Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,651
12,599
8,410
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects an anomalous burst of git clone, fetch, or download events performed by a single GitHub user account against a large number of private repositories within a short timeframe (15-minute window). This pattern often indicates unauthorized bulk collection or exfiltration of sensitive source code by an actor using a valid account.
Detects GitHub OAuth authorization, repository cloning, or ZIP downloads from source IP addresses that have not been observed for the specific actor within the past 30 days. This rule helps identify potential account compromise or token theft where an attacker attempts to access repository data from a new location, while specifically excluding bot/service accounts known for rotating CI infrastructure IPs.
Detects the IIS worker process (w3wp.exe) used by SharePoint loading a specific combination of assemblies (PresentationFramework.dll, System.Xaml.dll, and System.Data.Services.dll). This behavior is indicative of an ExpandedWrapper/XamlServices.Parse() insecure deserialization gadget chain, typically associated with the exploitation of vulnerabilities like CVE-2026-65660, which enables fileless in-memory code execution.
Detects instances where Chrome or Microsoft Edge processes are spawned from suspicious AppData subdirectories that do not match standard installation paths. This behavior is indicative of credential theft malware, such as RevStealer, which launches browser processes as debugged child processes from unique working directories to recover App-Bound encryption keys.
This rule detects instances where PowerShell is launched with hidden window arguments by explorer.exe or mshta.exe, and the command line indicates interactions with specific file extensions (.vbs, .ps1) located within the AppData directory. This pattern is often indicative of malicious script execution, such as those used in Konni malware campaigns to drop and execute payloads.
Detects the execution of a RevStealer native PE payload by an Electron-based loader (XabivSystem.exe). The rule identifies when the loader spawns an unsigned, detached process from a hidden, randomly-named subdirectory within the user's AppData folder. This process creation is a precursor to the malware's environment checks, anti-VM/sandbox gating, and CAPTCHA verification routines.
Detects a non-privileged user creating a new DLL file within the C:\ProgramData\CrossDevice\ directory on a system that has specific COM registration keys (CLSID {135fd325-45b7-4c30-89f8-4386961669f0} or {E9F83CF2-E0C0-4CA7-AF01-E90C70BEF496}) pointing to potentially missing or hijacked InprocServer32 paths. This is a common technique used for COM Hijacking or Persistence via phantom DLL loading.
Detects instances where dllhost.exe (COM Surrogate) running under high-integrity accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) loads an unsigned DLL file located in the C:\ProgramData\ directory. This pattern is commonly associated with DLL side-loading or malicious library injection to maintain persistence or escalate privileges.
Detects instances where dllhost.exe (COM Surrogate) running under high-integrity accounts (SYSTEM, LOCAL SERVICE, NETWORK SERVICE) loads an unsigned DLL file located in the C:\ProgramData\ directory. This pattern is commonly associated with DLL side-loading or malicious library injection to maintain persistence or escalate privileges.
Detects the custom ARX-based stream cipher used by Vidar Stealer (v2.2+) to encrypt strings and configuration data. The rule identifies the presence of specific FNV-1a and golden-ratio constants used for state initialization, in combination with unique, per-build keystream constants observed in recent variants.
Detects a SYSTEM-level dllhost.exe process, associated with specific COM object instantiation (CLSID {135fd325-45b7-4c30-89f8-4386961669f0}), loading a DLL from the C:\ProgramData\ directory. This behavior is indicative of an attacker-planted DLL being unmarshaled through a crafted OBJREF, effectively bypassing security controls like EOAC_NO_CUSTOM_MARSHAL.
Detects the presence of PIVOTPIPE .NET loader components within files by searching for specific magic bytes, debug strings, hardcoded developer file paths, and agent-related operational strings.
Detects the GHAPPIER four-stage loader execution chain initiated during npm postinstall processes. This rule monitors for malicious child process spawning (cmd, powershell, curl, wget) by node or npm, as well as the presence of specific markers like the '.git-checker' string or URLs associated with the PolinRider/FAMOUS CHOLLIMA npm supply chain campaign.
Detects the presence of PIVOTPIPE loader artifacts, specifically the COFF sleep-mask object file (sleepmask.o) and its associated debug log (nb_sleep_dbg.txt), which are written to a randomly named subfolder within the Windows temporary directory as part of a sleep-obfuscation evasion sequence.
This rule detects the presence of ZigCryptoStealer malware deployed via a NativeAOT-compiled Windows executable. The detection relies on identifying specific hardcoded infrastructure strings, such as a BNB Smart Chain RPC endpoint and a specific contract address used to resolve C2 domains. It also looks for common sideloading hosts associated with the malware's delivery.
Detects unauthorized attempts to modify or patch the AmsiScanBuffer function within amsi.dll in a remote process. This behavior is indicative of an AMSI bypass attempt, a technique often used by malicious loaders and fileless malware to evade security product scanning.
This rule detects suspicious process injection activity directed at explorer.exe. It looks for cases where explorer.exe is initiated by a non-standard parent process and performs remote thread creation, thread context manipulation, or process image mapping, which are common techniques used by malware to hide execution within a legitimate system process.
Detects high-frequency calls to the VirtualProtect API where memory protections are changed to read/write (PAGE_READWRITE) or executable read/write (PAGE_EXECUTE_READWRITE). This behavior is often indicative of process injection techniques or self-modifying code associated with unpacking, loading shellcode, or tampering with process memory.
Detects evidence of the PIVOTPIPE .NET loader attempting to disable AMSI scanning. The detection focuses on activity related to patching the 'AmsiScanBuffer' function within 'amsi.dll', specifically identifying the use of the hex signature '80070057' or direct references to the function name, which is an indicator of an AMSI bypass attempt performed to facilitate malicious code execution.
Detects the PIVOTPIPE loader extracting a 'sleepmask.o' Common Object File Format (COFF) file into a temporary directory prefixed with 'nb_'. This behavior is associated with the deployment of post-exploitation sleepmask functionality designed to obfuscate or encrypt beacon memory footprints to evade memory scanners.
Detects malicious JavaScript/npm payloads that attempt to evade static analysis and string-based detection signatures by dynamically reconstructing sensitive strings at runtime using V8 string-object construction or obfuscated string tables.
Page 92 of 864