Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects web browsers connecting via Port 80 (HTTP) to domains that strictly mandate HTTPS (HSTS bypass), revealing SSL stripping via DNS hijack. Specifically targets 'login.microsoftonline.com' and 'okta.com'.
Detects the creation and subsequent deletion of a scheduled task within a short timeframe (5 minutes), which can indicate an attacker attempting to cover their tracks after executing a malicious task.
Detects Kazuar clearing specific Security logs via the ClearEventLog Windows API immediately after lateral movement. The rule specifically looks for 'ClearEventLogApiCall' actions and excludes common legitimate tools like 'wevtutil.exe' and 'powershell.exe' that might perform similar actions.
Detects Kazuar executing process hollowing into legitimate Windows binaries like taskhostw.exe to blend in with normal OS behavior. This rule specifically looks for instances where 'taskhostw.exe' is the target process but its command line does not contain 'taskhostw.exe', indicating a potential suspended or hollowed launch, combined with network activity originating from that process.
Correlates a Valid-signed executable starting a legitimate Windows binary (e.g., svchost.exe) in a suspended state for memory injection.
Detects the use of bcdedit to configure the system to boot into Safe Mode with Networking, a technique often used by malware like Storm-1175 to bypass EDR during the encryption phase.
Correlates the malicious executable launching the embedded decoy .docx document to divert user attention during infection.
Detects a dropper deriving a decryption key from hostname or machine attributes before unpacking a second-stage module. The rule specifically looks for process command lines containing keywords related to hostname/computername/machineguid/volume serial combined with decryption-related terms like decrypt, aes, xor, payload, or byte array.
Detects a worker DLL or executable loaded from the Kazuar working directory shortly after a bridge process creates IPC channels. This behavior is indicative of the Kazuar malware's operational methodology, where a main 'bridge' component loads various 'worker' modules to perform malicious tasks.
Detects the execution of 'userscreen.exe', which is the masqueraded name used for 'pythonw.exe' by APT37's NarwhalRAT. This defense evasion technique hides the Python console window and blends in with legitimate system processes before loading its fileless payload into memory.
Detects an appx package that was added to the pipeline of the "to be processed" packages which was downloaded from a file sharing or CDN domain.
Detects BITS transfer job downloading files from a file sharing domain.
Detects the download of suspicious file type from a well-known file and paste sharing domain
Detects PowerShell connecting to an IP to download an image file containing embedded Base64 markers (<<BASE64_START>>). This behavior is associated with the Vidar stealer, which uses steganography to hide its payload within image files.
Detects a malicious executable imitating the .NET Runtime Optimization Service when found in the ProgramData folder. This is a common technique used by adversaries to masquerade malicious processes as legitimate system components.
Identifies the Python loader generating the decryption key using hashlib.sha512 over an embedded parameter.
Detects attempts to stop the wscsvc (Windows Security Center) service using 'sc.exe'. Adversaries may stop security services to impair defenses and avoid detection.
Detects an attacker disabling Code Access Security (CAS) publisher validation by modifying a .NET .config file, specifically looking for modifications to files ending with '.config' in conjunction with a process command line containing 'generatePublisherEvidence'.
Identifies dfshim.dll invoked via ShOpenVerbApplication processing the fake Adobe manifest parameters.
Hunts for the IAT_PHANTOM_FIX evasion routine where Python generates thousands of SHA-512 hashes to delay execution and fool heuristics. This rule specifically looks for 'python.exe' processes executing command lines that contain a loop iterating a large number of times (at least 1000) and performing SHA-512 hashing, indicative of anti-analysis techniques used by malware like XWorm.
Detects execution of mmc.exe from unusual file paths, specifically outside of standard Windows System32 or SysWOW64 directories. This behavior can indicate an attempt to impersonate legitimate system processes, potentially by malware like Brute Ratel C4.
Page 423 of 864