Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of executables with specific names ("WinHealth.exe", "WindowsSecurity.exe") known to be dropped by the SonicCrypt crypter. The execution is often initiated by the Task Scheduler, resulting in a parent process of 'taskhostw.exe'.
This rule detects suspicious process command lines that indicate the extraction of steganographically hidden payloads, potentially associated with the Remcos RAT. It specifically looks for processes with 'GST' in their name or initiating process file name, combined with keywords related to bitmap or image resource manipulation in the command line.
This rule detects the execution of a social engineered installer followed by the spawning of hollowed binaries. It correlates the execution of executables with names matching common AI tools or generic setup files (e.g., deepseek, gpt, kimi, fraudgpt, ProFluxeFlowAi, setup) with the subsequent execution of .NET utility tools (InstallUtil.exe, RegAsm.exe, MSBuild.exe) that are often abused for process hollowing, especially when their command line does not contain a hyphen, indicating non-standard usage.
This rule detects a suspicious sequence of events: first, a modification to the 'ExtensionInstallForcelist' registry key, followed within one hour by access to browser credential stores (specifically 'Login Data' or 'Cookies' files). This combination suggests an attacker might be attempting to force the installation of a malicious browser extension to steal credentials.
Detects broad hollowing logic involving injected Microsoft utilities (InstallUtil.exe, RegAsm.exe, RegSvcs.exe, aspnet_compiler.exe, MSBuild.exe) communicating over non-standard web command and control ports (8443, 5443, 8041). This rule specifically excludes common initiating processes like cmd.exe, powershell.exe, explorer.exe, and svchost.exe to reduce noise.
This rule detects a specific DLL sideloading sequence associated with the 'Screening Serpens' threat actor. It correlates the loading of 'uevmonitor.dll' with the subsequent dropping of 'unbcl.dll' by the same initiating process within a 5-minute window. This behavior is indicative of the MiniJunk V2 malware's execution chain, where 'uevmonitor.dll' is likely the legitimate application being hijacked to load the malicious 'unbcl.dll'.
This rule detects the creation of Okta API tokens with broad administrative scopes (okta.users.manage, okta.factors.manage, or okta.apps.manage) by the same user multiple times within a one-hour window. This behavior can indicate an attempt to establish persistent access or bypass multi-factor authentication.
Detects silent MSI installations that drop specific DLLs (autorun.dll or vcredist_x64.dll) and subsequently spawn a ScreenConnect client service within a 5-minute window. This behavior is indicative of potential persistence or remote access tool deployment.
Identifies the specific Start-Process -Verb RunAs pattern invoked by the underlying dropping mechanism, specifically looking for PowerShell executing this command in conjunction with a cmd.exe process running 'vvvv.cmd'. This pattern is associated with the UnregStealer malware for privilege escalation.
Detects command-line activity indicative of timestomping, specifically when 'cmd.exe' is used with file copy/move commands ('copy', 'xcopy', 'robocopy', 'move') and the target path is not within 'Program Files' or 'Windows' directories. This behavior is often associated with ransomware like Prinz Eugen attempting to hide its activities.
Detects Pass-the-Ticket attacks using stolen Kerberos tickets
Detects a process launching from the USOShared or firefx public folders and subsequently modifying the registry. This activity is associated with the Operation XENOFISCAL campaign, which has been observed deploying the Xenorat RAT.
This rule detects when VBScript (wscript.exe or cscript.exe) attempts to modify critical system policies in the Windows Registry, specifically those related to 'Policies\System', 'Policies\Windows', or 'UserAccessControl'. This activity can indicate an attempt to alter system behavior, disable security features, or bypass User Account Control (UAC).
Detects the execution of 'cmd.exe' with a command line that includes 'ping 127.0.0.1' combined with a file deletion command ('del', 'delete', 'erase'). This pattern is often used by malware, such as ransomware, to introduce a delay before self-deletion or to ensure network connectivity before performing destructive actions, followed by an attempt to remove its traces.
Detects the unique hardcoded mutex created by the Dropping Elephant in-memory RAT to prevent duplicate infections. This rule specifically looks for the mutex string 'kshdkfhskdfjkhsdkfhsjkdfhkj' during global object or mutex creation events.
Detects the mounting of an ISO image via PowerShell using the Mount-DiskImage cmdlet. This behavior has been observed as a required preparation step for the RoguePlanet Windows Defender Local Privilege Escalation (LPE) proof-of-concept, which abuses Windows Defender behavior to elevate privileges from a standard user context to SYSTEM on fully patched Windows 10 and Windows 11 systems.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
Detects the execution of known Windows privilege escalation tools commonly used in post-exploitation scenarios, such as JuicyPotato, PrintSpoofer, and other 'Potato' variants, by monitoring for process file names associated with these utilities.
Detects registry modifications to SyncRootManager occurring alongside cldflt.sys activity, which may indicate manipulation of cloud synchronization roots.
Detects BPFDoor-style iptables NAT REDIRECT rules used to tunnel traffic from a
legitimate service port (e.g. 22/tcp) to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
legitimate service port (e.g. 22/tcp) to a high ephemeral shell port (42391-43390) without
disrupting the real service for other clients. BPFDoor activates on magic packets, spawns a
bind shell, inserts short-lived PREROUTING redirects for the controller IP, then deletes them.
Detects LSASS credential dumping using comsvcs.dll via rundll32, specifically looking for the ordinal 24 or the string "MiniDump" in the command line. This technique is commonly used by attackers for credential harvesting, especially after bypassing EDR solutions.
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
Page 401 of 864