Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the execution of known PAYLOAD ransomware process-termination utilities (killer.exe or kill.exe). These tools are used by adversaries to forcefully terminate security software, backup services, and database processes prior to file encryption.
Detects the execution of files ending in '_win64.exe' from 'Perflogs' or 'Documents' directories, which is a known behavior of the Settra ransomware. The rule filters out common system and program file paths to reduce noise.
The following analytic identifies the first-time execution of child processes spawned by Zoom (zoom.exe or zoom.us). It leverages Endpoint Detection and Response (EDR) data, specifically monitoring process creation events and comparing them against previously seen child processes. This activity is significant because the execution of unfamiliar child processes by Zoom could indicate malicious exploitation or misuse of the application. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the endpoint.
The following analytic detects when DLLs with known abuse history are loaded from an unusual location.
This activity may represent an attacker performing a DLL search order or sideload hijacking technique.
These techniques are used to gain persistence as well as elevate privileges on the target system.
This activity may represent an attacker performing a DLL search order or sideload hijacking technique.
These techniques are used to gain persistence as well as elevate privileges on the target system.
The following analytic detects the execution of multiple offensive toolkits and commands through the process execution datamodel. This method captures commands given directly to powershell.exe, allowing for the identification of suspicious activities including several well-known tools used for credential theft, lateral movement, and persistence. If confirmed malicious, this could lead to unauthorized access, privilege escalation, and potential compromise of sensitive information within the environment.
The following analytic detects the creation or connection to named pipes used by potentially unwanted applications (PUAs) like VPNs or utilities like PsExec.
It leverages Sysmon EventCodes 17 and 18.
If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.
It leverages Sysmon EventCodes 17 and 18.
If confirmed malicious, this could allow an attacker to abuse these to potentially gain persistence, command and control, or further system compromise.
The following analytic detects the loading of known vulnerable Windows drivers, which may indicate potential persistence or privilege escalation attempts. It leverages Sysmon EventCode 6 to identify driver loading events and cross-references them with a list of vulnerable drivers. This activity is significant as attackers often exploit vulnerable drivers to gain elevated privileges or maintain persistence on a system. If confirmed malicious, this could allow attackers to execute arbitrary code with high privileges, leading to further system compromise and potential data exfiltration.
Detects suspicious network activity or credential exfiltration attempts occurring during package manager installation processes (npm, pip, yarn). The rule monitors for lifecycle scripts (e.g., preinstall, postinstall) spawning network utilities to external destinations or accessing common CI/CD secrets like AWS_SECRET_ACCESS_KEY or GITHUB_TOKEN.
Detects the use of native Windows utilities (vssadmin.exe, wmic.exe, wbadmin.exe, bcdedit.exe) to delete volume shadow copies, backup catalogs, or modify boot configuration data to inhibit system recovery, a common behavior observed during ransomware and wiper attacks.
Detects indicators of Cobalt Strike activity, including the creation of default named pipes, process injection into common LOLBins without legitimate parent processes, and network communication patterns consistent with Cobalt Strike malleable C2 profiles.
Detects attempts to create a memory dump of the Local Security Authority Subsystem Service (LSASS) using either the built-in 'comsvcs.dll' library via 'rundll32.exe' or by requesting specific sensitive process access rights to 'lsass.exe' from unauthorized processes.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility with either system-level privileges ('/ru SYSTEM') or persistent triggers ('/sc onlogon' or '/sc onstart'). The rule filters out commonly trusted parent processes, highlighting potential persistence mechanisms established by unauthorized or unusual processes.
Detects instances where common scripting engines like Python or Node.js are used to spawn command shells (CMD, PowerShell, or Bash) followed by the execution of suspicious commands commonly associated with reconnaissance, file exfiltration, or lateral movement.
Detects the abuse of native Windows binaries Regsvr32.exe and Rundll32.exe to execute code from remote sources. Regsvr32 is monitored for 'Squiblydoo'-style execution where scrobj.dll is used to execute remote scriptlets via a URL. Rundll32 is monitored for loading DLLs from remote UNC/WebDAV paths or HTTP URLs, which is a common pattern for proxying malicious code execution to bypass local security controls.
This rule detects potentially malicious behavior in package manager post-install scripts (npm, pip). It monitors for child processes like shells, network utilities (curl, wget), or command-line arguments indicative of credential harvesting (e.g., accessing .ssh, .aws/credentials, environment variables) initiated by package management processes.
Detects suspicious PowerShell command execution patterns commonly associated with malicious activities, including base64-encoded commands, download cradles used to fetch external content, and various obfuscation techniques like character concatenation or backtick escaping to hide malicious intent.
Detects a process reading credential store files (Login Data) from multiple Chromium-based browsers, immediately followed by an HTTP POST request to a specific exfiltration endpoint associated with the Psychedelic Stealer malware.
Detects the use of certutil.exe to decode files located within directories associated with the MSSQL service account (e.g., AppData, ServiceProfiles). This behavior is characteristic of an attack chain where an adversary uses SQL Server's xp_cmdshell to stage and decode a malicious payload from a base64-encoded file.
Detects the use of native Windows utilities (vssadmin, wbadmin, bcdedit, wmic) to delete shadow copies, backup catalogs, or modify boot configuration data to disable recovery. This behavior is commonly associated with ransomware and data destruction attacks intended to prevent system restoration.
Detects the execution of Nova ransomware (formerly RALord) by monitoring for its specific modular command-line interface arguments, which include file encryption commands, ransom note deployment, and specific ransom note filenames. The rule monitors process creation events for strings like 'encrypt-all', 'encrypt-path', 'readme-add', '--workers', and the presence of the 'README_NOVA.me' ransom note or unique file extensions associated with its encryption activity.
Detects the execution of legitimate remote-access software commonly used in social engineering attacks, such as Quick Assist and AnyDesk. These tools are frequently abused as an initial access or persistence mechanism by threat actors following initial contact via methods like vishing or email-based social engineering.
Page 24 of 465