ins originating from Railway.com PaaS IP space, which could indicate a token replay campaign or other unauthorized access.
Detects a mismatched/synthetic iOS 18 User-Agent (Version/26.x) used by Kali365 to bypass detection. This specific User-Agent string is indicative of malicious activity as 'Version/26' does not natively exist on iOS 18.
Detects suspicious modifications to the HKCU\Console registry key used by Gamaredon's GammaLoad to cache C2 URLs for persistence across executions.
This rule detects attempts to bypass AMSI (Antimalware Scan Interface) by overwriting the AmsiScanBuffer function in memory. Specifically, it looks for 'WriteProcessMemoryApiCall' events where the target address is within the memory region of 'amsi.dll', indicating a potential in-memory patch to disable endpoint telemetry.
Detects AutoGen Studio spawning Living-off-the-Land binaries (LOLBins) used for execution or payload retrieval. This rule specifically looks for processes initiated by 'autogenstudio' that then execute 'certutil.exe', 'mshta.exe', 'regsvr32.exe', or 'rundll32.exe'.
This rule detects attempts to disable Microsoft Defender's real-time monitoring or behavior monitoring features using PowerShell. It specifically looks for `powershell.exe` executing `Set-MpPreference` with the `-DisableRealtimeMonitoring` or `-DisableBehaviorMonitoring` parameters set to `1`, `$true`, or `True`.
Detects the execution of osascript used to generate deceptive "Network latency" GUI prompts, tricking the user into granting TCC permissions.
Detects the execution of files attempting to spoof benign document types via double extensions, specifically when initiated by explorer.exe. This technique is often used in phishing attacks to trick users into executing malicious files that appear to be safe documents.
Hunts for the stealer explicitly utilizing xattr -c to strip the com.apple.quarantine extended attribute, bypassing Gatekeeper execution protections.
Detects PowerShell executing the Add-MpPreference cmdlet specifically excluding the targeted mining executables (RuntimeHost.exe, lolMiner.exe, gminer.exe). This activity is indicative of an attacker attempting to disable or bypass Windows Defender's real-time protection for known cryptomining executables, a common tactic in cryptojacking campaigns.
Correlates the successful establishment of a reverse proxy (ngrok/cloudflared) with an incoming interactive logon event originating from the local loopback, indicating the tunnel is actively being used for malicious purposes such as Terminal Server Phishing.
Detects the netsh utility being invoked to explicitly add firewall exclusions for the TiFlux executables to ensure uninterrupted C2.
This rule detects potential ransomware activity by monitoring for file creations or modifications with specific extensions ('servertool.exe', '.prinzeugen', '.prinzeugen.tmp'). It aggregates these events and triggers an alert if a significant number of encrypted files, temporary files, or the 'servertool.exe' executable are observed. The rule also identifies if the activity originates from common user folders like 'Music' or 'OneDrive\Music'.
This rule detects suspicious process creation events where a process is spawned from common user-writable directories (AppData\Roaming, AppData\Local\Temp, Desktop) and subsequently allocates memory with characteristics often associated with code injection or execution (VirtualAlloc, NtAllocateVirtualMemory, PAGE_EXECUTE_READWRITE, 0x40). It filters out known legitimate Windows processes that might exhibit similar behavior.
Detects PNG or BMP image files used as steganographic carriers for hidden PE payloads. This rule specifically looks for PE (Portable Executable) headers (MZ and PE signatures) either appended after the PNG IEND (End of Image) marker or embedded within a high-entropy BMP file, indicating a hidden executable payload. This technique has been observed in multi-stage Remcos RAT loader campaigns.
Detects the creation or modification of a file named 'logs.dat' within the 'AppData\Roaming\DT\' directory by processes other than 'explorer.exe' or 'system'. This pattern is often indicative of malware or unwanted programs attempting to establish persistence or store data in a hidden or less scrutinized location.
This rule detects registry activity that indicates the presence of a virtualization or sandbox environment. Malware often checks for such environments to evade analysis. The rule specifically looks for registry keys and values associated with VMware and VirtualBox.
This rule detects suspicious process activity where common scripting or Office applications (PowerShell, WScript, CScript, MSHTA, Regsvr32, Word, Excel, Outlook) are either executing commands containing 'VirtualAlloc' (indicative of process injection techniques) or are themselves the target of such commands. This combination suggests an attempt to execute malicious code, potentially in-memory, leveraging legitimate applications.
Detects suspicious execution of MpCmdRun.exe (Windows Defender command-line utility) when it is spawned by an unexpected parent process or executed with arguments commonly used to disable or modify Windows Defender's functionality. This rule aims to identify attempts to impair defenses.
Page 375 of 864