Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects a suspicious behavior pattern where PowerShell initiates an 'msiexec.exe' process to install an MSI file located in a temporary directory, followed by that MSI process launching a secondary executable from a '%LOCALAPPDATA%\Programs\' folder. This pattern is commonly associated with malware installation or post-exploitation activities where an attacker attempts to masquerade an executable as a legitimate program.
This rule detects potential malicious activity where the binaries 'COTFileReadApp.exe' or 'DeElevate64.exe' initiate child processes or are themselves parent processes to suspicious binaries such as 'rundll32.exe', 'regsvr32.exe', 'msiexec.exe', 'powershell.exe', or script hosts ('wscript.exe', 'cscript.exe'). This pattern is indicative of a RAT (Remote Access Trojan) or sideloading chain dropping and executing follow-on payloads.
Detects the FileFix (ClickFix) social engineering technique, where an attacker tricks a user into pasting malicious command lines into the Windows File Explorer address bar. The rule correlates a process execution (PowerShell, Cmd, Mshta) originating from explorer.exe with recent registry writes to shell history artifacts (RunMRU, TypedPaths, or ShellBags) within a 120-second window, identifying the characteristic 'paste-and-execute' behavior.
Detects instances where a process loads both amsi.dll and the .NET CLR (clr.dll or mscoree.dll) within a 60-second window, excluding known legitimate .NET and PowerShell hosts. This behavior is indicative of an in-memory shellcode loader attempting to bypass AMSI protections before executing .NET payloads in memory, a technique frequently observed in sophisticated malware campaigns.
Detects a suspicious pattern consistent with rapid handoff from an initial access broker to an operator: a user account is added to a privileged group (e.g., Domain Admins) followed within 5 minutes by successful logins to 3 or more distinct hosts. This behavior indicates immediate privilege escalation followed by rapid lateral movement.
Detects instances where the XMRig cryptominer is masquerading as the legitimate systemd-logind process on Linux hosts. The rule triggers on process execution of /usr/sbin/systemd-logind coupled with suspicious outbound network connections to known mining pools or mining-related ports.
Detects anomalous database activity on Magento e-commerce platforms where a SELECT operation against sensitive payment-related tables is followed by a DELETE operation on the same table within the same host context. This sequence is indicative of an attacker exfiltrating credit card data and subsequently attempting to remove forensic evidence of the theft.
Detects the CLOSEDQUORUM implant communicating with multiple LLM providers (DeepSeek, Qwen, Mistral, or Gemini) for quorum-based decision making, followed by the same process spawning or injecting into a legitimate Windows system process (e.g., svchost, explorer) to conduct post-exploitation activities.
Detects potential process injection attempts where a process is created in a suspended state (often used for hollowed or injected code) and subsequently performs sensitive remote memory or thread operations (e.g., NtAllocateVirtualMemoryRemote, WriteProcessMemoryRemote) on that process.
Detects a suspected anti-debugging and anti-instrumentation sequence on Android devices. This rule identifies instances where 'getprop' is used to query system properties related to device security (ro.debuggable, ro.secure) followed shortly by a local network probe to the standard Frida instrumentation server port (27042). This combination is indicative of malware gating its execution to ensure it is not running within a controlled or debugged environment.
Detects suspicious cross-process memory access events, such as PROCESS_VM_WRITE and PROCESS_SUSPEND_RESUME, often indicative of process hollowing or Early Bird APC injection. The rule monitors for elevated granted access masks originating from non-system processes, a behavior associated with the CLOSEDQUORUM implant's post-compromise activities.
Detects the creation of Windows services by known binary hosts frequently utilized by NeedyMantis for DLL sideloading. This activity is indicative of the persistence phase where the actor's 'is' module registers itself as a service to ensure survival across system reboots following the execution of the sideloading chain.
Detects the execution of msiexec.exe with flags indicating a silent installation (/passive) where the package source is a remote URL (http:// or https://). This behavior is commonly associated with ClickFix campaigns and other malware delivery methods that attempt to trick users into installing malicious Windows Installer packages.
Detects execution of msiexec.exe via the Windows Run dialog (launched by explorer.exe) that utilizes a remote URL for an MSI installer alongside suspicious property flags ('ORG_NOTE', 'passive'). This pattern is associated with 'ClickFix' social engineering campaigns where users are instructed to copy-paste commands to 'fix' a display issue, leading to the execution of malicious installers.
This rule detects when the MpDlpService.exe process loads the 'mpclient.dll' library from a location other than the legitimate Windows Defender program directories. This behavior is indicative of potential DLL side-loading or hijack execution flow attempts targeting the Microsoft Data Loss Prevention service.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
Detects a multi-stage, automated attack chain performed by AI-based development agents (e.g., Claude, Copilot, Cursor). The rule correlates process discovery, credential access, file collection (staging), and exfiltration over web services within a tight 15-minute window, identifying potential autonomous exploitation and data exfiltration. Covered T1046, T1552.001, T1078, T1005, T1567
Detects the execution of PowerShell from web browser parent processes (chrome, edge, firefox, iexplore) using obfuscation techniques (hidden window, encoded command, no profile) combined with an indicator of WebDAV access (DavWWWRoot), which is commonly used to execute payloads from remote network shares.
Detects extension code implementing Caesar-shift-over-base64 decoding of a remote proxy server list fetched from dead-drop hosts, feeding a PAC-based proxy configuration
Detects PowerShell commands that load images (JPG/PNG) and parse their pixel data for encoded payloads. This technique, often associated with Invoke-PSImage, uses steganography to hide malicious scripts within image files, which are then extracted using GDI+ methods (GetPixel) or byte manipulation and executed in-memory via IEX or assembly reflection.
This rule detects the use of 'mshta.exe' to execute HTML (.html, .htm) or MHTML (.mhtml, .mht) files. This behavior is often associated with bypassing Mark-of-the-Web (MotW) protections, as attackers may use container formats to deliver files that do not properly inherit MotW markings when extracted, allowing them to be opened by 'mshta.exe' without restrictive security policies.
Page 42 of 864