Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the Python wrapper and native dropper deleting their own unicode.py and terminate.dll components after the payload has been unpacked. The rule specifically looks for file deletion events where the target file name matches 'unicode.py' or 'terminate.dll' within common application data directories (site-packages, dist-packages, AppData, Temp) and the command line contains deletion-related keywords.
Detects Python scripts utilizing ctypes, ptrace, or process_vm_readv to perform advanced, programmatic memory scraping without relying on shell utilities. This activity can be indicative of credential dumping or other forms of sensitive data exfiltration from process memory.
Detects a signed or expected game updater loading an unsigned DLL from the application directory, consistent with a compromised update package or side-loading chain. This rule specifically looks for image load events where the loaded module is a DLL, the module path is within common program directories (Games, Program Files, ProgramData), and the actor process is identified as a game, launcher, updater, or patch executable.
Identifies the execution of the ClientDelete command designed to wipe traces of the Realtek-disguised malware from the disk. Specifically, it looks for 'cmd.exe' executing a 'del' command with 'RealtekAudio' in the path, which is a known pattern for AsyncRAT self-deletion.
Detects files executing with double extensions designed to trick users (e.g., .pdf.exe). This rule specifically looks for process events where the filename matches a pattern of a common document/image/archive extension followed by an executable extension.
Detects the simultaneous launching of a clean decoy PDF and a malicious script (specifically PowerShell) within the same second, often used by malware like AsyncRAT for distraction during execution.
Monitors for attempts to modify ClickOnce registry trust settings to suppress security prompts for unsigned packages, which can be used by attackers to install, persist, and update malware without administrative rights.
Detects a Python runtime (such as userscreen.exe or python.exe) executing a file with a .cat extension. This technique is used by APT37 NarwhalRAT to conceal Python bytecode payloads.
Detects modification of the Magefile or related integrity markers inside the ClickOnce cache, a technique used to alter payloads post-deployment.
Detects the in-memory execution of .NET assemblies from the Go implant using the extracted execute-assembly_windows.go structures. Specifically looks for 'mscoree.dll' being loaded by a process named 'setup.exe'.
Captures the self-deletion execution phase corresponding to Opcode 0x1B removing the implant from the host disk. This rule specifically looks for 'setup.exe' deleting itself.
Detects process injection telemetry targeting spoolsv.exe followed by an unusual svchost child or related launch from the same initiating process. The condition requires the reported SprySOCKS component, path, or execution relationship rather than a common Windows artefact alone.
Detects potential credential access attempts indicative of infostealer activity or brute-force attacks, where an account experiences multiple failed login attempts followed by a successful login within a defined timeframe (5 minutes to 8 hours). This pattern suggests an adversary may be using stolen credentials or attempting to brute-force an account.
Detects attempts to stop the Windows Security Health Service using the 'sc.exe' command-line utility. This service is crucial for Windows security features, and stopping it can indicate an attempt to impair defenses.
This rule detects processes that attempt to set the 'BlockNonMicrosoftBinaries' mitigation policy using 'SetProcessMitigationPolicy'. This policy is typically used to prevent the loading of non-Microsoft signed DLLs into a process, which can be an evasion technique used by adversaries to hinder analysis or prevent injection by security products.
Detects attempts to sideload a malicious DLL named 'NotepadPlusPlus.dll' from a user's AppData folder. This technique is often used by adversaries to achieve persistence, escalate privileges, or evade defenses by masquerading malicious code as a legitimate library.
Detects unique INFINITERED marker strings in process command lines or event metadata. The indicators include the upgrade-code GUID delimiter, its Base64 representation, the stolen-session identifier prefix, and the custom file-download command tag. These values are specific to the reported malware and should be treated as high-confidence evidence when present.
Correlates the execution of the trojanized scp binary passed with the '!' flag, an internal trigger designed to disable SELinux enforcing mode prior to payload execution. This rule specifically looks for 'scp' command-line executions containing '!' and excludes standard scp syntax that might contain '@' for user@host.
Detects modification of Group Policy Objects for privilege escalation
Detects hard deletion of mailbox data to remove forensic email evidence
Detects removal of Zone.Identifier ADS to bypass MOTW security prompts
Page 420 of 864