Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects removal of registered authentication methods shortly after a password reset, a sequence that can prevent the legitimate user from recovering the account. This rule specifically looks for successful 'Delete user authentication method' or 'Remove authentication method' operations in AuditLogs.
Detects rundll32 executing the unusual mcrypto.chiper or mcrypto_clean exports. The misspelled export naming is tied to the compromised DAEMON Tools post-installation stage, indicating potential malicious activity related to the DAEMON Tools backdoor.
Detects suspicious MpCmdRun.exe command line arguments or execution by unexpected parent processes.
Correlates the executing Matanbuchus DLL performing process hollowing or injection into legitimate Windows binaries (e.g., svchost.exe, dllhost.exe) to execute AstarionRAT. This rule specifically looks for 'rundll32.exe' as the initiating process, targeting 'svchost.exe', 'dllhost.exe', or 'WerFault.exe' as the child process, and where the command line of the child process does not contain typical command-line arguments (hyphens or slashes), which can be indicative of process hollowing where the legitimate binary is started without its usual parameters before being injected.
This rule detects a specific kill chain involving PowerShell executing ClickFix, followed by rundll32 loading Matanbuchus, and finally, an AstarionRAT executable running from the AppData folder. The detection logic links these events by device ID and within specific timeframes (5 minutes between ClickFix and Matanbuchus, and 10 minutes between Matanbuchus and AstarionRAT).
Detects the EDR Killer utility restoring or unhooking user-mode APIs in ntdll.dll (by reading a fresh copy from disk into memory) before it begins communicating with the vulnerable kernel driver. This is identified by a file access event on ntdll.dll in System32 folder, joined with an image load event for EEDbg.sys by the same initiating process.
Identifies the EDR killer utility actively tampering with the Windows Defender registry keys (DisableAntiSpyware, DisableRealtimeMonitoring) after kernel access is achieved. This rule specifically looks for modifications to the 'DisableAntiSpyware' or 'DisableRealtimeMonitoring' registry values under the Windows Defender policy key, setting them to '1' (enabled/disabled respectively), and correlates this with the loading of a '.sys' driver file by the same initiating process.
Detects command-line activity containing keywords associated with process injection or hollowing techniques (e.g., shellcode, inject, hollow, replace) when executed by common script interpreters targeting critical system processes.
Detects command line activity indicative of an attempt to access or extract browser-related files such as 'Cookies' or 'Local State', which are commonly associated with session theft or credential harvesting from major web browsers like Chrome, Firefox, Edge, and Safari.
This rule monitors process command line arguments for a combination of programming language interpreters (java, python, node, .NET, go) and keywords commonly associated with malware, payloads, shellcode, or injection techniques. This is intended to identify suspicious execution patterns that may indicate the staging or execution of malicious code.
Detects the execution of common web browsers (Chrome, Firefox, Edge) with command-line arguments designed to weaken browser security. These flags, such as --disable-blink-features or --disable-sync, are often utilized by adversaries to bypass browser security controls, facilitate sandbox escape attempts, or maintain a consistent environment for session hijacking and credential harvesting.
Detects the execution of common web browsers (Chrome, Firefox, Edge) with command-line arguments designed to weaken browser security. These flags, such as --disable-blink-features or --disable-sync, are often utilized by adversaries to bypass browser security controls, facilitate sandbox escape attempts, or maintain a consistent environment for session hijacking and credential harvesting.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
This rule detects the behavior of a temporary executable making a network connection and then deleting itself shortly afterwards. It specifically looks for file creation and deletion events of executables within temporary directories (e.g., \temp or \appdata\local\temp) where the context process is a command-line interpreter or another executable. The rule's logic is designed to identify specific malware structures like SessionGate, Remus, or AnimateClipper rather than generic executable names.
This rule detects scripts that load a driver and subsequently attempt to remove its associated service and source artifacts. It specifically looks for the presence of 'NtLoadDriver' API calls, 'sc delete' commands for service removal, 'reg delete' commands for registry cleanup, and references to specific filenames like 'fsdiskbit.sys' and 'msidiskserver', which are associated with the Sprysocks malware.
Identifies the creation or execution of a scheduled task named 'GoogleErrorReport', which is used by the threat group Dropping Elephant (also known as Patchwork or FIN13) to run their side-loading chain every minute. This rule detects both the command-line invocation of schtasks.exe to create or modify tasks and the Windows Security Event ID 4698 for scheduled task creation, specifically looking for the 'GoogleErrorReport' string.
This rule detects persistence mechanisms associated with the Turla STOCKSTAY backdoor. It monitors for the creation or modification of Registry Run keys, the execution of msiexec for suspicious MSI package installations (DiplomacyEduAI.msi, Copia.msi), and the presence of known STOCKSTAY component executables (e.g., MicrosoftUpdateOneDrive.exe, SMEditor.exe) in the %LOCALAPPDATA%/Programs/SMN/ directory.
Detects attempts to forcefully stop or disable the Windows Defender service (WinDefend) using either 'sc.exe stop WinDefend' or 'powershell.exe Stop-Service WinDefend' commands. This activity is indicative of an adversary attempting to impair defenses.
Detects suspicious command-line executions involving common Windows system binaries (rundll32.exe, mshta.exe, certutil.exe, wmic.exe) when they contain keywords indicative of network communication or data transfer (http, https, base64, /transfer). This pattern is often observed in malware or adversary techniques to download payloads, exfiltrate data, or execute remote code.
This rule detects the loading of specific DLLs associated with Remcos RAT (Optimax.dll, System Optimizer, SystemOptimizer) from temporary directories. This behavior is indicative of in-memory execution patterns often used by malware to evade detection.
Detects the MYRA RAT using the prctl system call to rename its process to 'systemd-userdbd'. This masquerading technique aims to evade detection by blending in with legitimate system processes on Linux endpoints. The rule monitors process execution events for instances of 'systemd-userdbd' that do not originate from authorized system directories.
Page 399 of 864