Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,654
12,601
8,412
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Identifies Kazuar querying specific CPU or BIOS registry keys (VMware, VBox) to halt execution if it detects an analysis environment. This rule specifically looks for registry access to 'HARDWARE\DESCRIPTION\System\BIOS' combined with a process executing 'wmic bios get' on the command line.
Detects the execution of newly seen binaries containing valid Digital Signatures from issuers identified in Fox Tempest's malware signing service. This rule specifically looks for process creation events where the binary has a valid digital signature and a global prevalence of less than 50, and then joins these events with network connection events from the same device, indicating execution and beaconing activity.
Detects the execution of binaries where the digital certificate has been explicitly revoked or timestamped after revocation.
Detects the usage of Fox Tempest certificates to sign and load malicious .sys drivers into the Windows kernel space to blind EDR. The rule specifically looks for signed .sys files being loaded from temporary or downloads folders.
Correlates the malware attempting to permanently disable macOS system-wide Gatekeeper functionality (spctl --master-disable).
Detects AutoIt3.exe allocating memory with read, write, and execute (RWX) permissions into another process's space, which is indicative of a payload injection phase, specifically associated with the Vidar stealer loader.
Detects the execution of base64 decoded payloads in memory by interpreted languages such as Python or Node.js. This rule specifically looks for command-line arguments indicating base64 decoding or zlib decompression operations.
This rule detects malicious VBScript patterns, including Base64 decoding, file operations, and PowerShell execution. It looks for specific VBScript functions and object creations like `CreateObject("MSXML2.DOMDocument.3.0")`, `CreateObject("Scripting.FileSystemObject")`, and `CreateObject("Wscript.Shell")`, as well as patterns related to Base64 decoding. Additionally, it identifies common malicious PowerShell usage through keywords such as `powershell.exe -nop`, `-encodedcommand`, `Invoke-Expression`, `DownloadString`, and various execution policy bypasses or obfuscation techniques. The rule also includes patterns for VBScript window manipulation and script language declarations.
This rule detects JavaScript code within web traffic (proxy, web, or sandbox logs) that indicates attempts to block developer tools, prevent debugging, or detect automation drivers. Specifically, it looks for keywords and patterns associated with context-menu blocking, debugger statements, checks for browser window dimensions (often used to detect minimized or non-interactive browser windows), and the presence of automation-related strings like 'navigator.webdriver', 'selenium', or 'playwright'. This behavior is often observed in adversary-in-the-middle (AitM) phishing pages, such as those used by the Tycoon threat group, to hinder analysis and prevent automated detection.
Detects commands modifying the fDenyTSConnections registry key to forcefully enable Remote Desktop Services on the victim host using 'reg.exe'.
Identifies instances where a browser process is spawned directly with a Base64-encoded data: URI in its command line. This technique is used to load malicious HTML content without touching the disk or network, often associated with phishing attempts.
Detects the loader deliberately dropping marker files when it identifies an analysis environment. This rule specifically looks for the creation of files named "vm.txt", "Debugger.txt", or "01_detect_analisse_process.txt", which are known indicators of malware attempting to detect virtualized or debugging environments.
Correlates the download of a payload using 'curl' to the /tmp/ directory with an immediate 'chmod +x' command on a file in the /tmp/ directory, making it executable. This sequence of events is indicative of preparing a downloaded script or binary for execution, often seen in the initial stages of infostealer attacks on macOS.
Detects suspicious execution patterns involving SystemSettings.exe, specifically when spawned by uncommon binaries (xwreg.exe or xgdf.exe) or when performing thread creation operations, which may indicate process injection or suspicious lateral movement attempts.
Detects instances where the process SystemSettings.exe is executed from locations other than its legitimate path (Windows\ImmersiveControlPanel). This often indicates an attacker masquerading as a system utility to evade detection.
Detects the loading of specific suspicious library files (SyncRes.dat, SystemSettings.dll, DscCoreR.mui) from the AppData Roaming directory subfolders 'xwreg' or 'xgdf'. This activity is often associated with file masquerading or persistence techniques where malicious code is executed under the guise of legitimate-sounding system files.
This rule detects processes accessing or loading specific files (such as .mui, .dat, .nls, and .etl files) that are associated with specific naming conventions (xwreg, xgdf) or locations often targeted by malicious DLL search order hijacking or masquerading attempts. By identifying files that mimic or occupy paths related to system resources, the rule aims to uncover activity indicative of persistence or evasion techniques.
This rule detects when 'SystemSettings.dll' is loaded by a process other than the legitimate 'SystemSettings.exe' located in the Windows ImmersiveControlPanel directory. This behavior can be indicative of DLL hijacking or unauthorized code injection into a system-level component.
Detects various indicators of SharkLoader activity, including the deployment of decoy MSI files, execution of suspicious masqueraded processes, use of double-extension files, and the creation of malicious DLL components in specific AppData subdirectories.
Detects the use of SharpGPOAbuse or common command-line arguments associated with GPO manipulation, such as creating immediate tasks or modifying domain object ACLs. Additionally, it monitors for suspicious execution of gpupdate.exe with the /force flag, specifically when initiated by unauthorized processes or non-Microsoft signed binaries.
Detects techniques used to extract the Active Directory database (NTDS.dit) for credential dumping. This includes the use of native Windows utilities like ntdsutil.exe, vssadmin.exe, and diskshadow.exe to create volume shadow copies, as well as the identification of ntds.dit files being created or accessed in non-standard locations.
Page 393 of 864