Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects evidence of post-exploitation activity on Cisco SD-WAN components (vManage, vSmart, vBond). The rule triggers on common forensic evasion techniques including the deletion of logs via 'rm' or 'find', modification of file permissions on sensitive logs, use of validation scripts to verify account removal (e.g., 'troot'), and cleanup of staging files or tenant lists.
Detects anomalous SSH lateral movement originating from the Cisco SD-WAN Manager (vManage) to other control plane components (vSmart/vBond). This rule correlates network connections on port 22 with successful SSH logins using privileged or service-related accounts, which is indicative of potential post-exploitation activity or pivoting within an SD-WAN control plane environment.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
This rule detects the creation or interaction with mutexes that contain both 'asus_' and '_v' in their names. This pattern has been observed in malware associated with ASUS systems, potentially indicating the presence of malicious software attempting to establish a unique identifier on the compromised system.
This rule detects potential Remote Access Trojan (RAT) activity by identifying specific indicators associated with Nuitka-compiled binaries, specifically the 'chost.exe' filename or paths containing 'win-driver-xd7d'. Additionally, it monitors for suspicious Python-based loader executions ('loader.py') initiated from temporary directories, which is a common persistence or execution technique for such malware.
Detects the use of wmic.exe or powershell.exe by common scripting interpreters (python.exe, chost.exe) to query system information via WMI, specifically targeting hardware identifiers (Win32_ComputerSystem, Win32_NetworkAdapterConfiguration) or MAC addresses. This behavior is indicative of virtualization or sandbox evasion techniques, where malware attempts to identify if it is running within an analysis environment by checking hardware signatures.
Detects indicators of execution related to a known NPM Remote Access Trojan (RAT), including masquerading via chost.exe, execution from specific temporary directories used by the malware, and Python scripts executing a loader.py file from temporary locations.
This rule detects potential Remote Access Trojan (RAT) activity by identifying specific indicators associated with Nuitka-compiled binaries, specifically the 'chost.exe' filename or paths containing 'win-driver-xd7d'. Additionally, it monitors for suspicious Python-based loader executions ('loader.py') initiated from temporary directories, which is a common persistence or execution technique for such malware.
Detects anomalous process execution and filesystem access patterns originating from Gitea Act Runner that indicate an attempted container-to-host escape. This includes the injection of dangerous container flags (e.g., --pid=host, --privileged, --cap-add=ALL) into workflow commands, the execution of nsenter, or direct access to the host's filesystem structures (e.g., /host or /proc/1/root).
This rule detects various stages of exploitation activity associated with the System Informer PHSVC (Process Hacker Service) proof-of-concept (PoC). It monitors for the loading of the PoC DLL via rundll32, the spawning of processes using the specific PoC marker string, unexpected elevated child processes spawned by SystemInformer.exe, and the creation of services or PoC artifacts that facilitate privilege escalation or persistence.
Detects the use of wmic.exe or powershell.exe by common scripting interpreters (python.exe, chost.exe) to query system information via WMI, specifically targeting hardware identifiers (Win32_ComputerSystem, Win32_NetworkAdapterConfiguration) or MAC addresses. This behavior is indicative of virtualization or sandbox evasion techniques, where malware attempts to identify if it is running within an analysis environment by checking hardware signatures.
Detects exploitation of the SystemInformer phsvc service via ALPC port abuse and trusted-host bypass. The attack involves loading a malicious DLL into the Microsoft-signed rundll32.exe process to bypass trust checks, subsequently connecting to the '\BaseNamedObjects\SiSvcApiPort' to invoke privileged APIs for LPE.
Detects the Gitea Act Runner CI/CD tool executing Docker containers with dangerous security flags (such as --privileged, --pid=host, or --cap-add=ALL) or spawning nsenter to interact with host namespaces. This behavior indicates a potential attempt to escape the container boundary and gain unauthorized root-level access on the underlying CI/CD runner host.
Detects evidence of post-exploitation anti-forensic activity on Cisco SD-WAN components (vManage, vSmart, vBond). This rule monitors for unauthorized removal of logs and exploitation artifacts, the clearing of shell command history, and suspicious modification of file and directory permissions on critical system paths.
Detects the installation of a malicious browser extension that impersonates the legitimate Perplexity AI service. The extension leverages a typosquatted domain ('perplexity-ai.online') and a specific extension ID to facilitate search hijacking and keystroke collection on the victim host.
Detects a multi-stage activity chain associated with BumbleBee malware. The rule correlates the execution of an MSI installer from user-writable directories (e.g., Downloads, Temp) with the creation of a 'msimg32.dll' file in a non-System32 directory, followed by the loading of this suspicious DLL into the 'consent.exe' process. This pattern is characteristic of BumbleBee's DLL sideloading execution technique.
Detects automated Microsoft Graph API requests indicative of the 'Payroll Pirate' campaign, specifically targeting payroll and HR personnel after initial access via AiTM session token theft. The rule identifies two malicious patterns: bulk user directory harvesting using '?$top=999' and keyword-targeted enumeration (payroll, human, compensation) using OR-chained search queries and pagination markers ($skiptoken).
Detects the Bumblebee loader technique where a trojanized installer drops the legitimate Windows binary consent.exe and a malicious msimg32.dll into a temporary directory. The rule flags instances where consent.exe loads msimg32.dll from an AppData subfolder, indicating a DLL search order hijacking attempt rather than loading the trusted system library.
Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
Detects when a legitimate application, specifically 'pdf24.exe', loads 'cryptbase.dll' from a non-standard directory. This behavior is indicative of DLL side-loading, a technique known to be used by the PDFSIDER malware to evade detection and potentially escalate privileges.
Page 377 of 864