Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the execution of 'ComputerDefaults.exe' without command-line arguments, which is a known method for User Account Control (UAC) bypass. It then correlates this activity with outbound network connections to specific ports (5443, 8041, 8443, 80, 443), indicating potential post-exploitation communication or data exfiltration after privilege escalation.
Detects modifications to Chrome's ExtensionInstallForcelist policy to inject malicious extensions, specifically when initiated by cmd.exe or powershell.exe. This activity is associated with the UnregStealer malware.
Detects the use of legitimate administrative tools (regsvcs.exe, infinstall.exe, devcon.exe) being executed with command-line arguments indicative of driver or kernel-level installations (e.g., 'kernel', 'ring0', 'driver install'). This behavior is commonly associated with the installation of rootkits or the execution of Bring Your Own Vulnerable Driver (BYOVD) attacks to gain kernel-mode privileges.
Detects instances of common, sensitive Windows system binaries (svchost.exe, lsass.exe, sms.exe, csrss.exe) being executed by parent processes other than the legitimate system processes (services.exe, smss.exe, csrss.exe, winlogon.exe), indicating potential process masquerading or path spoofing.
This rule monitors registry modifications for keys or values related to common virtualization platforms (VirtualBox, VMware, QEMU, Xen, Hyper-V). Such registry queries or modifications are often indicative of malware performing sandbox evasion to determine if the execution environment is a virtual machine or a sandbox used for analysis, allowing the malware to terminate or alter its behavior to avoid detection.
Detects the execution of VBScript (wscript.exe or cscript.exe) with unusually long command lines containing common obfuscation patterns such as character replacement or string splitting. This pattern is indicative of attempts to hide malicious code from static analysis.
Detects the loading of DLLs with suspicious names ('hook.dll', 'inject.dll', 'logger.dll', 'loader.dll') from common user-writable directories such as 'Temp', 'AppData', or 'Downloads'. These patterns are frequently associated with malware loaders, persistence mechanisms, or unauthorized code injection attempts.
Detects the execution of executable files with suspicious command line arguments related to AI or Machine Learning frameworks (e.g., tensorflow, pytorch, neural) where the file size is relatively small (between 50KB and 500KB), which may indicate potentially malicious payloads masquerading as legitimate AI utilities.
This rule detects the execution of the squid.exe process where the command line does not explicitly specify a configuration file using the '-f' or '-n' flags, nor does it reference 'squid.conf'. Running Squid without a defined configuration file may lead to the application loading default, insecure, or unintended settings, which could be exploited as part of a vulnerability chain or misconfiguration.
Detects the loading of the Huawei HWAuidoOs2Ec.sys driver, which has been abused in Bring Your Own Vulnerable Driver (BYOVD) attacks for defense evasion and privilege escalation.
Monitors for device code authentication via uncommon Family of Client IDs (FOCI) applications. This rule identifies successful device code authentications where the application ID (AppId) has been observed fewer than 5 times, indicating potentially rare or newly introduced applications. This could be indicative of an adversary attempting to use a malicious application for device code phishing.
Detects bursts of Google Workspace device registrations for a single user in a short window, specifically when 3 or more devices are registered within a 1-minute interval for the same account.
Detects execution of DbgView64.exe spawning suspicious child processes such as command interpreters (cmd.exe, powershell.exe), network utilities (net.exe), system information tools (whoami.exe), or DLL execution utilities (rundll32.exe). This behavior is indicative of Backdoor.Turn side-loading, where a legitimate application is used to load malicious code.
Detects Node.js executing the Fortemedia audio utility fmapp.exe, indicative of a staged DLL sideloading attack orchestrated by a script.
Detects mshta executing any HTA file originating from the anomalous C:\Users\Public\USOShared-* path, as observed in Operation XENOFISCAL.
Detects the python loader renaming the LICENSE.txt file as an obfuscation technique, as observed in campaigns leveraging AI brands as bait in social engineering.
Detects the deletion of .pkg_history or .pkg_logs, an anti-forensic attempt after the dropper completes, associated with the Mastra NPM compromise.
This rule detects attempts to manipulate Windows Management Instrumentation (WMI) Quality of Service (QoS) policies, specifically targeting the 'MSFT_NetQosPolicySettingData' class. This activity is indicative of the EDRChoker technique, which aims to throttle network traffic for Endpoint Detection and Response (EDR) agents to hinder their telemetry and block their functionality. The detection logic looks for WMI events or process command lines containing references to 'MSFT_NetQosPolicySettingData' along with 'ThrottleRateAction' or 'AppPathNameMatchCondition'.
Detects SYSTEM privilege escalation attempts via ctfmon.exe or cloudfiles.exe processes.
This YARA rule detects components associated with the SprySocks malware, specifically looking for the '\Device\RawWNPF' device name in conjunction with kernel concealment-related API strings such such as 'NtQuerySystemInformation', 'nsiproxy', 'FwpmFilterAdd', and 'KdDisableDebugger'. The presence of these strings together indicates potential rootkit activity aimed at hiding malicious processes or network activity.
Detects a manual kernel mapper referencing a Fonts-hosted encrypted driver and PE relocation APIs. The rule looks for specific strings often associated with malicious kernel-mode operations, including references to the Windows Fonts directory, and API calls like ZwAllocateVirtualMemory, RtlImageNtHeader, MmGetSystemRoutineAddress, and DriverEntry, which are indicative of dynamic driver loading and PE header manipulation.
Page 419 of 864