Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
61,046 detections
Filters
Last updated
All Time
Detection languages
23,955
16,903
4,364
4,342
3,270
Contributors
11,679
8,654
7,555
6,800
4,504
Categories
20,590
11,933
5,910
5,194
4,872
Platforms
40,154
7,369
6,547
3,915
3,692
Products / Services
10,809
9,795
6,757
4,421
3,771
MITRE Techniques
18,176
15,735
12,661
8,477
6,293
CVEs
71
71
64
58
49
IDS Classtypes
1,937
503
461
381
237
IDS Protocols
2,431
869
408
324
97
Detects exclusive SMB file handle requests (ShareAccess = 0), which are utilized by the GhostLock denial-of-service technique.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
GhostLock is a proof-of-concept tool that evades traditional write-based ransomware defenses by locking files rather than encrypting them, causing widespread STATUS_SHARING_VIOLATION errors.
Note: To effectively identify the attack and reduce false positives, implement thresholding/aggregation in your SIEM. It is highly recommended to alert only when the count of these events exceeds 500 within a 5-minute window, grouped by the source 'IpAddress'.
Detects the Grandoreiro Campaign 2 obfuscated VBS loader executed via wscript.exe / cscript.exe from a user-writable directory. The rule has been expanded to also detect additional Grandoreiro behaviors, including the spawning of Delphi payloads from AppData, WMI queries for AntiVirusProduct, browser kiosk mode execution, and potential DLL side-loading of abused legitimate executables (FastStone, MinGW, FreeMat, AbiWord).
Detects whenever a QoS with throttleRate is created by a Windows Service. This behaviour is normally associated with EDR Supression.
Detects the execution of PowerShell cmdlets used to mount ISO/VHD images. This behavior is a known prerequisite for the RoguePlanet Windows Defender vulnerability exploit, which relies on a race condition triggered during the mounting of an ISO image by a standard user.
Detects the use of the Add-MpPreference PowerShell cmdlet to add the entire C:\ drive or powershell.exe to Microsoft Defender exclusions. This technique is actively used by threat actors to bypass antivirus scanning and ensure the execution of subsequent payloads.
Detects the creation of a scheduled task utilizing an XML configuration file located in the C:\Users\Public\Documents directory. The CryptoBandits worm component creates these tasks to maintain persistence for both itself and the stealer payload.
Detects the usage of curl.exe routing traffic through a local SOCKS5 proxy on port 9050, a behavior observed in CryptoBandits malware communicating with a bundled Tor client to hide its Command and Control (C2) destination.
Detects wscript.exe or cscript.exe executing a VBScript that uses MSXML2.XMLHTTP and ADODB.Stream to download a file in chunks (using the Range header) to a temporary or AppData location. This technique is often used by malware to evade detection by downloading payloads in smaller pieces.
Detects the creation or execution of the trepamobq.cmd file, which is associated with the Trepamo banking malware. This detection identifies instances where the trepamobq.cmd script is created in the filesystem or executed, which may indicate a compromise or malicious activity related to banking malware.
Detects WMI queries for installed AntiVirus products executed via scripting interpreters such as wscript.exe, cscript.exe, powershell.exe, or wmic.exe. This behavior may indicate an attempt to gather information about security software on the system, which can be a precursor to evasion or targeted attacks.
Detects the creation of a registry run key named 'Financeiro' under the CurrentVersion\Run path, which is associated with the Ousaban malware. This detection identifies instances where the 'Financeiro' run key is created in the Windows registry, which may indicate a compromise or malicious activity related to Ousaban malware persistence.
Detects the execution of 'reg.exe' with command line arguments that query registry keys associated with virtualization software, which is indicative of anti-VM behavior commonly observed in QuimaRAT malware. This detection identifies instances where 'reg.exe' is used to check for the presence of virtualization environments, which may suggest that the malware is attempting to evade analysis or detection in virtualized environments.
Detects execution of a trojanized 7-Zip proxyware payload (hero.exe/uphero.exe) from the SysWOW64 directory. This malware is known to be used in targeted attacks and can lead to unauthorized access and data exfiltration.
Detects attempts to enumerate Active Directory user objects using the Get-ADUser cmdlet with wildcard filters. This technique is often employed by attackers to gather information about user accounts and their attributes.
Detects attempts to identify the domain membership of a system using WMI queries to the Win32_ComputerSystem class. This technique is often employed by attackers to gather information about the network environment and potential targets.
Detects attempts to enumerate DNS zone records using the Get-DnsServerResourceRecord cmdlet. This technique is often employed by attackers to gather information about DNS configurations and potential targets within a network.
Detects attempts to enumerate Active Directory computer objects using the Get-ADComputer cmdlet with wildcard filters. This technique is often employed by attackers to gather information about networked devices and their configurations.
Detects attempts to enumerate Active Directory replication subnets using the Get-ADReplicationSubnet cmdlet. This technique is often employed by attackers to gather information about the network topology and potential targets within a domain.
Detects instances where the Microsoft Installer process (msiexec.exe) initiates a network connection to the local IPv4 loopback address (127.0.0.1). This behavior may indicate an MSI custom-action payload attempting to interact with a web browser through the Chrome DevTools Protocol (CDP) to establish a covert command-and-control channel.
Detects lib.dll being loaded by msiexec.exe, an unusual image-load relationship that matches the embedded MSI custom action used by msaRAT.
This rule attempts to detect the command flags from the msaRAT.
Page 22 of 2907