Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects potential file staging or persistence activities by identifying executable, library, or script files that are created in temporary folders and subsequently deleted within a short timeframe (300 seconds). This behavioral pattern is characteristic of attackers moving tools, staging payloads, or cleaning up tracks after executing malicious scripts or binaries within common directory structures like '\Temp\', '\AppData\', or '\Windows\Temp\'.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
Detects instances where WScript.exe queries or modifies multiple sensitive Windows Registry keys. This behavior is often associated with script-based malware attempting to modify file associations, persistence mechanisms, or security policies as part of an infection or post-exploitation process.
Detects the forceful termination of web browsers using taskkill.exe with the /F (force) and /IM (image name) flags. This behavior is a common precursor for information stealers attempting to unlock browser databases for credential harvesting.
Detects the simultaneous extraction of at least three different script types (VBS, PS1, JS, or DAT) from archives, followed by their execution by their respective interpreters (wscript.exe, powershell.exe, node.exe, or bun.exe). This behavior is indicative of multi-stage attacks where adversaries use various scripting languages for different phases of their operations, often to evade detection or to ensure compatibility across different system configurations. The inclusion of '.dat' files suggests that the rule is also looking for potentially obfuscated or custom script formats that are then interpreted by one of the listed executables.
Identifies instances where update.exe enforces an svchost.exe parent to evade sandboxes, specifically looking for 'UpdateChecker.dll' being loaded by a process named 'update.exe' whose parent is 'svchost.exe'. This behavior is associated with the Screening Serpens APT group.
This rule detects outbound Command and Control (C2) beaconing activity by the `UpdateChecker.dll` to Azure Websites, which is indicative of the Screening Serpens APT group. It specifically looks for the loading of `UpdateChecker.dll` followed by network connections to domains ending in `azurewebsites.net` from the same initiating process.
Detects the execution of curl commands that involve base64 decoding, often used by adversaries to download and execute obfuscated scripts or payloads. The rule specifically looks for common shell utilities (curl, zsh, bash, sh) executing commands containing 'base64 --decode' and 'curl', along with specific suspicious domains or a generic base64 encoded string pattern.
Detects inbound emails containing links to the Upflow.io billing portal that include an embedded token parameter. This technique is actively abused by attackers to grant unauthorized viewing access to fraudulent invoices without requiring login credentials.
This rule correlates the successful loading of the 'EEDbg.sys' driver with subsequent command-line activity indicating an attempt to stop a service or delete the 'EEDbg.sys' file. This behavior is indicative of an attacker cleaning up forensic evidence after a Bring Your Own Vulnerable Driver (BYOVD) attack, specifically targeting the EnCase EDR's driver.
Hunts for SimpleHelp executing reg.exe commands to disable Windows Defender components (DisableRealtimeMonitoring, DisableAntiSpyware) prior to encryption.
Identifies Havoc C2 spawning an interactive shell (cmd.exe or powershell.exe) where the parent process is a hollowed svchost.exe lacking the -k parameter.
Detects the threat actor clearing the staging archives securely via sdelete or forcefully via del /f /q immediately post-exfiltration. This rule correlates process execution of 'cmd.exe' or 'sdelete.exe' with specific command-line arguments targeting archive files (zip, rar, 7z) and a preceding network connection to a remote IP, indicating potential data exfiltration followed by anti-forensic cleanup.
Identifies the EDR Killer successfully removing driver callbacks or notify routines in kernel memory by detecting a sudden cessation of telemetry following the driver load of 'EEDbg.sys'. This rule correlates driver load events with subsequent telemetry drops from the same device.
Detects the consequence of the BYOVD exploit: the sudden termination or crash of protected EDR/AV processes (MsMpEng.exe, Sense.exe, csrss.exe tampering) in conjunction with the loading of the 'EEDbg.sys' driver, which is associated with the EnCase BYOVD technique.
Detects the Havoc Demon payload executing post-exploitation token manipulation APIs (DuplicateTokenEx) to escalate privileges to SYSTEM, specifically when the initiating process originates from the Downloads folder.
Detects anomalous user-mode processes requesting the SeLoadDriverPrivilege token privilege, which is essential for loading the EnCase driver (EEDbg.sys) into the kernel. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack using the EnCase driver.
Detects Havoc C2's Sleep Obfuscation (Ekko/FOLIAGE) technique where a process creates remote threads into itself with suspicious start addresses to hide its memory while sleeping. This rule specifically looks for CreateRemoteThread API calls where the target process is the same as the initiating process, excluding common legitimate processes like chrome.exe, msedge.exe, and svchost.exe.
Detects the core payload components dropped by the malicious easy-day-js npm package, which is an infostealer affecting developers and CI/CD environments. The rule specifically looks for the creation or modification of 'protocal.cjs' and 'config.json' within a hidden 'NodePackages' directory located in 'C:\ProgramData\', a technique used to masquerade as legitimate Node.js tooling.
This rule detects attempts by user-mode utilities to interact with the loaded EnCase driver via DeviceIoControl, specifically targeting paths containing 'EEDbg' or 'EnCase'. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack, where an EDR killer utility leverages a legitimate driver's functionality to execute arbitrary ring-0 commands, potentially bypassing security controls.
Identifies rundll32.exe executing a DLL with a randomized or anomalous export function, combined with evidence of a DLL file being created on the system. This behavior is indicative of Matanbuchus DLL sideloading.
Page 412 of 864