Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
This rule detects the execution of 'mshta.exe' when its command line contains a URL pointing to a '.7z' archive. This behavior is suspicious as mshta.exe is often abused by adversaries to download and execute malicious content, and downloading an archive directly via mshta.exe is not a typical legitimate use case.
Detects the execution of mshta.exe containing a URL with an '@' character to spoof a legitimate domain (e.g., www.bbc.com@malicious.com), a technique used by Gamaredon in the GammaPhish stage to obfuscate the real C2 domain.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
This rule detects suspicious DLL side-loading activity. It looks for DLL files being loaded from common user-writable or temporary directories (like `\temp\` or `\users\`) by legitimate Windows processes such as `rundll32.exe`, `explorer.exe`, or `svchost.exe`. The rule specifically flags instances where a DLL is loaded more than 3 times within an hour by these processes, indicating potential malicious activity where an adversary might be attempting to execute their own malicious DLLs by hijacking the loading process of a legitimate application.
Detects Google Chrome being launched with multiple flags designed to suppress crash dialogs and session restore bubbles. This behavior is indicative of forced browser restarts after a hijacker modifies Secure Preferences, as seen with malware like FlutterShell and Calendaromatic (CL-CRI-1089).
Detects file write operations to '/mnt/runner' indicating a sudoers configuration modification. This technique is utilized by the Miasma npm malware to grant passwordless sudo access for privilege escalation on GitHub Actions CI/CD runners.
Detects the creation of Vulkan components (e.g., vulkan-1.dll, .bin files) within the C:\Program Files\Common Files\ directory. This behavior is associated with TA4922 leveraging RomulusLoader for persistence via DLL sideloading.
Detects the creation, modification, or renaming of the TieringEngineService.exe executable within the System32 directory. This activity is associated with the RedSun exploit (CVE-2026-41091), which leverages Defender remediation redirection to plant a malicious binary. The rule specifically filters out legitimate Windows update operations originating from the WinSxS directory to reduce false positives.
Detects registry modifications to Windows Explorer Advanced settings designed to hide file extensions, hidden files, and protected operating system files. This defense evasion technique is commonly used by malware, such as Gamaredon's GammaWorm, to conceal dropped payloads and replaced LNK files from the user.
Detects suspicious process activity originating from WSMProvHost, suggesting potential lateral movement or remote command execution
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
Detects the execution of mshta.exe fetching a .7z payload from a remote URL, as observed in ClickFix campaigns delivering AnimateClipper.
Identifies instances where a Jupyter Notebook is opened and initiates suspicious child shell processes. This may indicate the execution of embedded malicious HTML or scripts attempting to automate UI interactions, such as bypassing extension installation prompts in VS Code environments.
This rule detects attempts to bypass User Account Control (UAC) by monitoring modifications or creations of specific registry keys. Adversaries often manipulate these registry keys to achieve privilege escalation without triggering a UAC prompt, allowing them to execute malicious code with elevated permissions. The rule specifically looks for changes to registry paths commonly abused in UAC bypass techniques, such as those related to ms-settings, mscfile, Environment\UserInitMprLogonScript, exefile, Folder, and Image File Execution Options.
This rule detects suspicious device enrollment attempts via Microsoft Intune Company Portal from a country not previously observed in a user's 7-day sign-in history. It identifies two primary patterns: sustained successful sign-ins from a new country, indicating a potential active session and successful device enrollment (High Severity), or Conditional Access Policy (CAP) blocked attempts from a new country, suggesting an attacker probing with stolen credentials (Medium Severity). The detection aims to identify identity theft leading to unauthorized device enrollment.
MSHTA HTA Application Download
Suricata
This rule detects the download of an HTML Application (HTA) file that contains the string "<HTA:APPLICATION". HTA files can be used to execute malicious code, often bypassing browser security restrictions. The rule specifically looks for HTTP traffic where the URI contains ".hta" and the file data contains the HTA application tag, indicating a potential attempt to deliver or execute a malicious HTA.
This rule detects the delivery of shellcode via HTTP that contains a NOP sled pattern. The rule specifically looks for a sequence of eight or more '90' (hexadecimal) bytes in the HTTP response body, which is a common indicator of a NOP sled used to prepare for shellcode execution. The detection is focused on traffic flowing from the server to the client over an established HTTP connection.
This rule detects the download of a potential bootkit payload designed to overwrite the Master Boot Record (MBR). It specifically looks for HTTP traffic where the file data contains the byte sequence '|55 AA|' (which corresponds to the MBR signature) within the first 512 bytes and has a total size greater than 500 bytes. This pattern is indicative of malicious software attempting to modify the MBR for persistence or system control.
This rule detects potential JavaScript obfuscation within HTTP responses by looking for the presence of both 'eval(' and 'unescape(' within the first 500 bytes of file data in a client-bound HTTP flow. This combination of functions is often used in malicious JavaScript to hide its true intent and evade detection.
This rule detects attempts to disable the system firewall via HTTP traffic. It specifically looks for the 'netsh firewall disable' command within the HTTP flow, indicating a potential defense evasion tactic.
This rule detects attempts to modify the remote registry via Server Message Block (SMB) by looking for the strings "winreg" and "RegSetValue" in TCP traffic destined for port 445 on the home network. This activity could indicate an attacker attempting to establish persistence, elevate privileges, or evade defenses by altering system configurations.
Page 470 of 864