Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects indicators of the DcRAT malware associated with Operation DragonReturn. The rule monitors for the creation of the specific DcRAT mutex 'Global\ShitSetupOn26126k', the execution of a malicious process disguised as the Windows Media Player 'Mixed Reality' utility, and the sideloading of the 'nvdaHelperRemote.dll' file within the Windows Media Player directory, which are techniques used for sandbox evasion and persistence.
Detects the use of 'unshare' to create new kernel namespaces or 'tc' (Traffic Control) with specific parameters (pedit) to manipulate packet headers. These tools are often leveraged by adversaries to perform privilege escalation or network redirection/manipulation within a Linux environment.
This rule detects advanced evasion techniques involving the patching of Native APIs (specifically WriteProcessMemory on ntdll.dll) combined with the spawning of suspended processes (process hollowing). This combination is indicative of attempts to unhook EDRs and execute malicious code stealthily.
Detects the script escalating privileges using the stolen password via sudo to strip quarantine extended attributes from the payload.
This rule detects fileless reflective loading behavior where a process performs an in-memory DLL load (specifically 'mscoree.dll' via 'LdrLoadDllApiCall') and is immediately followed by an outbound network connection within a 5-minute window. This sequence is indicative of techniques used for in-memory execution and command and control (C2) communication.
Detects unsigned or non-Microsoft signed executables running from the Windows Media Player installation directory. This behavior is indicative of masquerading techniques used by attackers, such as the Operation DragonReturn campaign, to hide malicious services or components within trusted system directories.
Detects attempts by potentially malicious processes to inject code into svchost.exe. The rule monitors Sysmon Event ID 10 (ProcessAccess) for specific granted access masks (0x1fffff, 0x1f0fff, 0x143a) commonly used for virtual memory manipulation, while excluding trusted Windows system processes.
Detects execution of known Proof-of-Concept binaries (pedit_cow_demo or packet_edit_meme) followed by /bin/su spawning /bin/sh, which indicates successful exploitation of the pedit COW vulnerability resulting in shellcode execution with root privileges.
Detects potential Anti-Malware Scan Interface (AMSI) bypass attempts by identifying processes modifying the AmsiOpenSession function within amsi.dll memory using VirtualProtect, a technique observed in the DcRAT malware.
Detects DcRAT malware injecting malicious code into the legitimate Windows system process svchost.exe. The rule monitors for a suspicious process launching and accessing svchost.exe, coupled with the presence of specific API calls associated with process injection techniques like memory allocation, payload writing, and remote thread execution within the command line context.
Detects the Kazuar malware removing job instructions and result files from its working directory after exfiltration or task completion. This rule specifically looks for file deletion events (EventCode 23 or 26 in Sysmon) where the file path matches patterns indicative of task, job, result, output, or stage files with common extensions like json, dat, bin, txt, or zip.
Detects a module parsing a large in-memory configuration blob without opening an external configuration file in the same start window. This behavior is indicative of the Kazuar malware loading its configuration directly from its executable rather than a separate file, which is a common obfuscation technique.
This rule detects attempts to impair defensive mechanisms by creating or modifying Quality of Service (QoS) policies that specifically target Endpoint Detection and Response (EDR) or Antivirus (AV) processes. Adversaries may use QoS policies to throttle network traffic for security products, hindering their ability to communicate with central management or cloud services, thus impairing their effectiveness. The rule looks for command-line arguments used to create or set QoS policies (`New-NetQosPolicy`, `Set-NetQosPolicy`) that include throttling parameters (`ThrottleRateActionBitsPerSecond`, `AppPathNameMatchCondition`) and target common EDR/AV process names. It also detects direct registry modifications to QoS policies (`\SOFTWARE\Policies\Microsoft\Windows\QOS`) that include EDR/AV process names.
Identifies the first-stage script downloading the Mach-O binary payload directly into /tmp/helper or /tmp/update using 'curl'.
Correlates the stealer invoking system_profiler via osascript to search for virtualization strings to halt execution in sandboxes.
Identifies the execution of files with classic double extensions designed to trick users into clicking what they think is a document. This rule specifically looks for filenames ending with common document/image extensions followed by executable extensions.
Correlates the runtime replacement of junk encoding markers (DGtre) with standard Base64 characters within the payload, often seen in Vidar malware's obfuscation techniques.
Detects modifications to CommonGlobUserSettings, used by Makop for UI/shell behavior manipulation.
Detects a web session that proxies an enterprise authorisation endpoint while also handling session-cookie names associated with authenticated access. This rule identifies suspicious activity indicative of an Adversary-in-the-Middle (AiTM) attack where an attacker proxies authentication requests and steals session cookies.
Detects one web session posting username, password, and MFA or one-time-code form fields through the same intermediary host. This behavior is indicative of an Adversary-in-the-Middle (AiTM) attack, where an attacker intercepts and relays authentication requests, including multi-factor authentication (MFA) codes, to gain unauthorized access.
Detects svchost.exe (hosting InstallService) loading InstallServicePlugin.dll from a UNC path, which is indicative of the UnCanny Local Privilege Escalation (LPE) technique. This behavior is suspicious as legitimate svchost processes typically load DLLs from local system paths, not network shares.
Page 404 of 864