Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects PowerShell utilizing [Runtime.InteropServices.Marshal]::WriteInt32 to overwrite the amsiContext memory space with 0x41414141, indicating an attempt to bypass AMSI.
Hunts for the reflective .NET loader dynamically invoking methods while spawning RegAsm.exe as the execution proxy. This rule detects when 'RegAsm.exe' is spawned by 'powershell.exe' and is associated with an 'AllocateVirtualMemoryApiCall' event, indicating potential reflective code loading and execution.
Correlates the malicious ms-settings registry hijack with the execution of the auto-elevating ComputerDefaults.exe. This rule detects a specific UAC bypass technique where an attacker modifies the 'ms-settings' registry key to point to a malicious executable, which is then launched when 'ComputerDefaults.exe' is executed, leading to privilege escalation.
Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for processes executing from paths matching the regex `AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\` and excludes common browser executables like chrome.exe, msedge.exe, and update.exe to reduce false positives.
Identifies JavaScript environments writing randomized markers to localStorage to suppress repeated execution of the malicious ClickFix payload. This rule specifically looks for browser storage modifications combined with network events indicating a CDN-hosted JavaScript file.
Detects the ClickFix technique where MSHTA is invoked to download and execute an MSIXBUNDLE that is actually a ZIP/HTA polyglot bypassing standard inspection. This rule specifically looks for mshta.exe executing with a command line that attempts to download files with extensions like .msixbundle, .zip, or .txt over HTTP/HTTPS, combined with network connection events.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
Detects AutoHotkey (AHK) scripts executing from the 'Microsoft.WindowsSoundDiagnostics' directory, which is an unusual location for such scripts and has been observed as a staging directory for malware like AsyncRAT. This rule specifically looks for process events where the initiating process or the process itself is located in 'Microsoft.WindowsSoundDiagnostics' and the command line contains '.ahk'.
Detects potentially malicious drivers masquerading as Palo Alto components, specifically looking for drivers loaded from the 'drivers' folder that claim to be from 'Palo Alto' but have no signer or an invalid signature. This behavior has been associated with the ABYSSWORKER threat.
Detects PowerShell commands that modify Quality of Service (QoS) policies targeting the 'ActiveStore'. This technique can be used by adversaries to apply throttling to processes, potentially bypassing EDR solutions without requiring a system reboot, as described in the EDRChoker playbook.
Detects the creation of Quality of Service (QoS) policies via PowerShell that explicitly target known Endpoint Detection and Response (EDR) agent executables. This activity could indicate an adversary attempting to degrade or block EDR telemetry to evade detection.
Detects sudden loss of telemetry from multiple EDR agents (specifically Microsoft Defender processes like msmpeng.exe and mssense.exe) while the OS remains active, indicating potential Quality of Service (QoS) throttling or other defense evasion techniques aimed at impairing EDR functionality.
Detects rapid non-interactive sign-ins utilizing refresh tokens from known VPS hosting providers. This rule identifies a high volume of successful non-interactive sign-ins (more than 20 within a 10-minute window) from a single user and IP address, indicating potential abuse of refresh tokens, possibly from a compromised cloud VPS.
Detects the loading of the QoS WMI provider DLL (qoswmi.dll) into the WMI provider host (wmiprvse.exe). This behavior is associated with the EDRChoker technique, which can be used for stealthy execution and EDR evasion.
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory, often associated with the XWorm malware.
Detects PowerShell commands that contain a reversed string pattern often used by Vidar malware to de-obfuscate its C2 endpoint at runtime. The specific pattern 'txt.[0-9a-zA-Z]+/selif_cilbup' is indicative of this technique.
Monitors for the empty DelegateExecute value insertion that forces Windows to fall back to legacy COM handler resolution.
Identifies XWorm dynamically identifying and invoking the Run method of a reflected plugin assembly using .NET late binding. This detection specifically looks for 'LdrLoadDllApiCall' events where 'mscoree.dll' is loaded by a process whose filename matches 'Win.Kernel_Svc'.
Detects PyInstaller unpacking dropping highly randomized compiled Python bytecode (.pyc) indicative of hidden malware loaders. Specifically looks for .pyc files with 20 or more alphanumeric characters in their name, created in a temporary folder path matching the pattern '_MEI[0-9]+'.
Correlates the dropping of the decrypted XWorm payload into %LOCALAPPDATA% with a name mimicking a Windows Kernel service.
Detects the execution of a spoofed Adobe.application ClickOnce deployment manifest, often initiated by web browsers or the explorer process, indicating a potential phishing attempt.
Page 414 of 864