Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
KQL Query from file: Email Bombing and Teams Impersonation Detection
Detects modifications to the Windows registry that disable the
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Microsoft Vulnerable Driver Blocklist by setting
VulnerableDriverBlocklistEnable to 0. This technique is used by threat actors,
such as the PoisonX RAT, to load vulnerable drivers (BYOVD) and evade or blind
EDR sensors.
Detects the use of `conhost.exe` with the `--headless` flag to stealthily execute the Deno runtime (`deno.exe`). This technique is utilized by the DinDoor backdoor to establish hidden persistence on compromised endpoints.
Detects the Deno runtime executing an in-memory script passed as a Base64-encoded Data URI, effectively bypassing disk monitoring. This technique is utilized by threat actors (e.g., DinDoor) to execute fileless malware payloads.
Detects PowerShell executing certutil.exe to decode base64 files, specifically when a hidden window style is used. This behavior is indicative of the JSE dropper routine employed by the Kimsuky threat group to decode malicious payloads to disk.
Detects the DLL sideloading primitive used by the ValleyRAT (SilverFox APT)
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
Detects variable splitting technique in cmd.exe to obfuscate PowerShell invocation.
This rule detects the use of Azure Managed Identity tokens originating from non-Azure IP spaces. This scenario is indicative of token theft, likely via the Instance Metadata Service (IMDS) endpoint (169.254.169.254), followed by an external replay of the stolen token from an attacker's infrastructure. Legitimate Managed Identity calls are expected to originate from Azure infrastructure IPs. The rule filters out legitimate Microsoft/Azure ASNs and RFC1918 private IP ranges to reduce false positives. It also categorizes the potential attack stage based on the operation name, including Key Vault access, Storage access, VM Code Execution, Privilege Escalation, and Directory Enumeration.
Detects the execution of mshta.exe attempting to download and execute a remote payload masquerading as an msixbundle file.
Detects chmod usage that sets SUID or SGID bits, which can be abused for privilege escalation.
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
2 is the special bit for SGID
4 is the special bit for SetUID
6 combines the special bits for SetUID and SGID
This rule detects the creation of scheduled tasks (`schtasks.exe /create`) where the command line arguments contain suspicious executables or paths commonly associated with malicious activity. This indicates a potential persistence mechanism being established by an adversary.
Detects the creation of scheduled tasks that explicitly call mshta.exe, matching the persistence mechanism of the CountLoader payload launcher.
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
Detects the creation of specific files associated with the UAC-0184 threat group, often used in DLL sideloading scenarios. The rule looks for the presence of 'cluster-overlay64.exe', 'plane9engine.exe', 'plane9engine.dll', 'openvr_api.dll', 'kernel-diag.lib', and 'filter.bin' in common temporary or user data directories. It triggers if three or more of these files are found within an hour, or if 'kernel-diag.lib' or 'filter.bin' are present.
Detects workloads created with privileged mode, host namespace sharing, dangerous Linux capabilities, Docker socket, containerd socket, or sensitive hostPath mounts. These configurations can be abused by adversaries to escape containers and gain access to the underlying host.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning.
Detects the execution of scripts (.vbs, .js, .wsf, etc.) proxied through explorer.exe or rundll32.exe (via shell32.dll).
Threat actors embed these commands in .LNK files to bypass direct cscript/wscript detections and break process tree lineage. Because the user executes the LNK from the GUI, the desktop explorer.exe acts as the parent, mimicking normal user activity.
Threat actors embed these commands in .LNK files to bypass direct cscript/wscript detections and break process tree lineage. Because the user executes the LNK from the GUI, the desktop explorer.exe acts as the parent, mimicking normal user activity.
Identifies instances of mshta.exe being used to execute remote payloads over HTTP/HTTPS. This matches the initial ClickFix access vector used in the Amatera Stealer campaign.
KQL Query
Detects the creation of scheduled tasks named 'ChromeCheck' or 'EdgeCheck' that execute regsvr32.exe. This behavior is associated with Kimsuky's MemLoad loader, which establishes persistence to deploy the httpTroy backdoor.
Detects file access attempts targeting the erroneous SysWOW64 path for Kaspersky drivers. This is a specific bug and a high-confidence indicator of Amatera Stealer's anti-sandbox and evasion checks. The malware specifically looks for 'klif.sys', 'kldisk.sys', 'klhk.sys', and 'kneps.sys' within the incorrect '\Windows\SysWOW64\drivers' directory.
Page 475 of 864