Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
896 detections
Filters
Last updated
All Time
Detection languages
281
252
167
85
36
Contributors
186
165
115
89
73
Categories
272
249
213
183
162
Platforms
877
18
11
6
4
Products / Services
10,665
9,773
6,705
4,421
3,749
896
MITRE Techniques
455
268
245
192
132
CVEs
17
6
4
4
4
IDS Classtypes
4
1
IDS Protocols
4
Detects malicious msimg32.dll files associated with the Bumblebee loader by identifying unique, randomized, dictionary-derived strings within the PE file version resource metadata. These strings serve as a known signature for Bumblebee builders, often used to trojanize MSI installers.
This rule identifies the execution or presence of a specific malicious installer executable (MD5 87603EA025623B19954E460ADD532048) that is known to be reused and renamed across multiple campaigns to masquerade as legitimate software installers.
Detects a malicious PNG file used by the Ousaban VBS downloader that embeds a ZIP archive containing a payload named 'SysMain.exe' appended after the PNG IEND chunk.
Detects attempts by the GreenBlood ransomware to disable Windows Defender's real-time monitoring by modifying the registry. This rule specifically looks for 'reg.exe' commands that add 'DisableRealtimeMonitoring=1' to the Windows Defender policy key.
Detects the use of PowerShell to modify Microsoft Defender preferences, specifically attempting to disable security features like Realtime Monitoring, IOAV protection, or Behavior Monitoring.
Detects the use of PowerShell to modify Microsoft Defender preferences, specifically attempting to disable security features like Realtime Monitoring, IOAV protection, or Behavior Monitoring.
Detects modifications to Windows Defender registry keys intended to disable core security features, including real-time monitoring and threat reporting, when performed by non-Microsoft signed processes.
Detects attempts to terminate security-related processes or stop security-related services using common administrative tools like taskkill.exe, sc.exe, net.exe, or net1.exe. This activity is often indicative of an adversary attempting to disable security monitoring and protection software to facilitate further malicious actions.
This rule detects attempts to stop security services (like Windows Defender) or clear event logs using 'sc stop', 'net stop', or 'wevtutil cl' commands, specifically when initiated by 'explorer.exe'. This behavior, especially when originating from explorer.exe, can indicate an adversary attempting to impair defenses or remove forensic evidence.
Detects the use of WScript or CScript (Windows scripting engines) to launch commands intended to disable or tamper with security products, including Windows Defender, system firewalls, Bitdefender, and Kaspersky antivirus solutions.
Detects the modification or termination of critical Windows security services using the Service Control utility (sc.exe). Attackers frequently disable Defender and associated security center services to allow undetected payload execution.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects common security product executables (MsMpEng.exe, SenseNdr.exe, csfalconservice.exe, CylanceSvc.exe) that are running from file paths inconsistent with their legitimate installation directories. This behavior is indicative of an adversary attempting to masquerade as trusted security software to evade detection or achieve persistence.
Modular remote access trojan associated with long-term espionage intrusions
Malvertising loader delivering CastleStealer via malicious Google Ads
USB worm and loader leveraging living-off-the-land binaries
Loader used in click-hijacking traffic distribution scheme
Modular remote access trojan associated with long-term espionage intrusions
Malvertising loader delivering CastleStealer via malicious Google Ads
Lightweight remote access trojan deployed in recruiter-themed social engineering
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Page 24 of 43