Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
KQL Query
This rule detects the creation of a Windows service named 'Cloud Sync Service' using command-line tools like 'sc.exe' or 'New-Service', or via direct service event monitoring. This behavior is often associated with malware persistence mechanisms that use misleading names to blend in with legitimate software services.
This rule detects suspicious process execution chains originating from ScreenConnect (ConnectWise Control) service. It monitors for common living-off-the-land binaries (LolBins) or specific suspicious command-line patterns (e.g., encoded commands, credential discovery commands) being spawned by the ScreenConnect process, which is often abused by threat actors such as APT35/Magic Hound for remote access and persistence.
Detects Zoom-related processes (zoom.us.exe, Zoom.exe, CptHost.exe) modifying registry keys within the Windows CapabilityAccessManager ConsentStore for webcam or microphone access. This activity indicates the system is recording the time a process initiated hardware access, potentially signaling unauthorized surveillance or post-compromise activity.
Detects the creation and configuration of a Windows service named 'media_updaten' via command-line utilities (sc.exe) or direct registry modification. This service is associated with CoolClient for persistence to relaunch 'Sang.exe' with a 'work' parameter.
Detects efforts to clear Windows Event Logs using PowerShell (Clear-EventLog, EventLogSession.ClearLog) or wevtutil.exe (cl, clear-log). This behavior is characteristic of anti-forensic activities performed by ransomware like Nova to impede incident response and investigation efforts.
This rule detects the use of the Windows Boot Configuration Data Editor (bcdedit.exe) to modify system recovery settings. Specifically, it looks for attempts to disable recovery features or instruct the boot manager to ignore failures. Such modifications are common in ransomware and destructive attacks to prevent users from using Windows recovery tools to restore the system or access backups.
Detects anomalous scheduled task execution by identifying processes named 'csvchost.exe' or 'psvchost.exe' that reference GoogleUpdateService or MSEdgeUpdateService task names containing GUID patterns. It further correlates this with suspicious command-line indicators such as 'App.py' references, 'WakeToRun' flags, '-headless' flags, or PowerShell bypass techniques, which are associated with the delivery of CountLoader and DeviceManager RATs in DOUBLECUP campaigns.
Detects post-exploitation persistence artifacts on Windows endpoints managed by N-able N-central consistent with abuse of CVE-2026-18577, including a new Windows service named Cloudflared, registry Services key creation for Cloudflared, a file named svchost.exe written under a user's Documents folder, or process execution of cloudflared.exe or a Documents-located svchost.exe.
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
Detects recreation of svchost32/Cloud Sync Service persistence (registry Run key, Windows service, or scheduled task) within 15 minutes of removal, indicative of CornFlake backdoor re-installation following remediation.
Detects redundant persistence mechanisms associated with the CornFlake RAT by identifying the creation of Windows services, registry run keys, and scheduled tasks that reference a binary named svchost32.exe located outside of the standard C:\Windows\System32 directory, often masquerading as a 'Cloud Sync Service'.
Detects the creation of a Windows service named 'svchost32' with a display name of 'Cloud Sync Service' via administrative command-line utilities like sc.exe, PowerShell, or cmd.exe. This activity is a known persistence mechanism for the CornFlake RAT, which masquerades as a legitimate system process to evade detection.
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
Detects execution of pOneDrive.exe, cOneDrive.exe, or mOneDrive.exe running from a user profile or AppData path (outside standard Program Files/System32/SysWOW64 locations) whose PE OriginalFileName does not match the on-disk image name, indicative of CountLoader binary impersonation delivered via the DOUBLECUP loader.
This rule detects the creation of a Windows service named 'Cloud Sync Service' using command-line tools like 'sc.exe' or 'New-Service', or via direct service event monitoring. This behavior is often associated with malware persistence mechanisms that use misleading names to blend in with legitimate software services.
Detects potential Cl0p ransomware activity by correlating the deletion of Volume Shadow Copies or backup catalogs with a subsequent burst of file creation, modification, or renaming activity on the same device. This behavior is indicative of ransomware preparing to encrypt files by inhibiting system recovery, followed by the mass encryption stage, while filtering out known administrative and legitimate software update activity.
Adversaries may abuse msiexec.exe to proxy execution of malicious payloads.
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Msiexec.exe is the command-line utility for the Windows Installer and is thus commonly associated with executing installation packages (.msi)
Detects modifications to the 'LoadAppInit_DLLs' or 'RequireSignedAppInit_DLLs' registry values within the 'Windows NT\CurrentVersion\Windows' key. This technique is often used for persistence or to force-load a malicious DLL into processes that load user32.dll.
Detects potential persistence attempts by monitoring suspicious modifications to Windows Winlogon registry keys, specifically targeting Shell, Userinit, GinaDLL, and Notify subkeys associated with the TOKYOCORE malware.
Detects the creation of a Windows service using 'sc.exe' with names or command-line indicators associated with legitimate Windows update services, a technique commonly used by the TOKYOCORE malware for persistence.
Page 15 of 61