Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Parses PowerShell command lines to identify scripts extracting PGP private key blocks from arbitrary files to decode nested stagers.
Detects a suspicious command line pattern where the Windows command shell (cmd.exe) is utilized to trigger a time-delayed deletion of the process image PerfWatson2.exe. This behavior is indicative of an attempt to remove indicators of compromise or cleanup malicious artifacts after execution.
This rule detects the execution of processes associated with VMware or suspicious files mimicking legitimate VMware components, particularly when spawned from web servers (w3wp.exe) or command-line interpreters (cmd.exe, powershell.exe). It monitors for specific file names and paths that may indicate persistence, lateral movement, or evasion attempts involving VMware-related binaries or configurations.
Detects the execution of specific binaries (vmtools.exe, vmwared.exe, XDRAgent.exe) from the C:\ProgramData\VMware directory. This path is often used by adversaries to masquerade malicious files or execute tools from a directory that might be excluded from security scanning.
Detects the creation of scheduled tasks using schtasks.exe that masquerade as common update tasks (Google, Microsoft) or point to suspicious file paths often associated with malware (e.g., C:\ProgramData\VMware\). The rule monitors for tasks created with high privileges or triggers, which are indicative of persistence mechanisms.
Detects the Go binary executing Windows token manipulation APIs to duplicate tokens and elevate to SYSTEM. Specifically looks for 'setup.exe' performing 'DuplicateTokenExApiCall' or 'SetThreadTokenApiCall'.
This rule detects multiple indicators of suspicious activity on Linux systems, including LD_PRELOAD hijacking, memfd_create fileless execution, suspicious process masquerading, periodic cron task execution, and the creation of configuration files associated with common IDEs and AI tools. These patterns are frequently used to establish persistence, hide malicious activity, or facilitate lateral movement by compromising development environments.
Detects execution of the process 'PerfWatson2.exe' (associated with TinyRCT malware) from file paths other than the expected %LOCALAPPDATA% directory.
This rule detects the execution of processes masquerading as legitimate VMware-related utilities or XDR agents when they exhibit behaviors associated with command-and-control (C2) activity. Specifically, it flags processes matching these names or non-standard file paths that include command-line arguments indicative of tunneling (e.g., 'reverse', 'admin-auth-flag') or connect to a specific, hardcoded malicious IP address on port 41256.
Detects execution of the TinyRCT backdoor by monitoring for suspicious instances of 'PerfWatson2.exe' running from non-standard locations (outside of the expected Visual Studio program directories) and specific instances of 'chrome_setup.exe' originating from user download directories matching a known malicious SHA256 hash.
This rule detects the use of the Windows command shell (cmd.exe) executing a specific pattern involving the 'choice', '/T', and 'del' commands. This sequence is often used as a technique to delay execution or wait for a process to terminate before deleting it, a common tactic for self-deleting malware, scripts, or malicious tools aiming to evade forensic analysis.
Detects network activity initiated by PerfWatson2.exe communicating with known command-and-control (C2) IP addresses. PerfWatson2.exe is used as a masquerading process to blend in with legitimate Visual Studio telemetry traffic, a technique observed in TinyRCT C2 beaconing.
Detects the creation or opening of a named event (SyncedEventCreate, SyncedEventOpen, CreateEvent, OpenEvent) on Windows systems using the specific, potentially malicious, object name 'ShitSetupOn26126k'. This pattern often indicates inter-process communication associated with specific malware or unauthorized tool execution.
Detects the use of bitsadmin.exe or certutil.exe to download and install legitimate Remote Monitoring and Management (RMM) tools like ConnectWise Control. This activity is often associated with adversaries establishing persistent graphical access after initial compromise, as observed in campaigns like Storm-1175.
Detects the loading of amsi.dll by specific suspicious executable names, which may indicate an attempt to interact with or bypass the Antimalware Scan Interface (AMSI).
Detects the presence of Windows Media Player or Mixed Reality process executions in conjunction with the creation of a specifically named DLL (nvdaHelperRemote.dll) within the Windows Media Player directory, which is a common indicator of DLL side-loading or hijacking techniques targeting these applications.
Detects specific suspicious executables that load the Antimalware Scan Interface (AMSI) library (amsi.dll). This pattern is often indicative of attempts to disable or bypass AMSI scanning, commonly seen in malicious loaders or tools aimed at evading security monitoring.
Detects the execution of files with names commonly associated with malicious campaigns or masquerading, specifically 'COU_ITR-1_to_4_AY2026-27.exe' and 'Mixed Reality.exe'. This rule alerts on process start events involving these specific image names, capturing command-line details and process lineage for further analysis.
Detects the loading of amsi.dll in conjunction with command-line arguments that reference sensitive APIs often used to patch or disable the Antimalware Scan Interface (AMSI), such as VirtualProtect, GetProcAddress, or BCrypt-related functions.
Detects cross-process activity originating from the 'nvdaHelperRemote.dll' library targeting 'svchost.exe'. This pattern is indicative of potential process injection where a malicious actor or suspicious process attempts to inject code or manipulate the memory space of a core Windows system process via this specific helper library.
Detects potential DLL sideloading attempts where a malicious 'Mixed Reality.exe' loads a 'nvdaHelperRemote.dll' from the Windows Media Player directory, or the creation of these suspicious files by unrecognized processes, potentially linked to a dropper file 'COU_ITR-1_to_4_AY2026-27.exe'.
Page 403 of 864