Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects suspicious activities related to cryptocurrency wallet applications, potentially indicating a 'Meow RAT' infection or similar compromise. It looks for modifications to crypto wallet application files (specifically 'app.asar'), attempts to terminate crypto wallet processes using 'pkill', and suspicious 'codesign' commands targeting wallet applications. The rule also identifies command-line patterns associated with known trojanized wallet versions.
Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.
This rule detects cryptojacking activity where a silent MSI execution, masquerading as a vcredist_x64.dll load, is used to install and run ScreenConnect. This specific pattern has been observed in campaigns abusing ScreenConnect for GPU mining cryptojacking.
Detects malicious UnityPlayer.dll reading the encrypted Com.dat container for decryption routines, indicative of the 'Dragon Weave' campaign.
This rule detects PowerShell execution that uses 'Add-Type' to define types from 'combase.dll' and specific functions like 'DllImport', 'RoInitialize', 'WindowsCreateString', or 'Marshal.GetDelegateForFunctionPointer'. This pattern is often observed in techniques related to COM hijacking, DLL injection, or other forms of process injection to achieve persistence or privilege escalation.
This rule detects the COM activation of 'Windows.Internal.InstallService.Control.InstallServiceControl' by non-SYSTEM processes, which can be abused to invoke 'CreateInstallServiceWork' for UNC-based DLL coercion. It looks for specific strings in process command lines and additional fields in device events, as well as suspicious loading of 'combase.dll' by non-system processes.
Detects PowerShell commands using 'Add-MpPreference' to add exclusions for paths or processes in Windows Defender, which is a common technique for defense evasion by adversaries to prevent security software from scanning malicious files or activities.
Detects the extraction process where specific files (empty.vbs, Profile.ps1, 1.dat, Com.dat) associated with the Dragon Weave campaign are simultaneously unzipped into a 'data' folder. This rule looks for the creation of at least three of these four files within a one-minute window by the same initiating process.
This rule correlates the creation of .config files (often used for EDR evasion via AppDomainManager bypass) with the immediate creation of scheduled tasks using schtasks.exe. This sequence of events suggests an adversary is attempting to establish persistence after an initial evasion technique.
Advanced detection correlating RuntimeHost.exe spawning suspended InstallUtil.exe to inject miner. This rule specifically looks for 'RuntimeHost.exe' initiating 'InstallUtil.exe' without command-line arguments, followed by network activity from the 'InstallUtil.exe' process, indicating potential process hollowing and cryptojacking.
This rule detects initial access attempts involving double-extension shortcuts (.lnk) that lead to the execution of VBScript (VBS) files, which subsequently launch PowerShell scripts for decryption. The detection logic specifically looks for a .lnk file executing a command line containing '.vbs', followed within 5 minutes by a PowerShell process executing a command line containing 'Profile.ps1' or '-bxor'. This chain of events is indicative of malicious activity often used in phishing campaigns to bypass security controls and execute obfuscated payloads.
Detects the sideloading of the tampered DLL 'AggregatorHost.dll' by a process named '._cache_GAME1.exe', which is associated with hijacking live Steam sessions.
This rule detects various activities associated with suspicious implants, including file creation/execution, process execution, DLL loading (potential injection), and persistence via Run registry keys. It specifically looks for files named 'senti.dll', 'Thal.exe', and mentions 'PhantomBackdoor' and 'TencShell' as suspicious artifacts.
Correlates the stealer invoking system_profiler to search for virtualization or security strings (e.g., VMware, Parallels) to halt execution in sandboxes.
This rule detects unusual parent-child process relationships for 'svchost.exe' and 'explorer.exe'. Specifically, it flags instances where 'svchost.exe' is spawned by a process other than 'services.exe', 'msiexec.exe', or another 'svchost.exe' instance. It also flags 'explorer.exe' being spawned by a process other than 'userinit.exe' or another 'explorer.exe' instance. These relationships can indicate process injection, masquerading, or other forms of malicious activity.
Detects the abuse of Windows Background Intelligent Transfer Service (BITS) via 'bitsadmin.exe' or PowerShell's 'Start-BitsTransfer' cmdlet to download files from remote URLs. This rule identifies potentially malicious activity by monitoring for specific transfer-related command-line arguments coupled with external network connections, excluding Microsoft-signed processes. It further refines detection by flagging output to suspicious directories (like Temp, AppData, or Public) or files with common executable extensions.
Detects the use of tar.exe to extract archives into common staging directories (Temp, AppData, Public, ProgramData), particularly when the process is initiated by suspicious parent processes such as Office applications, command shells, or download utilities, which is often indicative of malicious payload staging.
This rule detects potentially malicious usage of the BGInfo.exe utility, a legitimate Sysinternals tool used for desktop configuration information. The detection focuses on two primary attack vectors: 1) BGInfo.exe spawning scripting interpreters like wscript.exe or cscript.exe, which is anomalous behavior for a configuration tool; and 2) Execution of BGInfo.exe with a .bgi configuration file located in non-standard, potentially user-writable, or temporary directories, indicating potential abuse of the configuration file to execute arbitrary payloads.
Detects the creation of scheduled tasks using schtasks.exe that exhibit suspicious characteristics. This includes tasks referencing external URLs, those containing base64-encoded or obfuscated command strings, and tasks pointing to binaries or scripts in user-writable paths (e.g., AppData, Temp). The rule specifically targets tasks intended to run with SYSTEM privileges or those using common persistence triggers, while excluding known legitimate administrative software.
Detects the execution of msiexec.exe where the command line points to a remote resource via HTTP, HTTPS, or a UNC path. This behavior is indicative of an adversary using msiexec to download and execute a malicious MSI package, leveraging it as a proxy for malicious code execution.
Detects the execution of mshta.exe with suspicious command-line arguments that indicate the loading of inline JavaScript/VBScript or the retrieval of remote HTA files via HTTP/HTTPS. This behavior is a common technique used by attackers to proxy execution through a trusted Windows binary, often to bypass security controls.
Page 407 of 864