Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects the use of the Windows Service Control Manager (sc.exe) to create, delete, or start a service named 'MixedSvc', or attempts to execute a process masquerading as 'Mixed Reality.exe' from a suspicious directory (Windows Media Player folder). These activities are often associated with persistence or masquerading techniques used by threat actors.
Detects the creation of persistence via a malicious Windows service named 'MixedSvc' or any service pointing to 'Mixed Reality.exe' located within 'C:\Program Files\Windows Media Player\'. This activity is consistent with the 'Operation DragonReturn' campaign and the 'Silver Fox' threat actor, where the 'Mixed Reality.exe' binary acts as a host for DLL-sideloading of the DcRAT backdoor.
Detects a suspicious pattern where a large volume of files (documents, archives, or media) are written to common user directories, followed within 10 minutes by attempts to impair system recovery (deleting shadow copies) or disable Microsoft Defender exclusions using native Windows utilities such as vssadmin, wmic, or PowerShell. This behavior is highly indicative of ransomware staging activities.
Detects attempts to disable or tamper with Windows security products and logging mechanisms. This includes stopping security services, clearing event logs, using PowerShell to modify security preferences (e.g., Windows Defender exclusions or real-time monitoring), and modifying registry keys to disable security features.
Detects processes that exhibit signs of C2 communication (specifically on ports 4000-5000, associated with SystemBC) followed by the writing of executable or script files to SMB/UNC paths and subsequent remote lateral movement execution via WMI, Windows services, or scheduled tasks on the same host.
This rule detects persistence mechanisms associated with the SHARDLOADER threat activity, specifically monitoring for the creation of suspicious Registry 'Run' keys using the 'MediumNetMonIt' value or via scheduled task creation referencing known staging paths under 'C:\ProgramData\IDM\logs\'.
This rule detects the creation of a new Windows service where the executable path is located in suspicious directories (e.g., ProgramData, AppData, Temp, Users Public). It correlates the service installation event (using sc.exe) with the subsequent execution of the binary by services.exe within a two-hour window, identifying potential persistence mechanisms or malicious service-based execution.
Detects the creation of Windows services where the executable path is located in suspicious or volatile directories such as ProgramData, Temp, or AppData. This behavior is indicative of malware, specifically the The Gentlemen RaaS group, establishing persistence or deploying malicious components on a compromised system.
This rule detects multiple distinct attempts to tamper with security products on a host. It identifies processes attempting to stop security-related services (via sc.exe or net.exe), processes attempting to kill security-related applications (via taskkill.exe), modifications to Windows Defender registry keys, or the use of PowerShell Set-MpPreference to disable security features. The rule triggers when two or more of these evasion events or types occur within a 5-minute window on the same host.
This rule detects activities related to clearing or deleting Windows Event Logs, including usage of 'wevtutil.exe' to clear specific logs, 'cmd.exe' or PowerShell ('Remove-Item') to manually delete '.evtx' files, and the erasure of the USN journal via 'fsutil.exe'. It also detects the actual occurrence of Event IDs 1102 (Security log cleared) and 104 (System log cleared). The rule correlates these events with preceding service installations within the last 24 hours to distinguish between potential attacker anti-forensics activity and routine administrative maintenance.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects persistence mechanisms used by the Turla STOCKSTAY malware, specifically identifying the use of Registry Run keys (masquerading as 'MicrosoftUpdateOneDrive' or referencing the %LOCALAPPDATA%\Programs\SMN\ directory) and modifications to the AppInit_DLLs registry key.
Detects various phases of the Grixba infostealer infection lifecycle, including persistence via file drops in public user directories, malicious DLL/payload creation, reconnaissance data exfiltration, security software tampering (Windows Defender, AMSI, WLDP), and event log clearing via wevtutil.
Detects unauthorized attempts to terminate, stop, or access Endpoint Detection and Response (EDR) or Antivirus agent processes. This is identified by monitoring command-line utilities like taskkill, net, and sc targeting known security service names, as well as detecting suspicious cross-process access (e.g., OpenProcess) by unauthorized processes targeting security agent PIDs.
Detects the installation of RustDesk as a persistent Windows service. RustDesk is a remote access tool that has been observed in intrusion chains, including those involving Akira ransomware, to provide hands-on-keyboard access to threat actors.
Detects the creation of a 'MasterPackager.Updater' scheduled task by a suspicious instance of RegAsm.exe (hollowed process). The task is configured to execute a VBScript located in C:\Users\Public every two minutes, a known tactic associated with AsyncRAT delivery chains.
Detects the installation of the RustDesk remote access software as a Windows system service. This is identified by monitoring Event ID 7045 (Service Installation) for service names or image paths associated with RustDesk.
This rule detects when critical Windows services or processes associated with Active Directory (NTDS, Netlogon, LSASS, LDAP) or the Print Spooler (Spooler, spoolsv.exe) crash multiple times (3 or more) on a machine within a 7-day period. This could indicate instability, a denial-of-service attempt, or a system compromise affecting core services.
Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Page 23 of 61