Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,129 detections
Filters
Last updated
All Time
Detection languages
6,549
6,209
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,573
3,902
1,466
1,393
1,330
Platforms
13,734
1,392
1,319
824
738
Products / Services
3,828
3,138
2,448
912
908
MITRE Techniques
18,129
15,655
12,603
8,413
6,237
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects PowerShell command lines that simultaneously utilize .NET cryptography classes (TripleDES or AES) for decryption and runspace pipeline creation. This pattern indicates an in-memory execution technique where malicious payloads are decoded and executed directly within the PowerShell process, effectively bypassing disk-based security controls.
Detects the presence of PureLogs Stealer, a .NET-based information stealer, by identifying specific family name strings embedded within PE files that conform to the .NET assembly structure. This rule targets the static analysis of malicious binaries often used in credential harvesting campaigns.
Detects PowerShell scripts attempting to evade detection through programmatic runtime creation using Runspaces (RunspaceFactory, CreatePipeline, AddScript) combined with cryptographic operations or dynamic string substitution techniques. This behavior is often associated with obfuscated malware payloads attempting to execute code in memory.
Detects the use of PowerShell string concatenation to construct the malicious C2 domain 'merabs.pro'. This technique is used to bypass simple string-based detections that look for the full domain name in command-line arguments.
Detects parent process ID (PPID) spoofing associated with RMMCRAT and other HVNC malware, where an injected process (e.g., smartscreen.exe) spawns child processes while spoofing explorer.exe as the parent. The rule monitors for a mismatch between the reported parent (explorer.exe) and the actual creator (smartscreen.exe) and focuses on burst activity of common shell and browser processes.
Detects the creation of scheduled tasks that masquerade as a 'Google Chrome Update' task but are initiated by suspicious processes like cmd.exe, powershell.exe, or schtasks.exe, and do not originate from the legitimate Google Chrome installation directories.
Detects the execution of rundll32.exe with command-line arguments that include references to 'WindowsUpdate.log' and a specific ordinal or function index. This pattern is commonly associated with attempts to leverage rundll32.exe to execute arbitrary code while masquerading as legitimate Windows update operations.
Detects the execution of PowerShell with hidden window style and long Base64 or encoded command strings, which is a common technique used by attackers to execute obfuscated malicious scripts while minimizing visibility on the endpoint.
Detects the execution of rnpkeys.exe dropped by an MSI installer (msiexec.exe) from the C:\ProgramData\keyroll directory. The rule specifically monitors for side-loading of the rnp.dll or tdwp.dll libraries by rnpkeys.exe, a technique associated with the Sauron loader.
Detects anomalous network traffic patterns from the legitimate 'rnpkeys.exe' process when side-loaded from the 'ProgramData\keyroll' directory. The rule specifically looks for a sequence of connections matching initial C2 registration (TLV 0x01) followed by consistent, periodic beaconing (TLV 0x02) at an interval indicating automated task polling, rather than single-connection legitimate activity.
This rule monitors the rnpkeys.exe process for suspicious environmental reconnaissance activity, specifically targeting locale/keyboard-layout registry queries or domain enumeration via command-line tools. These activities are identified as occurring in a strict temporal sequence (pre-registration check) shortly before an initial outbound network connection, consistent with the behavior of the Sauron loader malware.
Detects the creation of a scheduled task named 'keyroll', which is associated with the persistence mechanism of Sauron Loader. The task is used to launch a DLL side-loading chain involving rnpkeys.exe and tdwp.dll.
Detects macOS Terminal commands that involve decoding a base64 string and piping the output directly to bash. This behavior is characteristic of 'ClickFix' social engineering campaigns, where users are lured into pasting a malicious command into their terminal, often under the guise of fake 'reCAPTCHA' or 'bot-verification' instructions.
Detects the execution of rnpkeys.exe from the path C:\ProgramData\keyroll\, which performs DLL side-loading by loading rnp.dll followed by tdwp.dll. This sequence is indicative of the Sauron Loader malware attempting to perform in-memory payload decryption.
Detects instances of process injection targeting the 'attrib.exe' process. This behavior is associated with the Sauron Loader, which performs in-memory shellcode execution by allocating memory and creating a remote thread within a legitimate process, such as 'attrib.exe', to avoid writing payloads to disk.
Detects the execution of staged payloads from the Windows %TEMP% directory. This rule monitors for suspicious activity often associated with loader-style C2 execution, including direct execution of randomly named files, proxy execution via rundll32 or regsvr32, silent MSI installations, and the execution of payloads extracted from archives in temporary locations.
Detects the execution of staged payloads from the Windows %TEMP% directory. This rule monitors for suspicious activity often associated with loader-style C2 execution, including direct execution of randomly named files, proxy execution via rundll32 or regsvr32, silent MSI installations, and the execution of payloads extracted from archives in temporary locations.
Detects unpacked Sauron Loader DLL samples by identifying a specific embedded configuration header (magic 0xbaadf00d) followed by RSA key material length fields. This indicates the presence of malicious configuration structures associated with the Sauron Loader malware.
Detects execution of rnpkeys.exe from the C:\ProgramData\keyroll\ directory, which is indicative of Sauron Loader side-loading activity, followed by an outbound network connection on port 443 within a 5-minute window. This behavior is consistent with the initial bot registration beaconing phase of the malware.
Detects the presence of Sauron Loader by matching known SHA-256 hashes of the MSI installer and associated side-loaded DLLs, or by identifying malicious PE files containing the 'Sauron' string.
Detects instances where the Steam service (steamservice.exe) is executing suspicious child processes such as command interpreters or binaries located in unusual paths like Temp, Downloads, or AppData, often indicating an attempt to hide malicious activity under a trusted process.
Page 98 of 864