Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects cross-process operations (such as memory access or thread injection) initiated by processes that are not signed by known, trusted vendors, or that do not reside in protected system directories. This behavior is a common indicator of process injection techniques used to evade security controls.
Detects the execution of known critical system processes (e.g., svchost.exe, lsass.exe) from directories other than the standard Windows System32 or SysWOW64 paths. This behavior is indicative of masquerading, where an adversary attempts to evade detection by naming malicious files after legitimate system binaries.
This rule detects common PowerShell code patterns associated with Antimalware Scan Interface (AMSI) bypass techniques. The detection monitors for the presence of specific keywords and method calls in script content, such as 'AmsiUtils', 'amsiInitFailed', and reflection-based attempts to modify memory buffers used by AMSI to scan for malicious scripts.
Detects the execution of PowerShell with encoded commands originating from suspicious process paths (outside Windows or Program Files directories). The rule includes logic to identify potential sandbox evasion by correlating the PowerShell activity with subsequent tasklist.exe execution within a short window, often characteristic of malware performing environment checks.
Detects attempts to terminate security-related processes using taskkill, tskill, or PowerShell's Stop-Process cmdlet. This is a common technique used by adversaries to disable endpoint detection and response (EDR) or antivirus (AV) agents on a compromised system to evade detection.
Detects the execution of known privilege escalation tools (JuicyPotato, RoguePotato, PrintSpoofer) or command-line arguments indicative of token impersonation attempts (e.g., usage of SeImpersonatePrivilege) to escalate privileges on Windows systems.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring for specific keywords associated with memory patching or tampering within the command lines of PowerShell, .NET-based binaries (dotnet.exe, csc.exe, msbuild.exe), and related processes. The rule specifically looks for strings like 'AmsiUtils', 'amsiInitFailed', and base64-encoded equivalents often used by offensive security tools to neutralize AMSI scanning capabilities.
Detects a Python process spawning pip to install multiple libraries (requests, pycryptodome, psutil, pywin32) in a short time frame, a behavior associated with the Arkanix Stealer's Python loader.
Detects when a signed process loads a DLL from a non-standard, user-writable directory (e.g., Temp, Downloads, Public folders). This is a common indicator of DLL hijacking or side-loading, where a legitimate signed application is leveraged to load a malicious library from a compromised location.
Detects attempts to terminate security-related processes using taskkill, tskill, or PowerShell's Stop-Process cmdlet. This is a common technique used by adversaries to disable endpoint detection and response (EDR) or antivirus (AV) agents on a compromised system to evade detection.
Detects the execution of an injector process associated with MYRA RAT, specifically monitoring for ptrace-based process injection techniques. The rule identifies processes attempting to attach to other processes using system calls like PTRACE_ATTACH, PTRACE_PEEKDATA, PTRACE_POKEDATA, or process_vm_writev. It also flags the specific behavior of spawning a 'sleep 600' decoy process as an injection target.
Detects instances where common Windows system processes (dllhost.exe, mmc.exe, svchost.exe) spawn known living-off-the-land binaries (LotLBin) or command-line interpreters. This behavior is often indicative of process injection or malicious activity where an adversary leverages trusted system processes to execute commands or malicious scripts.
Detects the loading of the Microsoft.Management.Configuration.dll image within ConfigurationRemotingServer.exe, indicating active DSC processing. This is a strong indicator of WinGet DSC execution, which is abused by tools like DSCourier.
Detects a sequence of events where an actor deletes a Google Cloud Storage bucket and then immediately recreates it, a pattern consistent with bucket hijacking intended to manipulate resource access or bypass security controls on data streams.
Detects the execution of the Windows binary 'certutil.exe' using flags commonly abused by adversaries to download files from remote URLs or decode base64-encoded files. It excludes instances where certutil is executed by Microsoft-signed processes from the System32 directory to reduce false positives.
Detects the use of regsvr32.exe to load a remote COM scriptlet via a URL. This technique, commonly known as Squiblydoo, allows adversaries to bypass application whitelisting and proxy the execution of malicious code, as regsvr32.exe is a trusted Windows binary.
Detects the execution of mshta.exe with suspicious command-line arguments, including the use of 'javascript:', 'vbscript:', or HTTP/HTTPS URLs. These patterns are commonly used to proxy the execution of malicious HTML Applications (HTA) or scripts to bypass security controls. The rule includes an exclusion for legitimate Microsoft-signed mshta.exe processes that do not contain these suspicious indicators.
Detects instances of rundll32.exe being used to load DLL, OCX, or CPL files from suspicious locations such as user-writable directories (Temp, AppData, Downloads, etc.) or UNC paths. This behavior is indicative of an adversary attempting to execute malicious code using a trusted Windows system binary (LOLBin).
Detects execution of a WMI query targeting Win32_VideoController to retrieve the CurrentRefreshRate property. This behavior is associated with the OXLOADER malware family, which uses this check to identify sandbox or virtualized environments (typically with refresh rates of 20Hz or lower) and abort execution to evade analysis.
Detects the use of bitsadmin.exe to create or modify BITS transfer jobs, a technique often used by adversaries to download payloads or exfiltrate data under the guise of background system tasks.
Detects network connection activity originating from a host to the hardcoded IP 62.102.148.212 on port 37393, which is identified as a command and control (C2) endpoint for Remcos RAT. This communication is often associated with process hollowing where the malware hides within legitimate browser processes.
Page 385 of 864