Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Targets creation or loading of a .sys file from the Fonts directory by a non-standard loader. The UDM rule retains principal and target context for correlation.
This rule detects the execution of self-extracting (SFX) archives that launch both a visible decoy and a hidden second executable from the temporary directory. It specifically looks for process command lines containing patterns indicative of 7-zip or generic SFX archive execution, combined with an actor process image name suggesting an archive utility or installer. The rule aims to identify malicious SFX archives used in multi-stage attacks, providing causality fields for investigation.
Detects the execution of base64 decoded strings directly outputted from scripting processes, which is a common technique for obfuscation and payload delivery.
This rule detects the creation of Electron application files (electron.exe, app.asar, index.js, package.json) in unusual AppData\Local subdirectories by processes identified as UtilifySetup or Inno Setup. It leverages causality information to link the file creation to the installer process, aiming to identify potentially malicious Electron-based applications installed by suspicious installers.
Identifies mshta.exe launching the downloaded GammaLoad payload with specific command arguments, indicative of T1218.005 (Signed Binary Proxy Execution: Mshta).
Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.
Detects the execution of the legacy ntvdm.exe with a hex parameter, utilized for process injection and legacy compatibility layers.
Detects the legitimate Microsoft binary Fondue.exe loading APPWIZ.cpl from a non-standard public directory (C:\Users\Public\), indicating DLL side-loading, a technique observed in campaigns like Dropping Elephant.
Detects Linux execution environments where processes manually manipulate their argv[0] to masquerade as kernel threads ([khubd]) or legitimate daemons (smbd -D). The rule specifically looks for process command lines matching 'khubd', 'smbd -D', or 'kauditd -sh' where the actual executable filename is not 'smbd', 'kauditd', or 'khubd'.
Identifies the creation of a .config file matching a newly relocated executable's name, used to force the .NET runtime to load the TOTPGuard.dll AppDomainManager. This rule specifically looks for the simultaneous creation of an executable (.exe) and a corresponding configuration file (.exe.config) in the same directory, which is a known technique used by the Nimbus Manticore threat actor for AppDomainManager hijacking.
This rule broadly hunts for instances where legitimate Microsoft update binaries (like mobsync.exe, w3wp.exe, certutil.exe, or svchost.exe) load unknown DLLs from non-standard directories, indicating potential DLL sideloading.
Detects obfuscated PowerShell commands commonly used in malicious scripts by looking for encoded PowerShell execution and specific obfuscated cmdlet patterns like 'new-item', 'net.webclient', 'downloadfile', and 'invoke-item'.
Detects the execution of mshta.exe when invoked with command-line arguments indicative of script execution (e.g., vbscript:, javascript:, http(s)://) or when spawned by common Microsoft Office applications. This behavior is frequently associated with malicious document-based attacks, where office macros trigger mshta to download or execute obfuscated code.
Detects instances where common Windows processes (svchost.exe, explorer.exe, or notepad.exe) spawn suspicious child processes (such as cmd.exe, powershell.exe, or wscript.exe). The rule identifies potential process hollowing or living-off-the-land techniques by correlating parent-child relationships with suspicious command-line parameters (encoding, hidden execution, or in-memory execution) or anomalous file paths (running from user-writable directories).
Detects suspicious injection into a headless Chrome or Edge process by looking for the '--headless' and 'DEBUG_ONLY_THIS_PROCESS' command-line arguments. This combination suggests an attempt to bypass app-bound encryption, potentially via IElevator COM.
Detects the execution of 'finger.exe' or a renamed version (e.g., 'ct.exe') when its command line contains an '@' symbol and either 'http', 'https', or a '.' (dot). This pattern is indicative of the LOLBin 'finger.exe' being used to communicate with an external C2 server, as observed in CrashFix/ModeloRAT campaigns.
Detects a batch script attempting to delete itself using the 'del %~f0' command. This technique is often used by malicious scripts to remove forensic evidence after execution.
Detects emails successfully delivered to the inbox that exhibit authentication failures for SPF, DKIM, or DMARC, or where a mismatch between the 'SenderFromDomain' and 'SenderMailFromDomain' is observed, indicating potential email spoofing or unauthorized sender impersonation.
Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.
This rule monitors system logs for attempts to disable or stop the Linux Audit daemon (auditd) or modify its configuration via auditctl or system management commands (systemctl, service). Disabling the audit system is a common technique used by adversaries to hide malicious activity from security monitoring.
Page 411 of 864