Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects use of macOS resource forks to hide malicious data
Detects the creation of an executable file in temporary directories (temp or appdata\local\temp) that is then executed by cmd, powershell, or another executable. This pattern is often observed with malware downloaders that stage and execute their payloads in temporary locations.
This rule detects the creation of suspicious executable files (.exe, .dll, .sys) in temporary or user-specific directories shortly after a Microsoft Defender component (MsMpEng, NisSrv) or system error reporting (WerFault) or service host (services) process terminates unexpectedly. This behavior can indicate an attempt to drop and execute malicious payloads following a potential exploit or crash of security software.
This rule detects the creation of suspicious executable files (.exe, .dll, .sys) in temporary or user-specific directories shortly after a Microsoft Defender component (MsMpEng, NisSrv) or system error reporting (WerFault) or service host (services) process terminates unexpectedly. This behavior can indicate an attempt to drop and execute malicious payloads following a potential exploit or crash of security software.
This rule detects an unusually high volume of object close operations (Event ID 4658) by a single user on a single computer within a one-hour window. This activity could indicate various malicious behaviors, including data collection for exfiltration, attempts to delete numerous files, or resource exhaustion attacks.
Udm Aspose Email Load
YARA-L
Targets Aspose.Email DLL loading by a user-writable or masquerading executable rather than an approved mail application. The UDM rule retains principal and target context for correlation.
Targets symbolic link, junction, or reparse-point operations against Defender quarantine, platform, or scan paths. The UDM rule retains principal and target context for correlation.
Targets plain, encoded, double-encoded, and mixed-separator path traversal in a JRPC request. The UDM rule retains principal and target context for correlation.
Detects highly obfuscated PowerShell command lines that utilize various encoding and execution techniques, often indicative of malicious activity. The rule scores different obfuscation methods (XOR, Hex, Base64), execution methods (ScriptBlock, IEX), and payload indicators (URLs, download functions). A high total score and specific thresholds for execution and obfuscation trigger the alert. It also considers suspicious parent processes like browsers or scripting hosts.
Identifies RuntimeBroker_update.exe sideloading the malicious Rust loader masquerading as UnityPlayer.dll. This detection specifically looks for the loading of 'UnityPlayer.dll' by 'RuntimeBroker_update.exe' in conjunction with the presence of a 'Com.dat' file, indicating the RUSTCLOAK malware's DLL sideloading technique.
Identifies the execution of the Connection.dll RAT spawning the decoy Meeting Room process, specifically looking for the loading of 'Connection.dll' and the simultaneous execution of 'SystemtUpdateTaskMachine.exe' by the same initiating process.
Detects PowerShell excluding targeted mining executables and RuntimeHost.exe from Microsoft Defender Antivirus scans. This activity is indicative of cryptojacking campaigns attempting to evade detection.
Generalized advanced detection for DLL sideloading from unprotected directories (Downloads, Temp, Public) followed by network beaconing. This rule identifies specific DLLs (autorun.dll, UnityPlayer.dll, UpdateChecker.dll, uevmonitor.dll) being loaded from these suspicious locations and then initiating network connections.
This rule detects suspicious activity where a malicious DLL (AggregatorHost.dll) is injected into a process that then explicitly interacts with 'steam.exe' by accessing its files. This behavior is indicative of malware targeting Steam users, potentially to steal credentials or items.
Detects the creation or modification of 'endpointdlp.dll' and 'data.bin' files on disk, which are key indicators of the MLTBackdoor infection chain prior to DLL sideloading. This rule focuses on the initial staging of these malicious components.
This rule detects when a single user principal name (UPN) attempts five or more sign-ins from the same IP address within a one-hour window, and each sign-in is flagged with a 'RiskDetail' other than 'none' but still results in a 'Success' status. This could indicate an attacker attempting to bypass security controls or an account compromise where the attacker is repeatedly trying to access the account from a consistent location, possibly with different credentials or methods, until successful.
Correlates mshta connecting to abimj.edu.af followed by a file write of zuidrt.hta or a .vmxx shellcode file, indicative of the Operation XENOFISCAL campaign.
Detects when a Network Security Group (NSG) rule is successfully deleted in Azure. This could indicate an attempt to bypass network access controls, potentially to enable unauthorized access or exfiltration.
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
Detects trusted developer utilities abused as execution proxies for defense evasion
Detects SID history manipulation for domain privilege escalation
Page 432 of 864