Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of PowerShell scripts that utilize large arrays of negative integers to reconstruct and dynamically execute code via the [scriptblock]::Create method. This technique is commonly used to obfuscate malicious payloads such as downloaders or API calls from static analysis.
Detects malicious DLLs identified by specific exports and imports (e.g., rdCore.dll, I++u.dll) that are intended to be sideloaded by signed binaries such as Canon's COTFileReadApp.exe or Stardock software. The detection relies on identifying the combination of sideloaded component names and the presence of suspicious import structures characteristic of these specific staging loaders.
Detects CARBONATO botnet activity where malicious processes are masquerading as legitimate Linux system components. This includes XMRig mining software running as /usr/sbin/systemd-logind, process arguments attempting to mimic kernel kworker threads, or processes running from directories associated with netd-svc/resolved container images.
Detects unauthorized access attempts to a Docker Registry API on port 5000. The rule identifies attempts to enumerate the image catalog and extract sensitive environment variable information from configuration blobs, which may contain hardcoded credentials or indicators of compromise.
Detects instances where msiexec.exe is used in conjunction with specific application names (Spotify, Zoom, Teams) in the command line, and subsequently launches suspicious child processes such as wscript.exe, cscript.exe, or powershell.exe with specific script or executable arguments. This pattern is often associated with malicious installers or trojanized software attempting to execute embedded payloads.
Detects the execution of the XMRig cryptominer masquerading as the legitimate systemd-logind service. The rule identifies suspicious command-line arguments indicative of mining activity, or instances where systemd-logind is spawned from unauthorized parent processes such as shell interpreters, container engines, or nsenter, which is often characteristic of post-exploitation activity like privileged Docker container escapes.
Detects the CARBONATO botnet using two distinct persistence and evasion techniques: masquerading user-space processes as kernel worker threads by setting command line arguments to '[kworker/u2:0]', or disguising mining binaries as the systemd-logind service. Legitimate kernel threads are spawned by PID 2 and lack an executable path, while the legitimate systemd-logind is expected to be spawned by systemd/init.
Detects a successful authentication to Microsoft SQL Server using the 'sa' account from a non-local address. This rule is designed to alert on potentially unauthorized access following a brute-force attack, as identified by the correlation of high-volume authentication failures (Event ID 18456) followed by a successful login (Event ID 18453/18454).
Detects the removal of persistence mechanisms related to the 'ComponentTask33Agent' task, specifically the deletion of a scheduled task or registry Run key, followed by the deletion of associated files within specific Microsoft-themed AppData subdirectories within a 30-minute window.
Detects the creation of a local administrative account with a hidden naming convention (ending in $) accompanied by a cluster of registry modifications designed to obscure the account from the logon screen, enable WDigest plaintext credential caching, relax RDP authentication requirements (disable NLA, enable RDP), and disable UAC remote restrictions. This activity is highly indicative of post-exploitation persistence and credential harvesting configurations following initial access via SQL server exploitation.
Detects execution of an XMRig cryptominer masquerading as the legitimate system process 'smss.exe' from a non-standard file path. This detection specifically identifies the presence of the WinRing0x64.sys kernel driver, often used by XMRig for hardware MSR access, and detects preceding malicious activity involving UnRAR extraction of the miner using a specific password.
Detects RatHat Android dropper applications that utilize automated build rotation to bypass file hash-based detection. The rule identifies stable artifacts, such as specific native library names, string obfuscation indicators, and manifest structure anomalies, that persist across these regenerated builds.
Detects the NeedyMantis second-stage loader, typically encountered as a malicious script (e.g., encryptbase64.ps1). The detection identifies raw shellcode residing in files that exhibit specific traits: PEB-walking for API resolution using a ROR(11) hashing algorithm, the inclusion of the 'RtlDecompressBuffer' API for payload expansion, and the absence of standard PowerShell script headers at the start of the file.
Detects NeedyMantis malware loader components that utilize the RtlDecompressBuffer API for custom XOR-compressed archive extraction. The rule specifically looks for the presence of known staged file names (dnsapi.dll, ws2_32.dll, msvcrt140.dll, or encryptbase64.ps1) alongside decoy file references typically used by the threat actor.
Detects the NeedyMantis malware component loading configuration and communications modules (specifically dnsapi.dll or ws2_32.dll) from a non-standard system directory. This behavior is indicative of DLL hijacking or side-loading, where a malicious library is substituted for a legitimate Windows system library to facilitate command and control or malicious execution.
Detects a specific privilege escalation and code execution chain attributed to the PUROSANGUE methodology. This activity involves using a COM Elevation Moniker (specifically with the 'Elevation:Administrator!new:' syntax) to bypass UAC, followed by process hollowing into ServiceModelReg.exe. The attack is initiated from unconventional parent processes such as vsdbg.exe or its associated DLL.
Detects NeedyMantis first-stage loader activity where a legitimate application (e.g., Poedit, curl, Vim, TightVNC) is executed to load an update or support DLL from a non-standard staging path (e.g., %ProgramData% subdirectories), followed by the presence of a co-located encrypted second-stage archive.
Detects specific malicious archive payloads associated with NeedyMantis that contain a second-stage loader and spoofed system DLLs (e.g., dnsapi.dll, ws2_32.dll, msvcrt140.dll). These archives utilize XOR encoding or RtlDecompressBuffer packing and are designed for DLL sideloading.
Detects the NeedyMantis first-stage loader (e.g., WinSparkle.dll variants) which employs anti-debug techniques such as NtQueryInformationProcess and ThreadHideFromDebugger, alongside stack-based string deobfuscation, to prepare for the extraction and execution of a secondary payload (e.g., encryptbase64.ps1).
Detects a potential TeamFiltration-style compromise where multiple accounts with no history of successful authentication and no MFA enforced authenticate successfully within a 7-minute burst window. This behavior is indicative of an adversary mass-testing or accessing newly compromised dormant or un-secured service accounts.
Detects user authentication events to recruitment, career, or applicant-tracking applications where the connection originates from an anonymizing proxy, VPN, or datacenter IP address. This behavior has been observed as a precursor to North Korean IT worker recruitment fraud, where attackers mask their true geographic location to gain unauthorized employment.
Page 68 of 864