Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule monitors DeviceProcessEvents for the execution of known malicious binaries associated with the SilverFox malware. It specifically looks for occurrences of three distinct SHA256 file hashes within the last 30 days.
Detects instances where the Adobe ColdFusion service (jrun.exe or java.exe) spawns common command-line shells, administrative tools, or utility processes. This behavior is indicative of potential exploitation of ColdFusion vulnerabilities, such as CVE-2023-26360 or CVE-2023-29298, where an adversary gains initial access and executes commands on the underlying system.
Detects credential dumping attempts against the Local Security Authority Subsystem Service (LSASS) process. The rule identifies processes attempting to access LSASS memory using specific access masks often associated with credential extraction, or the presence of the Mimikatz 'sekurlsa::logonpasswords' command in the process command line.
Detects the creation or execution of a scheduled task named 'CreateObjectTask' via schtasks or PowerShell, which is associated with spawning 'dllhost.exe' as a child process under high-privileged parent processes (svchost, taskeng, or schtasks). This behavior is indicative of potential COM hijacking or privilege escalation techniques leveraging system tasks.
Detects the creation of a DLL file within the 'ProgramData\CrossDevice\' directory. This path is associated with a dangling COM InprocServer32 registration and does not exist by default. The creation of files in this location by non-privileged processes is indicative of staging malicious DLLs for exploitation of COM-based privilege escalation chains, specifically CVE-2026-66804 and CVE-2026-50343.
This rule detects the use of PowerShell cmdlets often associated with enumerating COM object registrations, specifically targeting 'InProcServer32' registry keys. Such enumeration is a common reconnaissance step for identifying 'dangling' COM objects—registrations that point to missing or non-existent files—which can be exploited to achieve DLL Hijacking or persistence via COM hijacking.
Detects JavaScript loaders associated with the Exvicy/ErrTraffic campaign. The rule identifies obfuscated code that utilizes atob() for Base64 decoding, single-byte XOR operations, TextDecoder for content processing, and dynamic code execution via 'new Function()'. This pattern is commonly used to inject malicious payloads into compromised WordPress sites.
Detects malicious HTTP POST requests targeting SharePoint servers that attempt to inject 'Register' directives into pages or manipulate WebPartPage ToolPane markup, indicative of attempts to bypass SafeControls or exploit vulnerable SharePoint features for code execution.
Detects JavaScript code within HTML pages designed to block browser developer tools (F12, Inspect, View Source) using keydown event listeners. This technique is commonly associated with ClickFix-style phishing campaigns to prevent users or security analysts from inspecting malicious page content or fake CAPTCHA overlays.
Detects behavior consistent with the RevStealer malware, specifically focusing on cross-process operations against web browsers originating from hidden AppData subdirectories and the creation of its unique single-instance mutex.
Detects the use of PowerShell to modify Microsoft Defender settings to add an exclusion path within the AppData directory. This behavior is often associated with malware or threat actors attempting to whitelist malicious payloads to evade security scanning.
Detects PowerShell execution that combines screen capturing capabilities (System.Drawing.Bitmap, Windows.Forms) with network communication (System.Net.WebClient) directed towards known C2 domains (medianewsonline.com) using specific exfiltration parameters (OKey, Who).
Detects unauthorized processes attempting to open handles to Google Chrome or Microsoft Edge with elevated permissions, specifically accessing thread context (often associated with hardware breakpoints used for process injection or credential extraction techniques).
Detects suspicious process access attempts targeting common web browsers (chrome, msedge, firefox) using high-privilege access masks (such as 0x1F0FFF or 0x1FFFFF). The detection is specifically scoped to calls originating from unbacked memory (indicated by an UNKNOWN stack trace entry containing ntdll.dll), which is a common indicator of direct or indirect syscalls used by malware for stealthy memory access, such as credential theft or session cookie exfiltration.
Detects a suspicious behavior chain characteristic of information stealers like Vidar. The process first modifies the Windows Registry to disable the Windows Error Reporting (WER) UI (an anti-analysis technique to suppress crash dialogs) and shortly thereafter initiates an outbound network connection to a public IP, likely for C2 communication or data exfiltration.
Detects a low-privileged account manually triggering the 'CreateObjectTask' scheduled task, which is a known technique to force the 'Shell Create Object Handler' (dllhost.exe) to start under the SYSTEM context. This behavior is often associated with pre-exploitation steps for privilege escalation vulnerabilities, specifically those involving OBJREF marshaling targeting specific COM objects.
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
Detects the creation or modification of InprocServer32 registry keys within CLSID paths in HKEY_LOCAL_MACHINE. These registry locations are frequently abused by adversaries to achieve persistence or execute arbitrary code (COM hijacking) by pointing the server path to a malicious DLL or executable.
This rule monitors for coordinated persistence efforts by detecting the occurrence of at least two out of three specific persistence techniques (registry run key modification, scheduled task creation, or WMI-based script execution) on the same device within a 30-minute window. It explicitly filters out activities from signed binaries or those occurring in standard system/application directories, focusing on potentially malicious artifacts originating from user-writable locations.
Page 191 of 1908