Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects MYRA Linux RAT establishing cron-based persistence by scheduling /usr/local/lib/.cache-update.sh to execute every 13 minutes with a fileless fallback chain using memfd_loader and agent_launcher. Indicative of the apintergrationpost npm supply chain attack by threat actor kimijohn01.
Detects MYRA RAT fileless execution where memfd_loader or memfd_exec loads the Node.js binary and JavaScript agent bundle into anonymous memory file descriptors via memfd_create and executes via fexecve. Resulting processes show /proc/PID/exe pointing to '/memfd:.node (deleted)' or '/memfd:.bundle' with no files on disk.
This rule detects the execution of potentially unwanted programs (PUPs) from common temporary or user-specific download directories. It specifically looks for processes with filenames indicative of PUPs (e.g., 'pua.exe', 'adware.exe', 'pup.exe', 'unwanted.exe') originating from 'Temp', 'AppData', or 'Downloads' folders. The rule aggregates these events per device per hour and alerts if one or more such executions occur, indicating potential user-initiated installation or drive-by download of unwanted software.
Detects the use of .NET reflection methods within PowerShell process command lines. These methods, such as System.Reflection.Assembly.Load, are commonly used by attackers for fileless execution of malicious .NET assemblies directly in memory, bypassing disk-based security controls.
Detects attempts by unsigned or non-Microsoft processes to perform cross-process memory injection (such as CreateRemoteThread or NtCreateThreadEx) into critical processes including browser processes (chrome.exe, msedge.exe) or the local security authority subsystem service (lsass.exe).
Detects the use of certutil.exe to download files from a remote URL using the -urlcache or -split flags. This behavior is a common Living-off-the-Land (LotL) technique used by adversaries to bypass security controls and download secondary payloads.
Detects the execution of mshta.exe with arguments that indicate the loading of remote HTML applications (HTA) via HTTP/HTTPS, UNC paths, or the execution of inline JavaScript/VBScript commands. This behavior is a common technique used by attackers to proxy execution through a trusted Windows binary to bypass security controls or fetch malicious payloads.
Detects instances where a signed process loads a dynamic-link library (DLL) from a user-writable directory, such as Temp, AppData, Downloads, or Public. This behavior is a common technique used for DLL sideloading to hijack the execution flow of trusted, signed applications.
Detects StealC's characteristic self-deletion pattern where cmd.exe executes a timeout delay followed by a forced quiet file deletion (/f /q) of the malware binary. This occurs as StealC's final operation after data exfiltration when the self_delete flag is set in the C2 configuration.
Identifies fmapp.exe running from user-writable paths (AppData, Temp) to sideload the malicious fmapp.dll payload.
Detects suspicious chmod commands used to hide or protect malware
Detects malicious ClickOnce application manifests for proxy code execution
Detects SystemSettings.exe executing from any directory other than its legitimate location (C:\Windows\ImmersiveControlPanel\). This behavior is indicative of DLL side-loading, often used by malware like SharkLoader to execute malicious SystemSettings.dll.
Detects when 'SystemSettings.exe' is copied from its legitimate location to common staging directories like ProgramData, AppData, Temp, or Public. This activity is often observed in campaigns like StrikeShark as an early indicator before sideloading, providing an opportunity for earlier detection.
Detects unexpected outbound network connections from the ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe processes. Threat actors use WinGet DSC execution to establish reverse shells or download payloads. Network activity from these processes is highly unusual.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. This activity is associated with UNC6692 ("Snow Flurries") impersonating IT helpdesk over Teams, luring victims to a fake "Mailbox Repair Utility" page, and delivering a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects attempts to invoke 'sudo' for privilege escalation or enumeration from non-interactive contexts such as scripts, scripting language interpreters, or web/application service processes. It also identifies 'sudo -l' or '--list' commands used for privilege enumeration.
Detects IDEs executing as a Node.js interpreter, a technique used to run malicious JS silently, as described in the UNK_DeadDrop campaign.
Detects an administrative forwarding, redirect, BCC, or content compliance rule change when Defender for Cloud Apps identifies attributes that are uncommon for the account. UNC6508 replayed harvested credentials to access an administrator account before creating its covert exfiltration rule. The anomaly requirement increases confidence while preserving coverage for infrastructure that is not recognised as a proxy.
Detects when Windows Defender's real-time monitoring or anti-spyware features are disabled via registry modification. This can indicate an attempt by an adversary to impair defenses and evade detection.
Page 408 of 864