Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,683
9,759
6,695
4,421
3,750
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects suspicious process injection, module loads, or thread creation events where a web browser process (chrome.exe or msedge.exe) is the target, excluding known legitimate browser-related processes or sub-components like the elevation service.
Detects the execution of the legacy 'finger.exe' network utility with suspicious command-line arguments. The finger protocol is an outdated service that provides information about users on a system; adversaries may abuse this utility to perform network reconnaissance, identify user accounts, or gather system-level information.
Detects the execution of Python processes where command line arguments indicate the use of the DLLMemLoader agent or related indicators like 'hostfxr' or specific hex strings. This activity is often associated with the loading of malicious DLLs or secondary stages in an attack chain.
This rule monitors for the loading or interaction with specific device drivers named 'truesight.sys' or 'rentdrv2.sys'. These drivers are often associated with malicious activity, including potentially vulnerable kernel drivers used in BYOVD (Bring Your Own Vulnerable Driver) attacks or rootkit-like persistence mechanisms. The rule tracks driver loading, registry updates, process activity, and device I/O control calls related to these files.
Detects instances where browser extensions interact with specific AI-driven websites (Gemini, Perplexity, Claude) in a manner that bypasses user input or interacts with hidden DOM elements. This pattern is indicative of malicious browser extensions injecting scripts or manipulating content in the background without explicit user authorization, potentially for data exfiltration or automated session interaction.
This rule detects malicious activity by monitoring for specific known indicators, including hashes of malicious files (ProcessRollup2), network connections to known C2 infrastructure (NetworkConnectIP4), and URL clicks (UrlClick) associated with malicious domains or paths. It acts as a multi-stage indicator correlation rule to identify execution or communication with known threats.
This rule detects the creation of .lnk files within the Windows Startup directory. Attackers frequently use this persistence technique to ensure that a malicious script or executable runs automatically upon user login.
Detects the execution of MeshAgent or mvtcs (MeshCentral) binaries, which are commonly used for legitimate remote management but can also be used as unauthorized remote access tools by adversaries.
Detects instances where ConnectWise Control (ScreenConnect) agent services initiate the execution of processes that are not part of the standard ScreenConnect application suite. This behavior is often indicative of post-exploitation activity or malicious use of remote access tools to launch secondary payloads.
Detects the execution of the Rubeus tool, a C# toolkit used for interacting with the Kerberos protocol. The rule specifically monitors command-line arguments and process names associated with common Kerberos exploitation tasks such as Kerberoasting, Golden/Silver Ticket forging, and ticket manipulation.
Detects instances where PowerShell attempts to inject code into legitimate processes (such as csc.exe, chrome.exe, msedge.exe, or SearchIndexer.exe) using direct syscalls NtAllocateVirtualMemoryRemote or NtSetContextThreadRemote, indicating potential process injection activity.
This rule monitors for any process execution event captured by the EDR solution. It serves as a catch-all for recording process creation telemetry.
Detects the installation of a potentially malicious root certificate on a host. The rule monitors for common command-line arguments used by 'certutil.exe' to add certificates to the store, use of the 'security' utility for certificate installation on macOS, and the execution of processes referencing 'Localcertificate.zip'.
This query provides high-fidelity, post-exploitation hunting for CVE-2026-69730 by catching unauthorized child processes spawned from the Windows DNS Server engine (dns.exe).
Because dns.exe runs natively as NT AUTHORITY\SYSTEM and almost never executes external binaries during normal operations, filtering out known OS noise (conhost.exe and werfault.exe) flags potential RCE breakouts and privilege escalation with near-zero false positives.
Because dns.exe runs natively as NT AUTHORITY\SYSTEM and almost never executes external binaries during normal operations, filtering out known OS noise (conhost.exe and werfault.exe) flags potential RCE breakouts and privilege escalation with near-zero false positives.
Detects the execution of netscan.exe, a common network scanning tool often used by adversaries to enumerate network resources, hosts, and services within a compromised environment.
This rule detects attempts to patch critical Windows functions used for security instrumentation, specifically 'AmsiScanBuffer' within 'amsi.dll' (often for bypassing AMSI) or 'EtwEventWrite' within 'ntdll.dll' (often for disabling ETW logging). This activity is highly indicative of defensive evasion techniques used by malware or malicious actors to hide their behavior from security tools.
Detects access to sensitive files (KeePass databases, SSH private keys, and VPN configurations) by processes other than their designated applications. This behavior indicates potential credential harvesting or configuration exfiltration by unauthorized processes.
Detects instances where a process has been elevated on a Windows system, as indicated by specific log messages containing 'Process is elevated' within the command line or image file name fields.
Detects evidence of SloppyRAT employing the Hell's Gate technique, specifically the resolution and indirect invocation of low-level NT system calls (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) designed to bypass EDR user-mode API hooking during process injection activities.
This rule detects indicators of the Rapuncel browser injection by monitoring for the creation of a known malicious DLL hash on disk, identifying non-standard parent processes invoking elevation_service.exe, and detecting the loading of unrecognized DLLs into Google Chrome or Microsoft Edge browser processes.
Detects the presence of the CastleLoader intermediate loader binary on disk, associated with the SloppyRAT infection chain. The rule identifies specific file content patterns, including hardcoded strings such as 'CastleLoader', 'CastleRAT', specific user-agents, and embedded Python code used for base64/zlib decoding of further payloads.
Page 20 of 100