Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
Correlates RuntimeHost.exe spawning suspended MSBuild.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities.
Detects successful authentications where a Temporary Access Pass (TAP) was used as the primary authentication method. TAPs bypass standard password and MFA requirements, and their usage outside of expected scenarios (like onboarding or account recovery) could indicate an adversary bypassing authentication mechanisms.
This rule detects the sideloading of 'UnityPlayer.dll' by 'BrowserViewUtility.exe' in conjunction with network communication to a 'windows.net' domain. This activity is indicative of the 'Dragon Weave' campaign, specifically the 'RustCloak' malware, which uses DLL sideloading for execution and Azure cloud for C2.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
Detects the execution of 'PerfWatson2.exe' when initiated from the user-writable 'AppData\Local' directory. 'PerfWatson2.exe' is a legitimate Windows process associated with the Windows Error Reporting service; its presence or execution from a user directory is indicative of masquerading or potential malware activity.
This rule detects two suspicious behaviors associated with the TinyRCT malware family: the execution of common installer or archiver utilities in the Downloads folder that terminate within two seconds, and the use of 'choice.exe' for self-deletion of an executing process within a short timeframe.
This rule detects attempts to modify Windows Defender exclusions using PowerShell cmdlets (Add-MpPreference, Set-MpPreference) or direct Registry manipulation. Adversaries often modify these exclusions to hide malicious files or directories from antivirus scanning, a technique used to impair defensive security tools.
Detects the execution of 'PerfWatson2.exe' when initiated from the user-writable 'AppData\Local' directory. 'PerfWatson2.exe' is a legitimate Windows process associated with the Windows Error Reporting service; its presence or execution from a user directory is indicative of masquerading or potential malware activity.
Detects potential local privilege escalation attempts targeting the SystemInformer PhSvc service. The rule identifies suspicious child processes spawned from rundll32.exe (acting as a proxy) or other common binaries, where the process chain indicates an interaction with the SiSvcApiPort or the use of phsvc-related command-line arguments, potentially leading to unauthorized elevated process creation or service installation.
Detects anomalous process execution patterns associated with the Gitea Act Runner that indicate attempts to break out of container isolation. This includes the use of sensitive Docker flags like --privileged, --pid=host, or --ipc=host, the mounting of the Docker daemon socket, or the execution of nsenter to gain access to the host namespace, which are indicative of container escape techniques.
Identifies multiple directory junctions being created in a short time frame by the same user or process. This behavior indicates the potential setup of a GhostTree binary tree-like structure, which creates recursive loops to evade EDR and folder scans.
Detects suspicious child processes spawned by AnyDesk.exe or AnyDesk-runtime.exe that may indicate local privilege escalation. This rule specifically targets the abuse of the adprinterpipe named pipe and CoUnmarshalInterface to impersonate SYSTEM-level AnyDesk processes, allowing for the execution of unauthorized child processes.
Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.
Detects Node.js or JavaScript runtimes executing code patterns commonly associated with GlassWorm-style supply chain attacks. The campaign abuses invisible Unicode variation selectors to hide malicious payloads that are decoded and executed through eval(). Investigate execution originating from repositories, package managers, VS Code extensions, or temporary development directories.
Detects indicators of Grandoreiro banking trojan infection, including the loading of associated malicious DLLs from user-writable AppData directories, the execution of the specific binary 'ROt4I@m$etqv1Ns.exe' via script interpreters, and the spawning of unsigned executables from AppData by wscript.exe or cscript.exe.
Detects exploitation of the SystemInformer PhSvc service by monitoring for rundll32.exe launching with command-line arguments indicative of loading a proof-of-concept DLL and attempting to communicate with the SiSvcApiPort ALPC port. This activity is associated with abusing privileged helper APIs to perform unauthorized SYSTEM-level process creation or service installation.
Detects unexpected child process execution spawned by the Lunar Client Electron main process. This rule is designed to identify potential exploitation attempts, such as the lunar-modrinth-chain exploit, where malicious files (e.g., .mrpack entries) could lead to arbitrary code execution via shell.openExternal calls.
Page 378 of 864