Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,044 detections
Filters
Last updated
All Time
Detection languages
23,953
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,589
11,933
5,910
5,193
4,872
Platforms
40,153
7,368
6,547
3,915
3,691
Products / Services
10,809
9,795
6,757
4,421
3,770
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
This rule detects the infected version of CPU-Z, a popular system information tool, which has been compromised and used as a vector for malware infection
The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, such as file hashes, unusual command-line arguments, or known malicious behaviors associated with this tool.
The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, such as file hashes, unusual command-line arguments, or known malicious behaviors associated with this tool.
Detects the execution of shell interpreters (such as cmd, powershell, bash, osascript) as child processes of the Obsidian note-taking application. This behavior was observed in the REF6598 campaign where threat actors abused the "Shell Commands" community plugin to deliver the PHANTOMPULSE RAT. It also detects specific command-line indicators associated with the campaign.
Detects the execution of curl.exe to download an executable payload directly into the C:\ProgramData\ directory.
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
dirty frag
Sigma
This rule detects a multi-stage potential local privilege escalation attack sequence (often associated with Dirty Frag TTPs) where an ELF binary is created in a user-controlled or temporary directory, subsequently executed, and finally initiates a 'su' process.
Detects exclusive SMB file handle requests (ShareAccess = 0), which are utilized by the GhostLock denial-of-service technique.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).
Detects whenever a QoS with throttleRate is created by a Windows Service. This behaviour is normally associated with EDR Supression.
Detects the execution of PowerShell cmdlets used to mount ISO/VHD images. This behavior is a known prerequisite for the RoguePlanet Windows Defender vulnerability exploit, which relies on a race condition triggered during the mounting of an ISO image by a standard user.
Detects the use of the Add-MpPreference PowerShell cmdlet to add the entire C:\ drive or powershell.exe to Microsoft Defender exclusions. This technique is actively used by threat actors to bypass antivirus scanning and ensure the execution of subsequent payloads.
Detects the creation of a scheduled task utilizing an XML configuration file located in the C:\Users\Public\Documents directory. The CryptoBandits worm component creates these tasks to maintain persistence for both itself and the stealer payload.
Detects the usage of curl.exe routing traffic through a local SOCKS5 proxy on port 9050, a behavior observed in CryptoBandits malware communicating with a bundled Tor client to hide its Command and Control (C2) destination.
Detects wscript.exe or cscript.exe executing a VBScript that uses MSXML2.XMLHTTP and ADODB.Stream to download a file in chunks (using the Range header) to a temporary or AppData location. This technique is often used by malware to evade detection by downloading payloads in smaller pieces.
Detects the creation or execution of the trepamobq.cmd file, which is associated with the Trepamo banking malware. This detection identifies instances where the trepamobq.cmd script is created in the filesystem or executed, which may indicate a compromise or malicious activity related to banking malware.
Detects WMI queries for installed AntiVirus products executed via scripting interpreters such as wscript.exe, cscript.exe, powershell.exe, or wmic.exe. This behavior may indicate an attempt to gather information about security software on the system, which can be a precursor to evasion or targeted attacks.
Detects the execution of 'reg.exe' with command line arguments that query registry keys associated with virtualization software, which is indicative of anti-VM behavior commonly observed in QuimaRAT malware. This detection identifies instances where 'reg.exe' is used to check for the presence of virtualization environments, which may suggest that the malware is attempting to evade analysis or detection in virtualized environments.
Detects execution of a trojanized 7-Zip proxyware payload (hero.exe/uphero.exe) from the SysWOW64 directory. This malware is known to be used in targeted attacks and can lead to unauthorized access and data exfiltration.
Detects attempts to enumerate Active Directory user objects using the Get-ADUser cmdlet with wildcard filters. This technique is often employed by attackers to gather information about user accounts and their attributes.
Detects attempts to identify the domain membership of a system using WMI queries to the Win32_ComputerSystem class. This technique is often employed by attackers to gather information about the network environment and potential targets.
Detects attempts to enumerate DNS zone records using the Get-DnsServerResourceRecord cmdlet. This technique is often employed by attackers to gather information about DNS configurations and potential targets within a network.
Detects attempts to enumerate Active Directory computer objects using the Get-ADComputer cmdlet with wildcard filters. This technique is often employed by attackers to gather information about networked devices and their configurations.
Detects attempts to enumerate Active Directory replication subnets using the Get-ADReplicationSubnet cmdlet. This technique is often employed by attackers to gather information about the network topology and potential targets within a domain.
Page 21 of 2907