Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the execution of common security analysis, reverse engineering, and debugging tools such as Process Hacker, IDA Pro, Wireshark, and various debuggers. While these tools are legitimate for development and troubleshooting, their presence in unexpected contexts may indicate reconnaissance or analysis activities by an adversary.
Detects the execution of wusvc.exe (Windows Update service) from non-standard locations, specifically the user Downloads folder or locations other than the authorized C:\Windows\System32\ directory. This pattern is commonly used to masquerade malicious payloads as legitimate system services.
Detects modifications to the Winlogon Shell or Userinit registry keys. These keys define the processes that run upon user logon. Adversaries modify these values to achieve persistence by pointing them to malicious binaries or scripts, often identified in this rule by the string 'win_guard_'.
Detects the loading of amsi.dll into a process, excluding common trusted security processes. This behavior is often indicative of an attempt to interact with or bypass the Antimalware Scan Interface (AMSI) by non-security software, which can be a precursor to executing obfuscated scripts or malicious code.
This rule detects suspicious activity involving the loading of amsi.dll in conjunction with memory protection changes (VirtualProtectApiCall) that often signify an attempt to patch or disable the Antimalware Scan Interface (AMSI) in memory. It specifically monitors for remote thread creation, memory protection modifications involving 'AmsiScanBuffer', and executable memory page allocation within 30 seconds of loading amsi.dll, excluding known trusted Microsoft processes.
Detects the use of icacls.exe and takeown.exe to recursively modify file permissions, specifically targeting broad filesystem paths or system-critical binaries. This behavior is indicative of ransomware preparing for encryption by taking ownership and modifying ACLs to ensure access to protected files.
Detects unauthorized deletion, renaming, or movement of system command-line utilities (cmd.exe) located in System32 or SysWOW64, correlated with the use of standard Windows tools to delete Volume Shadow Copies. This behavior is indicative of ransomware preparation to inhibit system recovery and interfere with standard administration tasks.
Detects scenarios where 7-Zip (7z.exe or 7zG.exe) extracts an executable file to a user-writable directory (such as Downloads, Temp, or AppData), potentially stripping the Mark-of-the-Web (MOTW) identifier. The rule specifically tracks instances where such an extracted file is subsequently launched by the shell or Windows explorer within 5 minutes of extraction.
Detects instances where suspicious processes load the amsi.dll module, which is a common precursor to performing in-memory patching of the AmsiScanBuffer function. This behavior is indicative of an attempt to disable Anti-Malware Scan Interface (AMSI) to evade security scanning, specifically observed in techniques like the SNOWLIGHT dropper.
Detects unauthorized User Account Control (UAC) bypass attempts involving the SNOWLIGHT dropper (UNC5221). The rule identifies child processes running at High or System integrity levels that were spawned by a Medium integrity parent process. It specifically triggers when the child binary contains a 'requireAdministrator' manifest, suggesting silent elevation without a user prompt, and exhibits process token impersonation capabilities.
Detects the unauthorized deletion of cmd.exe from System32 or SysWOW64 by a non-system process, correlated with the creation of a new service or scheduled task on the same host within 60 seconds, which is characteristic of TrymeLocker malware persistence and tampering.
Detects the execution of cmd.exe or powershell.exe where the command line contains references to the Avast directory. This behavior may indicate an attempt to tamper with, interact with, or bypass security software components.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using a combination of arguments and commands commonly associated with script obfuscation or file-less execution patterns. This includes the use of ReadAllText for file reading, environment variable manipulation, and common execution aliases (iex/Invoke-Expression) combined with the -nop (NoProfile) flag.
Vidar In Memory Assembly
YARA-L
Identifies PowerShell dynamically converting the extracted Base64 string into bytes and loading it directly into memory.
Identifies PowerShell dynamically converting a Base64 string into bytes and loading it directly into memory, a technique often used by malware like Vidar for reflective code loading.
Detects modifications to the memory protection flags of the ntdll.dll library to PAGE_READWRITE (0x04). This behavior is commonly associated with shellcode injection, hooking, or patching of core system libraries to facilitate malicious activity or evasion.
Detects the GT_NET or Gt_net executable calling the VirtualProtectEx API to modify memory permissions to PAGE_EXECUTE_READWRITE. This behavior is a common indicator of process injection, where an attacker modifies memory to execute shellcode or malicious payloads within the context of a legitimate process.
Detects the use of legitimate Windows utilities 'timeout.exe' and 'ping.exe' to introduce delays in command execution. This behavior is often associated with malware or malicious scripts attempting to evade sandboxes or time-based security analysis.
Detects suspicious combinations of API calls and system monitoring often used by the VILE ransomware family to evade debuggers, sandboxes, and automated analysis environments. This includes detecting the registration of Vectored Exception Handlers (VEH), memory checks for debugging artifacts, reading the Process Environment Block (PEB), and monitoring for file restoration activities via ReadDirectoryChangesW.
Detects indicators of VILE ransomware activity, specifically identifying attempts to suppress Event Tracing for Windows (ETW) via NtTraceEvent patching, alongside execution of low-level NT syscalls and the presence of identified VILE-associated artifact files (e.g., .ico, .zip, .json).
Detects PyInstaller unpacking dropping highly randomized compiled Python bytecode (.pyc) indicative of hidden malware loaders.
Page 395 of 864