Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,654
12,601
8,412
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects execution and suspicious behavior associated with the SharkLoader malware, specifically monitoring the masquerading of SystemSettings.exe within user AppData or ProgramData paths. It identifies unauthorized cross-process activities, module loads of specific suspicious DLLs, and potential code injection techniques typical of shellcode staging, such as those used by Cobalt Strike Beacon.
Detects potential PPID spoofing and process injection activity associated with SharkLoader and Cobalt Strike. The rule monitors for cross-process injection into critical system processes or shell spawning from suspicious directories (AppData/Roaming or ProgramData/KasperskyLab), typically used by SharkLoader to stage payloads or perform parent process spoofing.
Detects anomalous activity associated with the SharkLoader malware, which masquerades as the legitimate Windows SystemSettings.exe process. The rule identifies suspicious characteristics such as execution from non-standard directories (AppData), use of MinHook for API hooking, loading of known payload-related files (syncres.dat, dsccorer.mui), and unauthorized remote thread creation.
Detects file creation and execution patterns associated with SharkLoader malware. The rule monitors for the staging of malicious DLLs, encrypted beacon payloads, and API hooks in specific AppData subdirectories ('xwreg' and 'xgdf'), as well as the execution of 'SystemSettings.exe' from non-standard locations, which mimics legitimate Windows system processes to achieve persistence and evasion.
Detects the loading of suspicious DLLs and support files (e.g., systemsettings.dll, dsccorer.mui, syncres.dat, msedge.dll) from atypical AppData subdirectories ('xwreg' or 'xgdf'). The rule correlates these file loads with known MD5 hashes associated with Sharkloader, indicating potential malicious payload execution or side-loading activities.
This rule detects modifications to Windows Registry Run keys that point to suspicious directories associated with the SharkLoader malware (such as 'xwreg' or 'xgdf' subdirectories in AppData) or an abnormally located SystemSettings.exe executable, both of which are common indicators of persistence attempts.
This rule detects potentially malicious behavior where a PDF reader or command-line utility (executing a PDF) spawns msiexec.exe shortly after, when the parent process is running from a suspicious directory (e.g., AppData, ProgramData, or other temp locations). This pattern is commonly associated with dropper activity where a malicious PDF is opened and subsequently triggers an MSI installer to deploy malware.
This rule detects potentially malicious usage of msiexec.exe. It monitors for two primary suspicious behaviors: 1) msiexec.exe spawning common command-line or scripting interpreters such as cmd.exe, powershell.exe, or mshta.exe, which often indicates lateral movement or execution of malicious payloads; and 2) msiexec.exe executing an installation process with silent or quiet command-line flags, which may be used to hide malicious software installation from the user.
Detects the loading of DLLs from suspicious locations such as AppData, Temp, or ProgramData into common browser processes. This activity is often associated with process injection techniques like Cobalt Strike's keylogging jobs or other credential theft attempts.
Detects instances where suspicious, non-Windows-standard processes (residing outside of System32 or SysWOW64) spawn or interact with critical system processes like svchost.exe or explorer.exe. This activity is indicative of process injection techniques used by malware loaders, such as SharkLoader, to execute malicious code within the context of trusted system processes to maintain persistence or elevate privileges.
The detection monitors for the loading of specific files ('SyncRes.dat' or 'DscCoreR.mui') that are known to be used as side-loading targets for malicious DLLs. These file names are frequently associated with various malware campaigns leveraging DLL search order hijacking to execute malicious code within the context of trusted applications.
Detects anomalous file activity and process execution associated with the SharkLoader malware family. The rule looks for the loading of specific component files (DscCoreR.mui, SyncRes.dat, SystemSettings.dll) from suspicious directories, as well as the execution of SystemSettings.exe from non-standard AppData or ProgramData paths, which indicates a beacon injection or execution chain.
Detects instances where the legitimate Windows process SystemSettings.exe loads specific DLL files (SyncRes.dat, SystemSettings.dll, or DscCoreR.mui). While these files have benign names, the context of monitoring for their loading by SystemSettings.exe is often used to detect potential DLL hijacking or sideloading attempts where an attacker replaces legitimate system DLLs with malicious ones to achieve code execution.
Detects the Windows Update Service (wusvc.exe) loading advapi32.dll or performing suspicious API calls like GetProcAddress to resolve GetUserNameA. This behavior is atypical for the legitimate Windows Update service and may indicate process injection, credential harvesting, or tampering attempts.
Detects the execution of wusvc.exe (Windows Update Service) from suspicious file paths or when associated with user, host, or directory names containing keywords like 'sandbox', 'malware', 'virus', or 'sample'. This behavior is indicative of potential masquerading or the analysis of malicious samples.
This rule detects sequences of suspicious administrative commands often used by attackers to gain control over files or clear system artifacts. It monitors the combined use of 'takeown.exe' to change file ownership, 'icacls.exe' to modify file permissions, and 'cmd.exe' to perform mass file deletions, particularly targeting sensitive system directories like System32 or SysWOW64.
Detects the use of built-in Windows utilities (icacls.exe, cacls.exe, attrib.exe) to modify file permissions (granting or denying access) or file attributes (hidden/system) on sensitive Windows directories or specific suspicious filenames often associated with malicious activity.
Detects modifications to the 'Run' registry key that include suspicious command-line arguments often used by malware for persistence and evasion. Specifically looks for '-ExecutionPolicy Bypass', '-WindowStyle Hidden', or references to 'AppData\Local\Temp' in the registry data.
This rule detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook, Publisher, Access, OneNote) spawn scripting or command interpreter processes such as PowerShell, WScript, CScript, Mshta, Regsvr32, or Cmd.exe. This behavior is often indicative of malicious activity, such as macro-enabled malware executing payloads or exploiting vulnerabilities.
Detects the creation of files with specific filenames (e.g. SystemSettings.dll, DscCoreR.mui, SyncRes.dat) within anomalous AppData subdirectories 'xwreg' or 'xgdf', followed by the execution of a process from those same directories within a 5-minute window. This behavior is indicative of SharkLoader malware staging its components and initiating execution.
Detects potential Cobalt Strike Beacon behavior where a process originating from AppData or ProgramData injects into a legitimate Windows process (e.g., svchost.exe, explorer.exe, notepad.exe, msiexec.exe). This is followed by the injected host process establishing an outbound HTTPS network connection to an external, non-RFC1918 IP address within 60 seconds.
Page 394 of 864