Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the unique XOR decryption routine logic utilizing the actor's embedded Session messenger identifier as the key string. This rule specifically looks for file creation or modification events of '.pth' files, correlated with process command lines containing 'contact [alphanumeric] on session'.
Traces the behavior of Vidar resolving its Win32 APIs dynamically in memory using a byte-by-byte XOR reconstruction loop. This rule specifically looks for `WriteProcessMemoryApiCall` events where the target process is `RegAsm.exe` and the buffer size written is less than 256 bytes, which is indicative of small, dynamic code injection or modification often seen in malware unpacking or API resolution.
Correlates the creation and immediate deletion of the trin.tar.gz archive handled by the Python temporary-directory context manager.
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, a known evasion tactic to blind EDR telemetry before full execution. This rule specifically looks for WriteProcessMemory API calls targeting memory regions near the base address of ntdll.dll, initiated by processes like InstallUtil.exe, MSBuild.exe, or powershell.exe.
Detects the creation or modification of an inbox rule in Microsoft 365 where the rule's name consists entirely of special characters. This behavior can be indicative of an adversary attempting to evade detection by obscuring malicious inbox rules.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
Detects the execution of QEMU virtualization binaries from non-standard or suspicious file paths (such as Temp or AppData) or with command-line arguments indicative of VM configuration (e.g., -drive, -net, -kernel). The rule further correlates these process executions with subsequent network connections within a 5-minute window, potentially identifying unauthorized VM usage, data exfiltration through tunnelled connections, or adversary-controlled virtualization tools.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
Detects modifications to COM InprocServer32 registry keys under HKEY_CURRENT_USER. This activity is often associated with COM hijacking, a technique used by adversaries to achieve persistence or execute malicious code when a hijacked COM object is invoked by legitimate applications. The rule specifically flags suspicious or non-Microsoft COM registrations, particularly those pointing to files within the user's AppData/Local directory.
Detects instances of PowerShell being launched by common scripting host binaries (mshta.exe, wscript.exe, cscript.exe) with command-line arguments indicative of malicious activity, such as encoded commands, hidden windows, and remote code download patterns (e.g., iex, Invoke-RestMethod). The rule further checks for indicators related to the Lightlife C2 infrastructure.
This rule detects attempts to modify Windows Defender preferences to exclude the 'Hola' application directory or a related miner process. It specifically looks for command-line executions of PowerShell, pwsh, or MpCmdRun.exe that include 'add-mppreference', 'exclusionpath', 'exclusionprocess', or '-addexclusion' in conjunction with 'hola'. This activity is often associated with malware attempting to disable security defenses.
Detects behavior indicative of StealC or Amadey malware loading and executing in-memory by injecting code into trusted Windows system processes such as svchost.exe or explorer.exe. The rule correlates a process launch from suspicious locations like Temp or AppData with subsequent process access events targeting these host processes, typically signaling process injection for evasion.
Detects the self-deletion behavior of the Prinz Eugen ransomware. The ransomware, identified by the filename 'servertool.exe', spawns a command shell to execute a ping command (as a delay mechanism) followed by a force-deletion command to remove itself from the disk after encryption activities are complete.
Detects behavior attributed to the AMOS (Atomic macOS Stealer) malware, where a shell process uses 'setsid' to detach from the current terminal session, followed immediately by the execution of 'killall Terminal' to conceal the execution of malicious commands.
Detects the creation of a LaunchAgent property list file in the user's Library directory that masquerades as an Apple-related process (com.apple.*). This behavior is associated with the macOS.Gaslight malware family, which uses such files for persistence, often with specific arguments like --type=renderer.
Detects instances of Chrome, Edge, or Brave browsers being launched with specific, suspicious command-line arguments (e.g., --no-first-run, --disable-gpu, about:blank) from parent processes that are not standard browser or update launchers. This behavior is indicative of Vidar Stealer attempting to force a browser instance to generate or expose the master encryption key, facilitating the theft of browser-stored credentials.
Detects a malicious persistence mechanism where a suspicious process ('chost.exe') is registered in the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key to execute at startup. The rule specifically monitors for registry keys pointing to temporary directories or unconventional path structures often associated with this RAT, while correlating this with the execution of the process from a non-system directory (i.e., outside System32/SysWOW64).
Detects a multi-stage execution pattern involving cmd.exe spawning PowerShell to download files from storjshare.io using System.Net.WebClient, followed by a secondary PowerShell execution using 'Start-Process -Verb RunAs' to trigger a UAC bypass, characteristic of the REF8372 campaign and OXLOADER distribution.
Detects instances where known Windows binaries vulnerable to UAC bypass (eventvwr.exe, fodhelper.exe, or sdclt.exe) spawn a child powershell.exe process with the '-ExecutionPolicy Bypass' argument. This activity is indicative of an attacker attempting to elevate privileges without triggering a UAC prompt.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Detects the OXLOADER malware attempting to probe for sandbox or analysis environments by dynamically loading mpr.dll and invoking the WNetAddConnection2W API function. This activity is a known behavioral pattern used to identify system artifacts or network connectivity constraints indicative of security analysis environments.
Page 405 of 864