Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,654
12,601
8,412
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the OXLOADER malware dropping a malicious copy of dui70.dll renamed as a random .ocx file into the user's temporary directory. The rule identifies subsequent loading of this dropped file via LoadLibraryA, which is indicative of module stomping techniques where malicious code in an added .xtext section is executed within the context of a legitimate system component.
Detects the creation or modification of a file named 'dui70.dll' (or variants if renamed) within non-standard, user-writable directories such as AppData or Temp. This behavior is indicative of malware, specifically the OXLOADER payload, preparing for module-stomping by placing a malicious DLL copy outside legitimate Windows System32 or SysWOW64 paths.
Detects anomalous Primary Refresh Token (PRT) issuance for non-compliant, non-hybrid joined devices that do not utilize TPM attestation, followed by immediate access to high-value Microsoft resources like Microsoft Graph, Exchange, or SharePoint. This activity is indicative of the Storm-2372 Conditional Access bypass technique, where attackers register 'phantom' devices to circumvent security policies.
Detects execution of processes originating from memory-only file descriptors (memfd) or the /proc/self/fd/ path, indicating fileless execution techniques often used by malware like MYRA RAT. This behavior is correlated with outbound network connections on port 4444 within a 2-minute window, which is indicative of command-and-control (C2) communication.
Detects the execution of rundll32.exe from common user-writable or temporary directories (Temp, AppData, ProgramData), which is a common technique used by malware to execute payloads while avoiding security monitoring of standard system directories.
Detects attempts to bypass User Account Control (UAC) by either modifying the registry key associated with the ms-settings protocol handler or by executing the fodhelper.exe binary via cmd.exe. These techniques are commonly used by attackers to gain elevated privileges without triggering a UAC prompt.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launching common shell or utility processes (cmd, powershell, wscript, cscript, mshta, regsvr32, rundll32). This behavior is a common indicator of macro-based attacks or malicious document execution where Office applications are abused to launch secondary payloads or execute code.
Detects modifications or creations of registry values within common Windows auto-start locations, specifically the 'Run' and 'Winlogon' keys. These locations are frequently abused by adversaries to maintain persistence on a host. The rule excludes common, legitimate installer and administration processes to reduce noise.
Detects the execution of mshta.exe with arguments containing URLs, script languages (vbscript, javascript), or .hta file extensions, which is a common technique used by attackers to execute malicious code via a legitimate Windows utility.
Detects usage of the Regsvr32.exe utility to load and execute remote scriptlets from an external HTTP source. This technique, often referred to as Squiblydoo, allows adversaries to bypass application control by leveraging a trusted, signed Windows binary to proxy the execution of malicious code without registering it in the registry.
Detects attempts to bypass User Account Control (UAC) by either modifying the registry key associated with the ms-settings protocol handler or by executing the fodhelper.exe binary via cmd.exe. These techniques are commonly used by attackers to gain elevated privileges without triggering a UAC prompt.
Detects unauthorized processes reading, copying, or renaming Kerberos ticket cache files (ccache) located in common temporary directories. This behavior is often associated with credential theft and potential Pass the Ticket attacks where adversaries attempt to extract session credentials to perform lateral movement or privilege escalation.
Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.
Detects modifications or deletions of Conditional Access policies in an environment. This includes disabling policies or altering key configurations like users, groups, applications, platforms, or locations, which could be indicative of an attacker attempting to bypass security controls or maintain persistent access.
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
Detects the use of the built-in Windows utility 'certutil.exe' with arguments commonly used to download remote content (-urlcache -split -f) or decode base64 encoded files (-decode, -decodehex), when the output or operation occurs within temporary system directories such as Temp, AppData, or ProgramData, and the process is not signed by Microsoft.
Detects the execution of mshta.exe with a remote HTTP or HTTPS URL in the command line. This technique is commonly used by adversaries to execute malicious HTA files or scripts directly from a web server, bypassing traditional application whitelisting and browser-based security controls by leveraging a trusted, signed Windows utility.
Detects the use of regsvr32.exe with the /s (silent), /u (unregister), and /i (install) flags to execute a remote COM scriptlet (SCT) via an HTTP or HTTPS URL. This is a known technique (often referred to as Squiblydoo) to bypass application control by leveraging a trusted, signed Windows binary to download and execute code from a remote server.
Detects the execution of mshta.exe with a remote HTTP or HTTPS URL in the command line. This technique is commonly used by adversaries to execute malicious HTA files or scripts directly from a web server, bypassing traditional application whitelisting and browser-based security controls by leveraging a trusted, signed Windows utility.
Detects the use of rundll32.exe to execute comsvcs.dll, a common technique used to create a memory dump of the LSASS process to extract credentials.
Detects the creation of named pipes with names frequently associated with common post-exploitation tools, such as Cobalt Strike. The rule filters out common browser processes and critical Windows system processes to reduce noise.
Page 386 of 864