Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,683
9,759
6,695
4,421
3,750
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects the execution or presence of specific Go or Terraform modules known to be malicious or associated with suspicious dependency retrieval. It monitors command-line activity from terraform.exe/go.exe attempting to download/run from these paths, as well as file system events involving these specific folder paths and filenames.
This rule detects the execution or presence of specific Go or Terraform modules known to be malicious or associated with suspicious dependency retrieval. It monitors command-line activity from terraform.exe/go.exe attempting to download/run from these paths, as well as file system events involving these specific folder paths and filenames.
This rule detects instances where the Terraform CLI tool connects to suspected lookalike domains associated with supply chain compromise attempts (e.g., hashicorp-aws[.]com or hashicorp-terraform[.]io) during common initialization or application workflows. It correlates process execution with network connection logs and optionally validates the presence of a related .terraform.lock.hcl file associated with the malicious origin.
This rule detects instances where the Terraform CLI tool connects to suspected lookalike domains associated with supply chain compromise attempts (e.g., hashicorp-aws[.]com or hashicorp-terraform[.]io) during common initialization or application workflows. It correlates process execution with network connection logs and optionally validates the presence of a related .terraform.lock.hcl file associated with the malicious origin.
This rule detects mass file modification, creation, or renaming activity involving files with the '.krsid' extension. The threshold is set to monitor for more than 20 occurrences, which is indicative of potential ransomware encryption activity, while explicitly excluding common system, temporary, and development paths, and filtering out processes explicitly performing shadow copy deletion.
Detects rapid execution of multiple native Windows discovery commands (whoami, ipconfig, hostname, tasklist) within a short window, which is often indicative of an adversary performing environment reconnaissance post-compromise.
Detects the execution of files related to 'UBPPatch' or 'HTSPnew', specifically looking for PowerShell scripts (.psh) or executables (.exe) that match these potentially non-standard or obfuscated update/patch filenames. The rule also looks for command lines referencing 'Update.Lst', often associated with custom or unauthorized patch mechanisms.
Detects behavior indicative of KRSID ransomware, characterized by mass file renaming to the .krsid extension and the creation of a 'ransomware-silent.Log' file. The detection specifically correlates this activity with the absence of vssadmin shadow copy deletion commands, which is an atypical behavior for most ransomware families, thereby serving as a distinguishing heuristic.
The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines.
Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads.
This activity is uncommon in typical enterprise environments outside of software development contexts.
Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads.
This activity is uncommon in typical enterprise environments outside of software development contexts.
Detects process command lines containing LLM tool-calling syntax (e.g., 'tool_call', 'function_call') in conjunction with keywords associated with offensive security capabilities (e.g., 'exploit', 'mimikatz', 'exfiltrate'). This pattern is consistent with the behavior of malicious LLM-based agents attempting to autonomously invoke and execute offensive tasks.
Detects the execution of a renamed Microsoft CoreCLR Debugger (vsdbg.exe) from a directory outside of standard Visual Studio installation paths. This behavior is indicative of DLL side-loading, where a malicious vsdbg.dll is planted alongside the renamed vsdbg.exe, a technique observed in malware loader chains like Rapuncel/BoryptGrab.
This rule detects the presence of ZigCryptoStealer malware deployed via a NativeAOT-compiled Windows executable. The detection relies on identifying specific hardcoded infrastructure strings, such as a BNB Smart Chain RPC endpoint and a specific contract address used to resolve C2 domains. It also looks for common sideloading hosts associated with the malware's delivery.
Detects high-frequency calls to the VirtualProtect API where memory protections are changed to read/write (PAGE_READWRITE) or executable read/write (PAGE_EXECUTE_READWRITE). This behavior is often indicative of process injection techniques or self-modifying code associated with unpacking, loading shellcode, or tampering with process memory.
Detects evidence of the PIVOTPIPE .NET loader attempting to disable AMSI scanning. The detection focuses on activity related to patching the 'AmsiScanBuffer' function within 'amsi.dll', specifically identifying the use of the hex signature '80070057' or direct references to the function name, which is an indicator of an AMSI bypass attempt performed to facilitate malicious code execution.
This rule detects instances where the legitimate remote desktop application AnyDesk (AnyDesk.exe) acts as the parent process to spawn a Windows command shell (cmd.exe) or execute a batch script (.bat). This behavior is often indicative of unauthorized remote access or the execution of malicious payloads by adversaries leveraging remote support tools.
This rule detects network connections or DNS requests to domains specifically structured to impersonate MFA registration, passkey setup, or SSO login pages. These domain patterns are commonly associated with phishing campaigns intended to harvest credentials, session tokens, or bypass multi-factor authentication (AiTM phishing).
This rule detects unauthorized processes attempting to access 'Login Data' files associated with Google Chrome or Microsoft Edge web browsers. Legitimate browser processes are excluded, so any external process attempting to read these files is potentially malicious, indicating an attempt to dump stored browser credentials.
Detects the execution of rundll32.exe with command-line arguments that include references to 'WindowsUpdate.log' and a specific ordinal or function index. This pattern is commonly associated with attempts to leverage rundll32.exe to execute arbitrary code while masquerading as legitimate Windows update operations.
Detects the execution of rnpkeys.exe dropped by an MSI installer (msiexec.exe) from the C:\ProgramData\keyroll directory. The rule specifically monitors for side-loading of the rnp.dll or tdwp.dll libraries by rnpkeys.exe, a technique associated with the Sauron loader.
Detects instances where critical system processes (such as svchost.exe, lsass.exe, or w3wp.exe) spawn known command-line interpreters or script execution utilities (e.g., cmd.exe, powershell.exe, certutil.exe) which then initiate outbound network connections to common ports (445, 3389, 135, 5985, 5986, 1433, 80, 443) that are external to the local network. This behavior is often associated with lateral movement, command and control (C2) communication, or reconnaissance.
This rule detects potentially malicious child processes (cmd.exe or powershell.exe) spawned by PaperCut application processes (pc-app.exe, PCClient.exe, or java.exe), which may indicate exploitation attempts such as RCE following an authentication bypass.
Page 17 of 100