Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6,695 detections
Filters
Last updated
All Time
Detection languages
2,745
1,501
1,114
673
407
Contributors
1,570
1,362
1,278
896
185
Categories
3,709
2,352
767
581
457
Platforms
6,668
71
52
31
29
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
2,448
1,976
1,634
1,401
856
CVEs
11
10
9
9
7
IDS Classtypes
1
IDS Protocols
1
Detects the execution of the hacktool Defendnot. Defendnot is a hacktool that abuses Microsoft undocumented WSC (Windows Security Center) API
to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.
to disable Windows Defender by registering itself as a fake antivirus product. Threat actors often use these kind of tools to bypass security measures.
Detects process handle on LSASS process with certain access mask
Detects mshta.exe executing a remote HTA payload over HTTP/HTTPS, the initial fileless execution stage of ACR Stealer's Campaign 2. The retrieved HTA contains VBScript loaders that ultimately deploy obfuscated PowerShell and steganography-assisted in-memory shellcode.
Detects the persistence mechanism used by ShelbyLoader V2 (RuntimeBroker.dll), the loader in the Iran-nexus Blinder Tunnel campaign (CL-STA-1178). The implant writes HKCU\...\Run\MicrosoftRuntime pointing at %LOCALAPPDATA%\Microsoft\RuntimeBrokers\RuntimeBroker.exe, then re-asserts it hourly. The genuine RuntimeBroker.exe is a System32 COM broker that is never autostarted from a Run key, so matching either the implant’s value name or RuntimeBroker.exe in Run data gives a near-binary signal with no allow-list. Covers both the Unit 42 and Nextron variants.
The following analytic detects the execution of known remote access software within the environment. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and parent processes mapped to the Endpoint data model. We then compare with with a list of known remote access software shipped as a lookup file - remote_access_software. This activity is significant as adversaries often use remote access tools like AnyDesk, GoToMyPC, LogMeIn, and TeamViewer to maintain unauthorized access. If confirmed malicious, this could allow attackers to control systems remotely, exfiltrate data, or deploy additional malware, posing a severe threat to the organization's security.
Detects registry modifications that tamper with internal Windows tools settings, commonly used by malware to disable security features or system tools
Detects devices that are missing a specific Windows Update KB5xxxxxx by checking the OsVersion table against the WindowsQfe update history table.
Detects the default scheduled task activity of the hacktool Defendnot, which is used to disable Windows Defender Security.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
It abuses Microsoft's undocumented WSC API to register itself as a fake antivirus product, allowing it to disable Windows Defender.
During installation, Defendnot creates a scheduled task named 'defendnot' with the argument '--from-autorun' for persistence.
Detects the creation of the "PSScriptPolicyTest" PowerShell script by an uncommon process. This file is usually generated by Microsoft Powershell to test against Applocker.
Detects the execution of Wireshark or tshark with command-line arguments indicating TLS key logging or packet capture file handling, followed shortly by a crash handler process (WerFault.exe or WerFaultSecure.exe) for the same process.
Detects hosts exhibiting multiple persistence mechanisms (Run keys, Scheduled Tasks, and Windows Services) within a short timeframe, indicating potential adversary persistence setup.
Detects the Blackwood tunneling tool from Blinder Tunnel. Blackwood.dll is sideloaded into a signed vshost32.exe via its .config and reflectively loads Go-compiled Chisel, which dials a raw public IP and opens a reverse SOCKS proxy for lateral pivoting.
Detects the Blinder Tunnel C2 loop. The loader beacons about every 63 seconds to the GitHub Contents API (profile upload, one-time license read). The newer variant can instead go through a Cloudflare Workers relay that mirrors the GitHub API paths. Both platforms are legitimate, so the signal is the client: the implant install directory, a non-System32 RuntimeBroker.exe, or any binary under AppData\Local\Microsoft\, none of which are real GitHub clients. Known implant hosts and the known relay alert on a single hit. The lookalike-path arm needs 10 or more connections per hour (a 63-second loop produces 100+), which suppresses incidental noise. Depends on RemoteUrl being populated for TLS connections.
Detects the sequential relationship of data staging using tools like WinRAR and subsequent exfiltration using tools like Rclone, WinSCP, or FileZilla on a single host within a 24-hour window.
Detects the execution of archiving utilities (7z, rar, tar, or Compress-Archive) targeting configuration directories of AI coding assistants such as Claude, Codex, Cursor, and Gemini.
The following analytic detects when a unprivileged user changes an Admin accounts password. This is a common artifact of successful exploitation of the BlueHammer Windows Defender privilege escalation. The attacker's process momentarily changes the passwords of high-value local accounts including the built-in Administrator to spawn an authenticated shell session, then immediately reverts the passwords to avoid detection. This uses EventID 4723 to log this activity.
Detects suspicious command-line execution patterns involving 'ccmpwn', coercing features, or manipulation of Configuration Manager configuration files such as SCNotification.exe.config.
Detects modification of the Microsoft Security Center AV registry keys, particularly those related with DisplayName, ProductEXE, or ReportingExe.
These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
These keys typically store information about antivirus products installed on the system, which is Windows Defender or third-party antivirus software.
But, if these keys holds unexpected values or are modified in a suspicious manner, it could indicate an attempt to tamper with the security settings of the system.
Detects Play-style lateral movement via Group Policy: an executable (.exe/.dll) written to a SYSVOL/GPO path by the same non-machine account that modified a GPO in the same 30-minute window. Attackers use this to push ransomware or Cobalt Strike/SystemBC payloads domain-wide.
Detects data staging and exfiltration preceding Play double extortion: WinRAR/RAR adding files to an archive (recursive or password-protected) followed within 4 hours by a WinSCP transfer from the same host and user.
Detects processes accessing sensitive files and configurations associated with multiple AI coding assistants (such as Claude, Codex, Grok, and Cursor) within a short time window, potentially indicating unauthorized access or credential theft from AI tools.
Page 2 of 319