Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects potentially malicious activities on Linux systems, including the download of files via curl or wget from a specific IP address, execution of scripts named 'isp.sh', usage of hidden temporary files (e.g., .xlamb), detection of processes named 'lambsys', and execution of scripts within the /var/tmp directory after a chmod +x command. These patterns are often associated with stage-1 or stage-2 dropper behaviors, malware persistence, or post-exploitation activities.
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory.
This rule detects a multi-stage execution pattern where a PowerShell process (PteroLoader) executes with suspicious flags (encoded or hidden commands) and subsequently launches a child process that is not part of a common list of legitimate system processes. This behavior is indicative of potential malware staging or command-and-control activity, specifically targeting unauthorized child process creation following PowerShell obfuscation.
Detects execution of regsvr32.exe with arguments that indicate loading of a remote scriptlet file (.sct) or script over HTTP/HTTPS, a common technique for bypassing application control and executing arbitrary code, often referred to as Squiblydoo.
Detects cross-process activity where a non-Microsoft signed process or an unsigned process attempts to inject code into high-value Windows system processes, such as lsass.exe, explorer.exe, or svchost.exe. This activity is indicative of malicious code injection or process hollowing, often used to achieve privilege escalation or persistent stealth.
Hunts for the Python process utilizing ctypes bindings to dynamically resolve VirtualProtect and patch the AmsiScanBuffer. This rule specifically looks for 'WriteProcessMemoryApiCall' events where the initiating process is 'python.exe' and the target memory address is within the 'amsi.dll' module.
This rule detects the use of BITSAdmin or PowerShell 'Start-BitsTransfer' to initiate file transfer jobs. These tools can be abused by adversaries to download malicious payloads or exfiltrate data, often bypassing standard firewall restrictions. The rule specifically filters out legitimate Microsoft-signed processes to reduce noise.
Detects the use of cmstp.exe with suspicious command-line arguments (e.g., .inf file references or silent/unattended flags) often associated with bypass of application control or User Account Control (UAC).
Detects execution of regsvr32.exe with command line arguments commonly used to execute remote scriptlets (SCT files) via HTTP/HTTPS, bypassing application control by leveraging a trusted Microsoft binary.
This rule detects attempts to acquire Windows credentials by accessing critical registry hives (SAM, SYSTEM, SECURITY) or their shadow copies. It looks for the use of 'reg save' to export hives, as well as direct file access to these hives or their shadow copy variations by non-standard system processes.
Detects modifications to the 'LimitBlankPasswordUse' registry setting to '0'. This modification enables remote network logons for accounts with blank passwords, a technique abused by threat actors like DragonForce for persistence.
Detects attempts to disable or flush system firewall rules on Linux platforms using common utilities like iptables, ufw, or nftables. Adversaries perform these actions to bypass network access controls and facilitate malicious activities such as command and control communications or lateral movement.
Detects the use of the Windows command-line utility 'wevtutil.exe' to clear Windows event logs. Attackers often clear logs to hide evidence of post-compromise activity.
Detects the execution of PowerShell commands intended to disable or bypass the Antimalware Scan Interface (AMSI). This is achieved by referencing internal AMSI methods such as 'AmsiUtils', 'amsiInitFailed', or 'amsi.dll' within command line arguments, typically used to neutralize endpoint security scanning during malicious script execution.
Detects core Windows system processes (svchost.exe, lsass.exe, csrss.exe, winlogon.exe) executing from non-standard locations other than System32 or SysWOW64. This is a common indicator of process masquerading, where malicious actors rename or move their executable to blend in with legitimate system activity.
Detects the use of certutil.exe for potentially malicious activities including file encoding/decoding and downloading files from the internet. Attackers often abuse this legitimate Windows utility to deobfuscate payloads or pull malicious files onto a target system.
Detects the execution of the Windows runas command using the /savecred flag. This flag instructs Windows to save the supplied credentials locally, which can be abused by unauthorized users to elevate privileges or execute processes in the context of a saved account without providing a password again.
Detects the execution of regsvr32.exe with command-line arguments that attempt to load and execute a remote scriptlet (SCT file) via a URL. This technique is often used to bypass application control and proxy the execution of arbitrary code using the trusted regsvr32.exe binary.
Detects the use of certutil.exe for potentially malicious activities including file encoding/decoding and downloading files from the internet. Attackers often abuse this legitimate Windows utility to deobfuscate payloads or pull malicious files onto a target system.
Detects a utility-themed parent process launching msiexec with a ScreenConnect or remote support installer and quiet options. This behavior is often associated with adversaries attempting to establish remote access covertly.
Detects when a ScreenConnect installer or related process loads the 'vcredist_x64.dll' file from a temporary, downloads, or AppData folder. This behavior can indicate DLL side-loading, where a malicious DLL is placed in a location that a legitimate application will search before its intended, trusted location, potentially for privilege escalation or persistence.
Page 382 of 864