Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects unauthorized installation, service creation, and registry modifications associated with the RustDesk remote access tool. The rule monitors for command-line activity indicating the installation of RustDesk as a service, execution of installation scripts, and imports of configurations from non-standard locations, which may indicate the deployment of unauthorized remote access software for C2 purposes.
This rule detects process execution attempts where specific arguments (such as '--b' or '-b') are used alongside strings associated with malicious C2 configuration, such as command-line flags for server, key, group, organization identifiers, or external domain references. This behavior is indicative of command-line obfuscation and the smuggling of C2 configuration data within process launch arguments, a technique often used to evade signature-based security controls.
Detects the Snowlight dropper (UNC5221) installing a new Windows service named 'Windows Update Service' that utilizes a non-standard executable file named 'wusvc.exe' to achieve persistence and masquerade as the legitimate Windows Update service (wuauserv).
Detects attempts to clear Windows event logs using the wevtutil utility (clearing Security, System, or Application logs) or the native Windows event log clearing event ID 1102 (The audit log was cleared).
Detects the creation of a Windows service named 'wsftprm'. This specific service name is often associated with malicious activities, particularly in historical cases involving persistent threats or unauthorized software installation.
Detects DLL search order hijacking of legitimate Windows binaries consent.exe or icardagt.exe. The rule triggers when these binaries are executed from non-standard, user-writable directories (e.g., %TEMP%, %APPDATA%), which is a common technique used by the BumbleBee malware loader to sideload a malicious msimg32.dll.
Detects the loading of the 'pcdhost.sys' driver, which is associated with malicious activity, and correlates this event with potential defensive evasion techniques such as mass termination of security-related processes or the usage of 'sc.exe' for service creation. The rule also looks for specific debug string artifacts within process memory or payloads that indicate potential malicious behavior.
Detects the loading of the vulnerable OPSWAT AppRemover driver (pcdhost.sys) from a non-standard file path, often used as a Bring Your Own Vulnerable Driver (BYOVD) technique by the ResiLoader malware to elevate privileges and gain kernel-level access to terminate security software. The rule also monitors for mass process termination events indicative of successful security product disabling.
Detects the manual or malicious termination of security-related processes, including antivirus software, endpoint protection agents, and diagnostic/monitoring tools (e.g., Task Manager, Process Explorer, Wireshark). Such behavior is often indicative of an adversary attempting to impair security defenses to facilitate further malicious activity.
Detects the clearing of Windows Security or System event logs using either the 'wevtutil' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. This activity is commonly associated with anti-forensic efforts by adversaries to remove evidence of malicious actions, such as credential harvesting, following a compromise.
Detects the loading of the known vulnerable OPSWAT AppRemover driver (pcdhost.sys). This driver is often abused in Bring-Your-Own-Vulnerable-Driver (BYOVD) attacks, such as those performed by ResiLoader, to execute code in kernel mode and bypass security controls, ultimately allowing the termination of protected security processes.
Detects the modification of the 'ServiceDLL' Registry value for a Windows service to a path that resides outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. This behavior is often associated with service hijacking or persistence techniques where an adversary points a service to a malicious DLL for execution.
Detects persistence mechanisms used by Vidar/SnappyClient (Operation Turb00), specifically the creation of a malicious Windows service named CadenceOptimizer and the hijacking of a Svchost service-group (Brn_Agent) to load a malicious DLL (agt.dll) from the ProgramData directory with SYSTEM privileges.
This rule detects attempts to clear Windows event logs using either the 'wevtutil.exe' command-line utility or the 'Clear-EventLog' PowerShell cmdlet. Adversaries often clear event logs to hide evidence of their activity on a compromised host.
Detects various methods of disabling or tampering with Windows Defender protections, including modifying preferences via PowerShell (Set-MpPreference), stopping the WinDefend service via sc.exe, terminating the antivirus process via taskkill, or modifying Registry keys associated with Defender policies.
Detects a Windows system BugCheck (Blue Screen of Death) event that occurs within two minutes of a process termination event. This behavior can be indicative of a process intentionally causing a system crash, often utilized by malware that abuses critical-process protection or attempts to evade analysis by forcing a system halt.
Detects the mass termination of processes related to productivity suites (Office, Thunderbird), database management (SQL, Oracle, MySQL, Postgres), system backups (VSS), and security monitoring/analysis tools (Task Manager, Wireshark, Process Explorer/Monitor). This activity is highly suspicious and may indicate an attacker attempting to disrupt services, hinder analysis, or prepare a host for destructive activities like data encryption or deletion.
This rule detects the frequent installation of KVM-related hardware devices (e.g., PiKVM, USB video/HID devices) on a single host. Multiple installations of such devices in a short window may indicate the unauthorized connection of remote access hardware, potentially used to establish a covert command and control channel.
Detects attempts to clear Windows Event Logs using either the command-line utility 'wevtutil.exe' or the PowerShell cmdlet 'Clear-EventLog'. Additionally, it monitors for Windows Security Event ID 1102, which specifically indicates the clearing of the Security log. These actions are common indicators of an adversary attempting to remove evidence of their activity from a host system.
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Detects the creation of a Windows service named 'RageService' using the sc.exe utility, potentially involving associated binary names like 'RageCore_' or 'win_guard_'. This activity is indicative of persistence mechanisms used by malware or unauthorized tools.
Page 18 of 61