Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects process injection attempts using ptrace or LD_PRELOAD originating from scripting languages like Python or Node.js. This technique is associated with the SPECTRALVIPER threat group for process hollowing and defense evasion.
Captures the scheduled cleanup task executed via cmd to terminate headless Edge instances lacking CoreUIComponents.dll. This activity is associated with the SNOWBELT threat actor group, specifically targeting defense evasion by checking for the presence of a specific DLL.
Identifies the implant injecting threads into explorer.exe to mask outbound network traffic, specifically when the initiating process is 'setup.exe'.
Detects local memory allocations changing state to PAGE_EXECUTE_READWRITE inside Go-compiled executables to execute shellcode. This behavior is indicative of reflective code loading, often used by malware to evade detection.
This rule detects executables running from more than four levels deep within the AppData/Local directory, a technique often used by malware to mimic legitimate applications or cache directories like NVIDEO or 2.0 cache.
Detects the environmental preparation stager modifying registry keys to forcefully re-enable Windows Script Host and restore .vbs file associations.
Detects executable or script files dropped in the deceptive Windows sound diagnostics package folder, representing decoded payload bytes.
This rule detects attempts to disable real-time monitoring features, specifically targeting the 'DisableRealtimeMonitoring' setting using PowerShell's 'Set-MpPreference' cmdlet. This activity is often associated with adversaries attempting to evade detection by security software.
Detects local development directories where the compromised package matches a fake GitHub user repository URL, specifically looking for 'package.json' file events (creation or modification) within folder paths containing 'maximus-mcmillan'. This is indicative of the Stitch-SDK scope squatting credential harvester technique.
Identifies outbound HTTP GET requests fetching masqueraded Donut shellcode disguised as .woff web font files from non-browser processes. This rule specifically looks for network events where the remote URL ends with '.woff' and the initiating process is not a common web browser (chrome.exe, msedge.exe, firefox.exe).
Detects Node.js executing inline base64 encoding specifically aimed at configuration files prior to exfiltration.
Detects VSPMsg.dll written beneath the x64 print processor directory from ProgramData or another staging path. The condition requires the reported SprySOCKS component, path, or execution relationship rather than a common Windows artefact alone.
Correlates at least three Defender service state changes within thirty minutes with exclusion, disable, stop, or start commands issued by the same device. The condition combines the Defender exploitation or tampering sequence with a follow-on security impact.
Detects attempts to disable Defender Real-Time Monitoring by modifying a specific registry key and value. This action indicates an adversary trying to impair defensive capabilities.
Detects the use of the Electron setLoginItemSettings API for startup persistence. This API allows Electron-based applications to configure themselves to launch automatically when a user logs in, which can be abused by adversaries to maintain access to a system.
Detects notepad.exe spawned by explorer.exe that immediately initiates network connections, which is a known behavior of Brute Ratel C4 (BRc4) when performing Parent PID Spoofing.
Detects network traffic associated with the Meow backdoor's beaconing activity. Specifically, it looks for outbound network connections on port 666 initiated by 'rundll32.exe'. This pattern is indicative of malware using a common system utility to establish command and control communications.
Detects attempts to disable Microsoft Defender's Behavior Monitoring feature by modifying specific registry keys. This activity is often indicative of an adversary trying to evade detection by security software.
Detects the creation of the XWorm specific mutex 'HOHE6S8FaZZlGf0f'. This mutex is known to be used by the XWorm malware to ensure only a single instance of itself is running on a system.
This rule detects instances where 'node.exe' or 'bun.exe' are executed from common user-writable directories (AppData, ProgramData, Public Users, Temp) and are initiated by common Windows shell processes (cmd.exe, powershell.exe, wscript.exe, cscript.exe, mshta.exe). It excludes executions from known legitimate development-related paths to reduce false positives.
Detects the Cloudflared tunnel binary being renamed to svchost.exe and then used to establish a tunnel. This is indicated by the process name being 'svchost.exe' and the command line containing 'tunnel', '--url', and '--no-autoupdate'. This technique is often used by adversaries to masquerade malicious activity as legitimate system processes.
Page 428 of 864