Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects the execution of 'rnpkeys.exe' from within the '\ProgramData\keyroll\' directory, specifically when it loads 'rnp.dll' from the same path. This behavior is indicative of potential malicious activity, as the ProgramData directory is a common location for adversaries to stage files, and the use of custom DLL loading from this directory may suggest an attempt to execute unauthorized code or obfuscate tool activity.
This rule detects the suspicious sequential loading of 'tdwp.dll' and 'rnp.dll' by processes related to key management or encryption (e.g., 'rnpkeys.exe' or processes from a 'keyroll' folder). The detection correlates these events within a 2-minute window and highlights if the 'tdwp.dll' has a known malicious hash.
This rule detects potentially malicious usage of msiexec.exe where the command line contains obfuscation techniques such as excessive spacing, Unicode character substitution, or suspicious case variations. It specifically looks for activity initiated by common shell processes like explorer.exe or cmd.exe that involves the /package argument or URL-based loading, which is a common indicator of MSI-based payload delivery.
Detects the creation of a scheduled task named 'keyroll' in close temporal proximity to the execution of 'rnpkeys.exe' from 'C:\ProgramData\keyroll'. This pattern mimics the persistence mechanism used by the Sauron malware (a.k.a. Strider) to execute its loader chain.
This rule uses YARA to identify specific malicious files associated with the Sauron Loader malware, including the MSI installer and associated support DLLs (rnp.dll, tdwp.dll), based on their known SHA-256 hashes.
Detects anomalous, high-frequency outbound HTTPS POST requests from the 'rnpkeys.exe' process, characteristic of the Sauron Loader exfiltrating screenshot chunks (Message Type 3) to a Command and Control (C2) server.
Detects process injection behaviors (e.g., remote thread creation, memory allocation) targeting the attrib.exe process. Such activity is often associated with process hollowing or reflective shellcode injection, consistent with loader behavior used to execute in-memory payloads within legitimate, rarely-used system utilities.
Detects reconnaissance commands related to system domain, locale, and environment settings following the execution of rnpkeys.exe from C:\ProgramData\keyroll, a behavior associated with the Sauron Loader. The rule identifies suspicious system discovery commands (nltest, whoami, etc.) or environment checks performed shortly after the loader's execution, indicating potential target verification before C2 registration.
Detects unpacked Sauron Loader DLL samples by identifying the embedded configuration structure. The rule searches for a specific 4-byte magic header (0xbaadf00d), specific configuration field strings ('group_id' and 'build_id'), and RSA key length markers consistent with the loader's known cryptographic configuration structure.
Detects suspicious execution of command-line utilities (cmd.exe, powershell.exe, conhost.exe) directly from Windows Explorer (explorer.exe), which is often indicative of fileless malware execution, downloader activity, or 'ClickFix' style social engineering attacks.
This rule detects network activity associated with the Sauron Loader malware. It monitors for TLS connections to known hardcoded C2 domains and identifies HTTP requests following a specific pattern of randomized command and control (C2) paths combined with suspicious User-Agent headers (Windows NT with Edge/Edg).
Detects the creation of a Windows service that points to a .sys file located in common temporary directories (Temp, Windows\Temp). This behavior is characteristic of adversaries attempting to load malicious kernel drivers, often for persistence or privilege escalation, such as in Bring Your Own Vulnerable Driver (BYOVD) attacks.
Detects Sauron Loader DLLs by identifying specific configuration blob magic values (0xbaadf00d), associated flags, and internal strings like 'group_id' or 'build_id' that suggest the presence of malicious configuration or RSA key material.
Detects unpacked Sauron Loader DLL samples by identifying specific binary structures, including the magic value 0xbaadf00d and subsequent flag bytes (0x40) often found in its embedded configuration blob.
Detects unpacked Sauron Loader DLL samples by identifying specific binary structures, including the magic value 0xbaadf00d and subsequent flag bytes (0x40) often found in its embedded configuration blob.
Detects the loading of the Alinubx.sys (aka CcProtect.sys) kernel driver, often dropped as nvfsflt64.sys or registered as NvFsFilter, followed by a rapid, simultaneous termination of security product processes. This activity is indicative of a BYOVD (Bring Your Own Vulnerable Driver) attack chain where kernel-mode primitives are used to terminate EDR/AV processes.
This rule monitors for network connections and process activities associated with known malicious indicators, including file hashes, C2 IP addresses, domains, and specific URLs. It maps these activities to identify potential command and control communication or other malicious network activity occurring on endpoints.
Detects the MSI installer (msiexec.exe) creating files within the 'C:\ProgramData\keyroll' directory, which is characteristic of the staging phase for the Sauron Loader DLL side-loading trio (rnpkeys.exe, rnp.dll, tdwp.dll).
Detects the execution of various system binaries (e.g., rundll32.exe, powershell.exe, regsvr32.exe) launched from a Temp directory where the parent or actor process is identified as rnpkeys.exe or rnp.dll. This behavior is indicative of potential malicious activity where legitimate tools or utilities (GnuPG/RNP) are being abused to proxy the execution of secondary payloads or scripts.
This rule detects the execution of common remote access tools (Quick Assist, AnyDesk) on a host that does not have a prior history of using those specific tools. This is intended to identify potential hands-on-keyboard activity by adversaries following initial access via social engineering, such as vishing or email-bombing, where they attempt to establish a persistent remote access foothold.
Detects the execution of the 'rnpkeys.exe' file from the 'C:\ProgramData\keyroll\' directory. The location and filename are highly atypical and could indicate unauthorized tool usage, potential persistence, or malicious activity.
Page 194 of 1908