Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the creation of suspicious child processes (PowerShell, Command Prompt, WScript, CScript, or Rundll32) originating from ManageEngine applications. This behavior could indicate an adversary leveraging a compromised ManageEngine service to execute malicious scripts or commands, potentially as part of a phishing attack or other compromise.
Detects the execution of VBScript (wscript.exe or cscript.exe) with a command line containing common obfuscation techniques such as 'chr(', 'asc(', 'Replace(', 'Split(', 'Join(', or 'char_code_at', and a command line length greater than 500 characters. This pattern is often used in phishing campaigns to hide malicious code.
This rule detects the execution of 'eventviewer.exe' by scripting engines such as 'wscript.exe', 'cscript.exe', or 'vbscript.exe'. This behavior is indicative of a User Account Control (UAC) bypass technique where 'eventviewer.exe' is abused to elevate privileges without user interaction.
Detects regsvr32 with silent, unregister, or scriptlet options referencing a remote or user-writable resource. This behavior is often associated with malware like InstallFix to execute malicious code.
Detects PowerShell, mshta, or curl writing an executable, DLL, or script beneath a hidden-looking AppData directory. This behavior is often associated with malware staging or persistence.
Detects rundll32 loading a DLL from common user-writable directories (Downloads, Temp, AppData, or ProgramData) which is a known technique used by malware like InstallFix to execute newly downloaded stages.
Detects Python deleting runtime scripts, compiled modules, screenshots, and credential archives from temporary or profile paths. This rule specifically looks for file deletion or creation events where the target file matches common Python script/module extensions (.py, .pyc, .pyd, .so) or archive/image extensions (.zip, .7z, .png, .jpg) within temporary or user profile directories, and the process responsible is identified as Python.
Detects the creation of a new LNK file in a user's Startup folder that references PowerShell, mshta, or rundll32, indicating a potential persistence mechanism. This rule specifically looks for file creation events where the target file is a .lnk file within the 'Start Menu\Programs\Startup' path and the command line of the creating process contains 'powershell', 'pwsh', 'cmd', 'wscript', or 'mshta'.
This rule monitors process events for the combined usage of multiple Windows security APIs associated with access token manipulation. Specifically, it flags processes that call two or more of the following functions: AdjustTokenPrivileges, LookupPrivilegeValueW, SetTokenInformation, OpenProcessToken, DuplicateTokenEx, or GetTokenInformation. This behavior is indicative of token stealing or impersonation attempts, often used by malware such as Vile Ransomware to escalate privileges or bypass security controls. The rule also includes heuristic filtering for common system processes.
Detects execution of timeout.exe or ping.exe with specific command-line arguments often used by Pay2Key ransomware to implement time-delay mechanisms for sandbox and analysis evasion.
Detects execution of cmd.exe with specific command-line arguments consistent with the Pay2Key ransomware SFX dropper cleanup routine. The pattern involves using ping for a loopback wait followed by fsutil or specific del commands to delete the dropper executable.
This rule detects the registration of a Vectored Exception Handler (VEH) by specific process names (gt_net.exe, grixba) or processes running from suspicious paths (e.g., C:\Users\Public\Music). This behavior is associated with the Grixba component of Play ransomware, which uses VEH for anti-debugging and execution hijacking.
This rule detects potentially malicious activity associated with process injection, specifically identifying memory regions allocated as Read-Write-Execute (RWX) or the loading of sensitive DLLs (amsi.dll, wldp.dll) from unbacked memory regions, which is a common indicator of process injection or shellcode execution.
This rule detects indicators of the Grixba v2/v3 ransomware group, specifically identifying the presence and execution of sideloaded XOR-encrypted payloads (inf_g.dll) and the utilization of specific reconnaissance file staging paths within C:\Users\Public\Music\, including the identification of malicious binaries masquerading as gt_net.exe.
This rule detects two indicators associated with ransomware activity: the modification of the 'legalnoticetext' registry value, which is often used to display ransom notes on the Windows login screen, and the execution of Notepad to open a file named 'HowToRestoreFiles.txt', a common indicator of a ransom note left by ransomware operators.
This rule detects an unusually high volume of operations related to GitHub Enterprise repositories, such as adding users, creating teams, pushing to repositories, or changing permissions, within a short timeframe. This could indicate a compromised account or automated malicious activity targeting source code repositories.
Identifies the fake VPN installer executing process hollowing, spawning suspended legitimate .NET binaries (RegAsm.exe, InstallUtil.exe) to inject the Vidar or Lumma stealer payload.
Detects the execution of Python or Node.js processes that include command-line arguments indicative of base64 decoding or zlib decompression, often used for deobfuscating and executing malicious payloads in memory.
Detects the execution of .bat or .cmd scripts disguised as VPN installer components utilizing curl or wget to pull down malware.
Detects attempts to load the 'mscoree.dll' library by processes like PowerShell, setup, or main executables. This activity can indicate an in-memory .NET assembly load, often used by adversaries for stealthy execution (T1620).
Detects memory allocation anomalies where VirtualAllocEx is used with PAGE_EXECUTE_READWRITE protection by common scripting engines such as Python, Node.js, WScript, CScript, PowerShell, and AutoHotkey. This behavior can be indicative of process injection or other malicious memory manipulation techniques.
Page 402 of 864