Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the creation of an inbound firewall allow rule by `netsh` or `powershell` when the initiating process (actor) is launched from a user-writable location such as `temp`, `appdata`, `programdata`, or `users\public`. This behavior can indicate malicious activity where an adversary attempts to establish network access or persistence by modifying firewall settings from an unusual or untrusted execution path.
This rule detects the creation or modification of files within the Windows Fonts directory that use specific naming conventions (starting with 'x1', 'kx1', or 'kw1') and have no file extension or a generic one. This pattern is often associated with malware attempting to hide encrypted data containers or malicious payloads by masquerading them as legitimate system files.
Detects PowerShell commands extracting and executing script blocks embedded in XML files (e.g., unattend.xml). This behavior is observed in the GreatXML BitLocker bypass exploit, where an attacker leverages a crafted unattend.xml during Windows Defender Offline Scan to spawn an unrestricted shell.
Detects the unique start and end markers (VAPTb3gin, VAPTfin) used by the VAPT autonomous framework to confirm exploit success across network or host logs. This rule searches across process and network events for these confirmation markers.
Identifies the execution of the built-in CMD command 'mklink' using the '/J' switch, which creates an NTFS directory junction. Attackers use this to build recursive loops for EDR evasion.
Detects PowerShell executing heavily obfuscated commands utilizing both Base64 conversion and DeflateStream decompression, a signature of the Codex loader.
Detects the Komari agent executing from anomalous staging directories (e.g., Public, ProgramData, Temp) and immediately initiating high-frequency external network connections. This rule correlates process creation events with network connection events to identify suspicious behavior indicative of Komari C2 activity.
Identifies the final stage of Codex where the decrypted byte array is reflectively loaded into the .NET runtime using [System.Reflection.Assembly]::Load and subsequently invoked via EntryPoint.Invoke. This rule specifically looks for PowerShell command executions containing these reflective loading patterns.
Detects the PUP installer dropping an outdated, legitimate application (e.g., old versions of VLC or Notepad++) alongside a malicious DLL to execute a sideloading attack. The rule identifies file creation events for DLLs followed by an image load event for an unsigned DLL within a short time frame, where the initiating process for the image load has a valid signature.
Identifies PowerShell spawning Microsoft .NET binaries (RegAsm.exe, InstallUtil.exe, AppLaunch.exe) without command-line arguments, which is indicative of process hollowing or injection by the Codex malware to inject its final stage.
Correlates the PowerShell process allocating virtual memory with PAGE_EXECUTE_READWRITE permissions, setting up the memory space for process hollowing.
Detects the Komari agent spawning svchost.exe in a suspended state (no arguments) and writing memory into it to hide malicious execution. The rule identifies svchost.exe processes launched without the '-k' argument (indicating a suspended state) and then correlates these launches with subsequent 'WriteProcessMemoryApiCall' events targeting the same process within a one-minute window.
Identifies the deceptive, deeply nested directory structure used to hide the persistent payload, specifically looking for folder creations matching the pattern `AppData\LocalLow\LocalLow\sWindows\Program\sRules\Program\sRules\sNVIDEO`.
Identifies rundll32.exe executing payloads where the exported function name is highly anomalous (over 10 characters, randomized alphanumeric). This behavior is often associated with malware loaders attempting to evade detection by using dynamically generated or obfuscated export names.
Correlates the installation of TiFlux originating from a highly suspicious parent process (like an Office macro, wscript, or an unsigned executable).
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load to execute the compiled ClassLibrary stage filelessly.
Correlates the execution of the TiFlux installer leveraging silent, unattended installation flags to hide its deployment from the user.
Hunts for the stager modifying the UserAuthentication registry key to disable Network Level Authentication (NLA) for RDP, lowering security requirements for the attacker.
Detects WMI interactions targeting the MSFT_NetQosPolicySettingData class within the ROOT\StandardCimv2 namespace. The EDRChoker tool abuses this specific WMI class to silently drop EDR telemetry by limiting bandwidth to unworkable speeds (e.g., 8 bits per second), bypassing standard WFP tampering alerts.
Correlates RuntimeHost.exe spawning suspended RegAsm.exe to inject mining shellcode, followed by network activity. This behavior is indicative of cryptojacking campaigns abusing ScreenConnect and .NET utilities for process hollowing.
Identifies secondary delivery where ScreenConnect runs PS to drop SimpleRunPE disguised as vlc.exe.
Page 418 of 864