Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects rundll32.exe loading davclnt.dll triggered by a .wsh script for WebDAV access. This activity can be indicative of an adversary attempting to force authentication to capture credentials or to facilitate ingress tool transfer.
Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for paths matching the pattern AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\ and excludes common browser update processes.
Parses Python execution strings to detect inline, on-the-fly decompression and execution of the CastleLoader script without touching disk.
Detects the malware copying itself into the localized cache directory under the hardcoded campaign ID D3F4E2A1, specifically looking for 'RuntimeHost.exe' being created in that path.
Detects the specific defense evasion tactic where malware invokes wevtutil to clear event logs immediately after executing its payload, effectively taunting defenders. This rule specifically looks for 'wevtutil.exe' being executed with the 'cl' (clear log) command-line argument, and filters out common legitimate processes like cmd.exe, powershell.exe, and explorer.exe as initiating processes.
Identifies authentication binaries (sshd, su, sudo) loading a pam_unix.so module that contains anomalous compile-time RPATHs pointing to the attacker's staging directories, as observed in the Velvet Ant campaign.
Detects PowerShell reflectively loading .NET assemblies from memory using [Reflection.Assembly]::Load, explicitly bypassing disk IO to execute the compiled ClassLibrary stage.
Employs regex to identify the highly specific, deceptive, deeply nested directory structure (LocalLow Windows\Program Rules NVIDEO) used to hide the persistent payload.
Detects PowerShell adding a Defender exclusion path to C:\ProgramData. This activity can be indicative of an adversary attempting to disable or modify security tools to avoid detection.
This rule detects when a single process account initiates the deletion of 10 or more executable (.exe), dynamic link library (.dll), or system (.sys) files within a 5-minute window on a device. This behavior can be indicative of malicious activity such as malware cleanup, anti-forensics, or an attempt to disrupt system functionality.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
This rule detects repeated successful operations related to public access or firewall configuration changes within Azure Activity Logs. A high count (3 or more) of such operations by the same caller within an hour could indicate malicious activity, such as an attacker attempting to open up network access to compromised resources or exfiltrate data.
Detects potential credential access attempts indicative of infostealer activity or brute-force attacks, where an account experiences multiple failed login attempts followed by a successful login within a defined timeframe (5 minutes to 8 hours). This pattern suggests an adversary may be using stolen credentials or attempting to brute-force an account.
This rule detects the execution of ScreenConnect client services or MSI installers when initiated by common scripting or installer processes such as wscript.exe, cscript.exe, powershell.exe, or msiexec.exe. This behavior can indicate the abuse of legitimate remote monitoring and management (RMM) tools for malicious purposes, such as initial access, persistence, or remote control by adversaries.
This rule detects Portable Executable (PE) files that contain a cluster of API calls commonly associated with process doppelganging techniques, specifically targeting the 'spoolsv.exe' process. The presence of 'NtCreateTransaction', 'CreateFileTransacted', 'NtCreateSection', 'NtCreateProcessEx', and 'NtCreateThreadEx' in conjunction with 'spoolsv.exe' suggests an attempt to inject malicious code into a legitimate process using advanced evasion techniques.
Detects when an actor searches Slack audit logs, which could indicate an attacker attempting to understand logging capabilities or evade detection. Also detects bulk session resets initiated by an administrator, which may be a response to an account takeover or an attacker attempting to evict legitimate users from their sessions.
Detects multiple instances of a non-SYSTEM or non-LOCAL SERVICE account using 'RunAs' to execute processes as highly privileged accounts (admin, system, root) within a short timeframe. This could indicate an attempt at privilege escalation or token impersonation.
This rule detects suspicious command-line activity related to Duo Security administration. It looks for processes executing with 'duo_client', 'duo_admin', or 'duo_api' in their command line, combined with sensitive parameters like '--admin-api', '--key', '--secret', or 'token'. The rule specifically excludes processes spawned by 'powershell.exe' or 'cmd.exe' to reduce noise, and triggers if such activity occurs at least twice within an hour on the same computer by the same user. This could indicate an attempt to manipulate Duo Security configurations, potentially to bypass multi-factor authentication.
This rule detects suspicious process activity indicative of process injection, specifically looking for the creation of remote threads combined with memory allocation, writing to process memory, and loading of DLLs. It monitors Security Event ID 4688 (a process creation event) and filters for command-line arguments containing functions commonly used in process injection techniques such as 'CreateRemoteThread', 'VirtualAllocEx', 'WriteProcessMemory', 'GetProcAddress', and references to '.dll' or 'LoadLibrary'. A count of such events within an hour is then used to identify potential injection attempts.
This rule detects an account performing multiple interactive logons (LogonType 2) from at least 3 unique IP addresses within a 5-minute window. This behavior can indicate credential compromise or an adversary attempting to move laterally or access multiple systems using stolen credentials.
Detects use of strip or UPX to remove debug information from malware
Page 429 of 864