Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the use of 7za.exe, executed from temporary 7ZipSfx directories, to extract encrypted data (data2.bin) into the Avast Software directory. This activity is indicative of the Pay2Key ransomware attempting to perform DLL sideloading by dropping a malicious DLL, such as powrprof.dll, into a legitimate application folder to hijack execution flow.
Detects execution of PowerShell commands used by VILE ransomware to create shortcut (.lnk) files and icons on the victim's desktop, utilizing WScript.Shell via a non-interactive PowerShell session.
Detects a registry modification where Pay2Key ransomware sets the 'shutdownwithoutlogon' value to 0 under 'HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System'. This action disables the shutdown option in the Windows Start menu, a tactic used by the ransomware to maintain access to the infected system and ensure encryption processes are not interrupted by a reboot.
Detects the use of PowerShell to execute the 'Suspend-BitLocker' cmdlet, potentially bypassing BitLocker protection to prepare for file encryption, a behavior associated with the Pay2Key ransomware.
Detects potential SNOWLIGHT dropper behavior where a process associated with Windows Update (wusvc.exe) is observed alongside environment naming conventions indicative of analysis sandboxes (e.g., 'malware', 'sandbox', 'virus', 'sample'). This combination of process naming and environment characterization suggests evasion or anti-analysis techniques typical of malware droppers.
Detects the loading of amsi.dll by a non-Microsoft signed process. This behavior is indicative of processes attempting to hook or patch AMSI (Antimalware Scan Interface) functions in memory to evade detection, a technique commonly used by malware droppers to neutralize security scanning.
Detects potential persistence attempts by the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update service (wusvc). The rule monitors for unauthorized execution of wusvc.exe, the use of sc.exe to register a wusvc service, and direct modification of registry keys associated with the wusvc service path.
Detects network connection activity originating from the Windows Update service process (wusvc.exe) to a known C2 IP address (38.60.253.35) on port 8084. This pattern is indicative of VSHELL RAT communication, potentially using masquerading to hide its network activity.
Detects the specific behavior associated with the TrymeLocker malware DestroyCMD function, which involves stripping file permissions from cmd.exe using takeown and icacls, followed by the deletion or renaming of cmd.exe within the System32 or SysWOW64 directories to disable command execution.
Detects evidence of TrymeLocker or similar ransomware behavior by identifying the simultaneous use of Windows utilities (icacls, cacls, takeown, attrib) to modify permissions on critical system directories or obscure executables, correlated with the deletion of volume shadow copies or disabling of system recovery features.
Correlates the creation and immediate deletion of the 'trin.tar.gz' archive, which is handled by the Python temporary-directory context manager, indicating potential malicious activity associated with TeamPCP.
Detects PowerShell spawning csc.exe to dynamically compile the custom launcher (uds.exe) natively on the host.
This rule detects PowerShell activity attempting to drop specific files associated with VILE ransomware, including 'vile_Decryptor.lnk' onto the desktop and 'vile_icon.ico' into the temporary directory, using the -NoProfile flag to bypass profile script execution.
Detects token manipulation activity indicative of VILE ransomware attempting privilege escalation. The rule monitors for the usage of Windows token-related APIs such as AdjustTokenPrivileges, LookupPrivilegeValueW, DuplicateTokenEx, and SetTokenInformation, which are commonly used by malicious actors to elevate their security context.
Detects the Pay2Key ransomware dropper's attempt to obfuscate its presence by using 'fsutil setZeroData' to wipe its own binary content followed by the deletion of associated executable and batch cleanup scripts to hinder forensic investigation.
Detects modifications to the Windows Registry's Image File Execution Options (IFEO) to inject a debugger for 'agntsvc.exe'. This technique is used by Pay2Key ransomware to hijack and suppress backup agent services, preventing them from functioning during the encryption process.
Detects OpenVPN Connect applying a server-controlled PAC AutoConfigURL to HKCU Internet Settings, potentially enabling proxy interception of user traffic. This is achieved when a malicious VPN server pushes a dhcp-option PROXY_AUTO_CONFIG_URL, causing the OpenVPN system-level agent to write the attacker-controlled URL to the user's registry hive.
Detects HTTP POST requests to MyBB Admin Control Panel modules restricted to superadministrators (e.g., user management, group configuration, settings) initiated by non-privileged accounts. This activity is consistent with privilege escalation exploitation patterns where internal authorization checks might be bypassed.
This rule detects the execution of processes containing the string "zuidrt" or the execution of 'mshta.exe', followed by a network connection to the known XenoRAT C2 IP address 185.235.137.106. This correlation aims to identify XenoRAT payload execution and subsequent communication with its command and control server, as observed in Operation XENOFISCAL.
Detects a process creating both the PyArmor runtime module and Python 3.11 runtime library in user-writable locations. The component pairing is consistent with execution staging for the PyInstaller-packaged, PyArmor-protected VVS sample.
Detects inbound invoice-themed phishing emails where the sender domain authentication (SPF/DKIM) fails, combined with healthcare-related display name impersonation. The rule specifically targets the abuse of aged, high-reputation domains used as a vector to bypass standard reputation-based email filtering while masquerading as healthcare organizations.
Page 396 of 864