Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects LCRYX ransomware modifying registry keys to impair analyst interaction. It specifically monitors for the creation of the Scancode Map registry key, used to disable keyboard input, and the modification of the SwapMouseButtons registry key, used to invert mouse button functionality.
Detects LCRYX ransomware establishing persistence by modifying the Winlogon Shell registry key and creating multiple VBScript-based entries in Windows Run keys. The rule monitors for registry modifications targeting known persistence locations with suspicious scripts as values.
Detects unauthorized modification of Windows Registry keys intended to disable core administrative tools, including Task Manager, Registry Editor, Command Prompt/Run dialogs, and the Control Panel. Additionally, it identifies the creation of 'DisallowRun' entries used to block security and remediation utilities like Process Explorer, Autoruns, and System Configuration tools.
Detects LCRYX ransomware activity where PowerShell is used to write data from a specified file (gcrybground.png) directly to the physical disk (PhysicalDrive), intending to overwrite the Master Boot Record (MBR) and render the system unbootable. It also monitors for subsequent attempts to disable Windows system recovery via bcdedit.
Detects mshta executing a remote HTA, JavaScript, or HTML resource from a browser-driven installation chain. This rule specifically looks for mshta.exe being executed with a command line containing a URL (http/https) or script protocol (javascript/vbscript) followed by file extensions or keywords commonly associated with malicious scripts or payloads (.hta, .js, .html, payload, install).
Detects modifications to Windows Registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or Command Prompt. These modifications are commonly performed by scripts (wscript.exe, cscript.exe) used by malware or malicious actors to restrict user access to system administration and diagnostic tools.
Detects the use of the 'icacls.exe' utility to remove permissions (specifically group permissions via '/remove:g') from files or directories containing 'MspPlatform' and 'archives' in the path. This pattern is often associated with unauthorized attempts to modify file access controls to bypass security restrictions or hide data.
Detects Hannibal Stealer-related process injection patterns involving the use of legitimate Windows binaries (sppextcomobj.exe, slui.exe) spawned by rundll32.exe, or specific child-process relationships, correlated with directory paths associated with CefSharp.BrowsersSubprocess or SCef.WindowsAdapter, which are indicative of malware staging.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
This rule detects potential registry enumeration activities targeting sensitive Windows system keys ('HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion' or 'HKLM\HARDWARE\DESCRIPTION') that are associated with the execution of suspicious processes named 'systemki.exe' or 'sysklnd.exe'. These filenames are consistent with historical observations of the Sauron (also known as Strider) malware framework.
Detects the execution of JSE files by wscript.exe or cscript.exe followed by the immediate self-deletion of the file from the Downloads folder, a behavior commonly observed in Kimsuky dropper activity.
This rule detects modifications to specific Windows Registry keys used for keyboard layout remapping ('Scancode Map') or mouse button swapping ('SwapMouseButtons'). Such modifications can be used by adversaries to facilitate keylogging, persistent input redirection, or to impair user interaction. The rule prioritizes alerts where the change was initiated by script engines like wscript.exe or cscript.exe, which are common vectors for VBScript-based malware.
Detects modifications to Windows registry keys that control system policies, such as disabling the Task Manager, Registry Tools, or suppressing UAC prompts, when performed by scripting engines like wscript.exe or cscript.exe. This activity is often associated with malware or adversarial post-exploitation efforts to impair defensive capabilities and maintain persistence.
Detects the use of the 'icacls.exe' utility to remove permissions (specifically the 'Everyone' group 'S-1-1-0') from directories related to 'MspPlatform', 'PME', and 'archives'. This behavior is characteristic of an attempt to prevent access to specific files or directories, potentially to hide malicious activities or hinder security analysis.
Detects LCRYX ransomware behavior characterized by the disabling of Windows Defender real-time monitoring followed by an attempt to overwrite the Master Boot Record (MBR) on PhysicalDrive0 using PowerShell. The rule monitors for PowerShell processes spawned by wscript.exe or cscript.exe that reference disk drive objects or specific LCRYX image files, and correlates them with Defender tampering activities.
Detects the execution of Node.js silently using 'conhost --headless', a technique used by EtherRAT and other malware to run malicious JavaScript payloads without displaying a console window to the user.
Detects Self-Service Password Reset (SSPR) activity followed by the deletion of authentication methods within a 1-hour window. This sequence of events can indicate an attacker attempting to maintain access or bypass multi-factor authentication after gaining initial access to an account, potentially executed by threat groups like Storm-2949.
This rule correlates commands indicative of privilege escalation (checking local administrator groups or user privileges) with subsequent manipulation of Quality of Service (QoS) policies via WMI. This sequence of events suggests an attacker gaining elevated privileges and then attempting to throttle network traffic, potentially to hinder EDR/security tool communication or data exfiltration.
Identifies logins from geographically distant locations occurring faster than physically possible, highlighting proxy infrastructure. This KQL query analyzes Google Workspace login success events, grouping them by account and a 10-minute time window. It then filters for instances where an account has successfully logged in from two or more distinct locations within that short timeframe, indicating potential impossible travel.
Identifies rundll32.exe executing dfshim.dll,ShArpMaintain silently to uninstall or modify ClickOnce applications from the command line. This activity can be abused by attackers to install, persist, and update malware without administrative privileges.
Detects highly obfuscated VBScript execution utilizing specific array splitting and character decoding loops used by GammaDrop. The rule specifically looks for the combination of 'Split' and 'ChrW' functions within VBScript command execution, which is indicative of a common obfuscation technique used by the Gamaredon APT group.
Page 397 of 864