Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects modifications to the 'BootExecute' registry value within the 'Session Manager' key. The 'BootExecute' value, typically set to 'autocheck autochk *', controls programs that execute automatically during the Windows boot process. Adversaries can add arbitrary executables or scripts to this multi-string value to achieve persistence and gain code execution before user logon.
Rule for T1548.002 technique "Bypass UAC using Event Viewer (cmd)"
Detects execution patterns associated with the DragonReturn loader, which implements a timing delay loop using GetTickCount64 before executing secondary actions, such as deploying a Windows service via sc.exe.
This rule monitors for indicators of process hollowing or memory injection targeting ServiceModelReg.exe. It correlates suspicious events including the creation of suspended processes, memory writes, remote thread creation, specific debug strings (e.g., RUNPE, PEB patched), and outbound network connections. This approach aims to reduce noise from legitimate use of ServiceModelReg.exe by requiring multiple indicators of malicious behavior.
Detects the creation of a new Windows service where the service executable is located outside of standard system directories (e.g., C:\Windows\ or C:\Program Files\), which is followed by outbound network communication to known SnappyClient C2 ports 3333 or 3334.
This rule detects unauthorized exfiltration of stolen browser and credential data by the Yuta/Glove Stealer malware (winupdate.exe). It identifies outbound HTTPS network connections from the specific indicator file path '%APPDATA%\.cache\winupdate.exe' to known C2 endpoints, including Discord webhooks, Telegram bot APIs, or connections utilizing the 'python-requests' user agent.
Detects the loading of known vulnerable drivers (e.g., ProcessMonitorDriver.sys, inpoutx64.sys) associated with 'The Gentlemen' RaaS group, used in BYOVD attacks to elevate privileges and terminate security products.
Detects attempts to stop or delete security-related processes and services, such as Sysmon, SentinelOne agents, Windows Defender, and logging agents like Filebeat. This is often an indicator of an adversary attempting to impair security defenses to hide malicious activities.
Detects the creation or configuration of Windows services spawned by WinGet-related processes such as ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe. This activity is often associated with software installation or configuration management but could be abused by adversaries to establish persistence or execute code with elevated privileges.
Detects behavior associated with the SnappyClient remote access trojan, specifically identifying the execution of 'VirtualAr.exe', which performs GDI-based screen capture and keyboard hooking via 'SetWindowsHookEx', followed by the staging of stolen data within the 'ProgramData\Mayanex\Nata' directory.
Detects instances where the FortiTray.exe process is launched by the FortiClient scheduler (scheduler.exe). This pattern is typical of standard FortiClient operation, but can be used as a baseline for monitoring application behavior.
This rule detects the installation or modification of kernel-mode drivers on Windows systems. It identifies potential driver installation activities using 'sc.exe' to create a service with a kernel-type driver image, or by monitoring Registry 'ImagePath' updates for services that point to '.sys' files, a common method for rootkit or malicious driver persistence.
Detects the use of the Windows service control utility (sc.exe) to install or manage a malicious service named 'MixedSvc'. This activity, which involves pointing the service executable to 'Mixed Reality.exe' located in the Windows Media Player directory, is a persistence technique observed in Operation DragonReturn attributed to the Silver Fox threat group.
Detects the installation, service creation, and network activity associated with Tailscale VPN on endpoints. The rule monitors for process creation of Tailscale binaries, creation of associated registry keys, and outbound network traffic to Tailscale infrastructure or the internal 100.64.0.0/10 CGNAT mesh range, which may indicate unauthorized persistence or remote access.
Detects the installation of a driver service using sc.exe from suspicious, non-standard directories (e.g., Temp, AppData) or involving common driver extensions (.sys). This behavior is indicative of the Bring Your Own Vulnerable Driver (BYOVD) technique, often used to load vulnerable drivers to bypass or disable security products, consistent with activities attributed to various threat actors.
Detects the creation or modification of WMI event subscriptions via EventID 5861 from the Microsoft-Windows-WMI-Activity log. This activity, involving EventFilters, EventConsumers, or FilterToConsumerBindings, is a well-known technique used by adversaries to establish persistence and achieve execution triggered by system events, often resulting in elevated SYSTEM privileges.
Detects the abuse of msiexec.exe to execute malicious payloads, a technique observed in the StrikeShark campaign. The rule identifies suspicious child processes, installation from remote sources (UNC/HTTP), execution from non-standard user-writable directories (Temp, AppData), and the use of quiet installation flags to mask malicious activity.
This rule detects the frequent installation of KVM-related hardware devices (e.g., PiKVM, USB video/HID devices) on a single host. Multiple installations of such devices in a short window may indicate the unauthorized connection of remote access hardware, potentially used to establish a covert command and control channel.
Detects the drop or installation of known vulnerable drivers associated with the 'The Gentlemen' ransomware group's Bring Your Own Vulnerable Driver (BYOVD) tactics, or the creation of kernel-mode services by unsigned binaries. These techniques are often used to gain kernel-level privileges and disable security software.
Detects malicious attempts to clear Windows Event Logs using native utilities like wevtutil or PowerShell, or by direct file deletion of .evtx files. This behavior is common in post-exploitation cleanup phases by threat actors, such as The Gentlemen RaaS, to hinder incident response and forensic analysis.
Detects attempts to clear Windows Event Logs via common administrative tools such as 'wevtutil.exe', PowerShell, or the detection of specific system events indicating logs have been cleared (Event IDs 1102 and 104).
Page 19 of 61