Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects various activities associated with the SilverFox loader chain, including Defender exclusion modifications, suspicious child processes spawned from trojanized OEM binaries, VirtuOne DLL loading, scheduled task creation with specific names or unusual principals, creation of 'checktime.vbs' in public user directories, and masquerading of 'svchost.exe' in the Windows directory.
Detects attempts to leverage PowerShell to register a loose-file AppX package from a UNC path. This technique can be used to trigger NTLM coercion via InstallService.exe or achieve SYSTEM DLL load, often associated with the 'UNCanny' coercion method. The rule looks for PowerShell command lines containing 'Add-AppxPackage', '-Register', and a UNC path (\\) along with 'AppxManifest.xml'. Additional suspicious indicators like '-ExecutionPolicy Bypass', 'DiscCoerceProbe', 'poc.ps1', 'Invoke-InstallServiceCoerce.ps1', or '-AttackerHost' increase the suspicious score.
Detects potential DCOM lateral movement by identifying svchost.exe spawning DCOM host processes (mmc.exe, mshta.exe, wmic.exe) with the '-Embedding' argument, followed by these DCOM host processes spawning command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This pattern is indicative of adversaries leveraging DCOM for remote code execution and subsequent shell access.
Detects the execution of 'cmd.exe' with a command line that includes both a 'timeout' command and a 'del /f /q' command. This combination can be indicative of an adversary attempting to delay execution before forcefully deleting files, often seen in destructive malware or during incident response to remove evidence.
Detects attempts to bypass or disable the Antimalware Scan Interface (AMSI) in PowerShell sessions by monitoring for common indicators such as manual manipulation of AmsiUtils, AmsiScanBuffer, or reflection-based patching techniques. This activity is indicative of an adversary attempting to execute malicious code without security interference.
Detects instances where an email client (Outlook, Thunderbird, Edge, Chrome, Firefox) spawns `cmd.exe` with highly obfuscated command-line arguments. This behavior is characteristic of phishing delivery chains, specifically mentioning Phantom Stealer, which often uses Base64, XOR, and Donut for obfuscation. The rule looks for specific keywords and patterns indicative of obfuscated commands, such as `-enc`, `-EncodedCommand`, `FromBase64String`, `certutil`, `^^`, `!x!`, and `set /p`.
Detects potential Windows privilege escalation attempts where a user account is assigned the SeImpersonatePrivilege and subsequently executes known exploitation tools (e.g., Potato-family exploits) within a short window. This pattern often indicates an attempt to escalate to SYSTEM privileges by abusing token impersonation vulnerabilities.
Detects the use of regsvr32.exe to execute remote scripts or components via a URL (a technique often referred to as Squiblydoo). This rule flags process command lines containing /i flags combined with remote HTTP/HTTPS addresses, while excluding known management tools to reduce false positives.
Detects various activities associated with Operation Poisson Havoc Demon, including the loading of 'senti.dll' (a shellcode carrier), PowerShell execution spawned from 'explorer.exe' (indicating potential shellcode injection), execution of 'RevS.ps1' (a PowerShell reverse shell), and the presence of other suspicious files like 'PhantomBackdoor' and 'TencShell'.
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Identifies untrusted AutoHotkey (AHK) scripts executing under renamed benign system signatures, specifically masquerading as Realtek components.
Detects PowerShell scripts that reconstruct native cmdlets (e.g., Test-Path) from fragmented character arrays mapped to Simplified Chinese variables, a technique observed in AsyncRAT campaigns for obfuscation.
Detects attempts to bypass or disable the Antimalware Scan Interface (AMSI) in PowerShell sessions by monitoring for common indicators such as manual manipulation of AmsiUtils, AmsiScanBuffer, or reflection-based patching techniques. This activity is indicative of an adversary attempting to execute malicious code without security interference.
This rule detects attempts to unhook or tamper with Native APIs by monitoring 'WriteProcessMemory' calls targeting 'ntdll.dll'. This technique is often used by adversaries to evade EDR (Endpoint Detection and Response) solutions by disabling their API monitoring capabilities.
Correlates an MSI downloaded by a browser with silent msiexec execution on the same device within fifteen minutes. This rule detects potential malicious software installation initiated by a user downloading an MSI package via a web browser, followed by a silent execution of that package using msiexec.exe. This technique is often used by attackers to install malware without user interaction.
Detects modifications or publication of Azure Automation runbooks by users or service principals other than known, pre-approved automation service principals. This activity may indicate an unauthorized user or compromised service principal attempting to inject malicious code into automation workflows.
Detects file creation or process execution occurring from a folder named 'GentlemenCollection', the known staging directory for Gentlemen RaaS EDR killers prior to ransomware encryption.
Detects modification of an Azure storage account network rule set to allow public access, bypass trusted-service checks, or add broad network ranges. This could indicate an attacker attempting to gain broader access to sensitive data stored in Azure Storage.
Detects a new phone, authenticator application, FIDO key, or passkey registered after account recovery activity, which can establish attacker-controlled multifactor authentication.
Detects Device Code Flow authentication originating from abused Railway.com infrastructure, widely abused by Kali365.
Detects usage of bitsadmin downloading a file from a suspicious domain
Page 389 of 864