Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Description: Detects the Stage 2 C2 tasking loop from the malicious Next.js developer-targeting campaign.Stage 2 spawns a child Node.js process and executes attacker-supplied JavaScript via STDIN ('-') or eval ('-e'), sourced from a parent Node process that previously beaconed to Vercel staging infrastructure. Trojanized assets involved include jquery.min.js and env-setup.js loaded from
known malicious repo structures.
known malicious repo structures.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
Detects the creation of an Alternate Data Stream (ADS) explicitly named 'WDFOO' attached to 'wermgr.exe'. This is a high-fidelity artifact generated by the RoguePlanet zero-day exploit to manipulate Microsoft Defender's remediation.
This rule detects attempts to disable or impair Endpoint Detection and Response (EDR) or Antivirus (AV) solutions by abusing Quality of Service (QoS) policies. It specifically looks for two methods: 1) Process command-line execution that creates or modifies QoS policies (`New-NetQosPolicy` or `Set-NetQosPolicy`) and targets known EDR/AV process names with throttling actions. 2) Direct manipulation of the Windows Registry under `SOFTWARE\Policies\Microsoft\Windows\QoS` where the registry value data contains known EDR/AV process names. This activity is indicative of an attacker attempting to "choke" the telemetry stream from security products, potentially to evade detection.
Detects the uploading of a plugin matching known disguised slugs ('content-delivery-helper' or 'database-optimizer') used by attackers to install backdoors after establishing a rogue admin account in WordPress environments. This rule specifically targets POST requests to the WordPress plugin update endpoint with these malicious plugin names in the query string.
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
This rule detects potential User Account Control (UAC) bypass attempts by monitoring the creation of processes for 'fodhelper.exe', 'computerdefaults.exe', or 'slui.exe' when their parent process is not 'explorer.exe' or 'svchost.exe'. These executables are known to be used in UAC bypass techniques to elevate privileges without user interaction.
Detects PowerShell command-line executions that utilize the '-enc' (encoded command) parameter, combined with common Base64 encoded string prefixes. This technique is frequently used by adversaries to obfuscate malicious PowerShell scripts and evade detection.
Detects disabling of Windows Defender through registry modifications
This rule detects the execution of 'VmwareSampling.exe' with a command line containing 'victimtoolsalla.dll'. This specific combination is indicative of the NIGHTFORGE loader, which often leverages DLL side-loading techniques to execute malicious payloads. The presence of 'victimtoolsalla.dll' suggests an attempt to load a malicious DLL via a legitimate VMware process.
This rule detects potential DLL sideloading activity by monitoring process creation events where specific executables ("Setup_File_75.593.2113.exe" or "SystemSettings.exe") are launched with a command line containing "borlndmm.dll". It then correlates this with file events to confirm the presence of "borlndmm.dll" on the same device. This pattern is indicative of the OnyxC2 malware attempting to load a malicious DLL.
Detects a component combining spooler token access and CreateProcessAsUser, often indicative of the Sprysocks malware. The rule specifically looks for the presence of 'spoolsv.exe' along with API calls 'OpenProcessToken', 'DuplicateTokenEx', and 'CreateProcessAsUser', which are used to elevate privileges or impersonate other users by duplicating a token from the print spooler service and then launching a new process with that token.
Detects vcpktsvr.exe loading a local libcef.dll associated with the non-standard cef_api_mash export used by ZiChatBot.
Detects the creation of generic executable files (e.g., me.exe, update.exe, monitor.exe, service.exe) within the Hola browser installation path. This rule aims to identify potentially malicious executables delivered by a compromised updater or supply chain attack targeting Hola browser users. The rule also captures the principal process responsible for the file creation for correlation.
Detects the creation of an inbound allow firewall rule by 'netsh' or 'powershell' when launched from a user-writable location (e.g., Temp, AppData, ProgramData, Users\Public). This rule aims to identify potentially malicious activity where an attacker might be establishing persistence or enabling command and control communication by modifying host firewall settings.
Detects the execution of mshta.exe with a remote .7z file as an argument. This behavior is often indicative of malicious activity where mshta is abused to execute script content disguised as an archive file from a remote source.
Detects the execution of mshta.exe with a remote .7z file as an argument. This behavior is often indicative of malicious activity where mshta is abused to execute script content disguised as an archive file from a remote source.
Detects the creation of an executable file in temporary directories (temp or appdata\local\temp) that is then executed by cmd, powershell, or another executable. This pattern is often observed with malware downloaders that stage and execute their payloads in temporary locations.
Targets an executable copied or launched beneath AppData Local Programs by a temporary-stage process. The UDM rule retains principal and target context for correlation.
Udm Hola Monitor Service
YARA-L
This rule detects modifications to the Windows Registry related to the 'hola_monitor_svc' service. Specifically, it looks for registry keys containing 'services\hola_monitor_svc' and registry value data or process command lines that include 'holamonitorservice.exe'. This activity indicates the configuration or presence of the Hola Monitor Service, which could be associated with the Hola VPN application.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Page 410 of 864