Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)
Detects malicious usage of bcdedit.exe to weaken system boot security. The rule flags commands that disable Windows Recovery (WinRE), boot integrity checks, driver signature enforcement, or force legacy boot policies, which are often used by ransomware like TOKYOCORE to prevent system recovery and hinder defensive remediation.
Detects the creation of a malicious Windows service named 'WinUpdateSvc' with the display name 'Windows Update Service Helper' using sc.exe. This activity is a documented persistence mechanism for the TOKYOCORE ransomware, which executes the binary 'fsociety.exe' with SYSTEM privileges.
Detects unauthorized modification of the BootExecute Registry key to execute a file named 'bootexec.bat'. The BootExecute key, located in 'HKEY_LOCAL_MACHINE\System\CurrentControlSet\Control\Session Manager', is processed by the Windows Session Manager during early system boot. Adversaries can leverage this to maintain persistence or execute malicious code before most security products initialize.
Detects lateral movement patterns involving PsExec or PSEXESVC where either a suspicious command-line flag (e.g., '-psex') is present or the PsExec service spawns child processes like cmd.exe or powershell.exe executing suspicious, obfuscated, or remotely retrieved payloads.
correlates two OS-generated artifacts on the same PID within a 120-second window: a seclogon-spawned process (CreateProcessWithLogonW is the only unprivileged API for remote profile loading) and a PostBootReminders\ProfileError\TempProfile registry write (ProfSvc marks fallback when tampered ntuser.dat breaks normal initialization). neither artifact is attacker-controlled. the time window filters PID-reuse false positives. an attacker could theoretically delay the oplock release beyond the window, so a secondary hunting query without the time filter should be run periodically.
Detects the disabling of User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. Adversaries may disable UAC to bypass elevation prompts and facilitate unauthorized modifications to the operating system.
Detects instances where the Windows Installer process (msiexec.exe) deletes files or folders associated with the 'Config.Msi' directory while running in the context of the SYSTEM account (SID S-1-5-18). Config.Msi is used by Windows Installer for rollback information during installations or updates; unauthorized or suspicious deletions from this location, particularly when initiated by system-level processes, may indicate attempts to hide installation artifacts or manipulate the installer service.
Detects the execution of the McUploader component associated with the GigaWiper malware, which is used for file staging and exfiltration.
Detects evidence of the TELEPUZ malware establishing persistence by installing a Windows service named 'CipherAllocator' or 'PilotmasterMast'. The rule monitors for the installation of these specific services via Windows Event ID 7045, process command line execution, and direct registry key modifications.
Detects the loading of the bindflt.sys Windows Minifilter driver, which is associated with Path Virtualization and file system filtering. Monitoring for this driver can identify when virtualization features or specific system isolation mechanisms are initialized.
Detects the execution of the McUploader component associated with the GigaWiper malware, which is used for file staging and exfiltration.
Detects the use of reg.exe to modify registry keys associated with Windows crash-dump settings and automatic reboot policies. Such modifications are indicative of attempts to inhibit system recovery and hinder incident response analysis, often associated with wiper malware such as GigaWiper.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects the execution of the PsExec service component (psexesvc.exe), which is often used for remote command execution and lateral movement. The rule monitors for the process starting, particularly when it originates from legitimate Windows service management processes like services.exe or wininit.exe.
Detects abuse of comsvcs.dll MiniDump export to dump LSASS or other process memory
for credential access.
for credential access.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects the use of bcdedit.exe and reagentc.exe to disable Windows system recovery and boot failure remediation, a common technique used by malware to inhibit system restoration after a destructive or ransomware attack.
Detects the execution of the McUploader component associated with the GigaWiper malware, which is used for file staging and exfiltration.
This rule detects the registration of the 'CipherAllocator' Windows service associated with the TELEPUZ malware. It monitors registry modifications related to service creation, specifically identifying the usage of 'grpeng.dll' from a suspicious path ('C:\ProgramData\XeroxPrint\Temp\Worker\') and specific 'svchost' registry configurations used for persistence.
Detects the creation or modification of a Windows service named 'ThumbcacheService', which has been associated with the GoSerpent campaign for file collection. The rule monitors both registry modifications indicative of service installation and process execution patterns using sc.exe, reg.exe, powershell.exe, or cmd.exe that reference this specific service name.
Page 16 of 61