Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of rundll32.exe with a command line referencing a DLL file stored in the C:\ProgramData directory. This pattern is commonly used by adversaries to execute malicious code while masquerading as legitimate system activity, particularly when initiated by command shell or browser processes.
Detects a sequence of suspicious activities associated with credential dumping and inhibiting system recovery. The rule tracks when a user account executes multiple commands related to volume shadow copies (vssadmin, rmdir, mklink) or attempts to copy sensitive registry files (SAM, SYSTEM, SECURITY) within a 15-minute window on the same device.
Detects activity associated with a potential RMM (Remote Monitoring and Management) agent communicating with known malicious infrastructure and accessing sensitive files like credentials or IDs. This often indicates an adversary leveraging legitimate RMM tooling for post-compromise activity or exfiltration.
Detects instances where browser processes (Chrome or Edge) are spawned by smartscreen.exe and subsequently access sensitive browser storage files such as Login Data, Cookies, or Local State. This pattern is indicative of a process injection or masquerading chain used to extract credentials or session data.
Detects instances where Python interpreters (python.exe or pythonw.exe) are executed from a subdirectory within ProgramData that matches a 32-hex character pattern, initiated by the 7zip archive utility (7za.exe). This pattern is indicative of a self-extracting archive or malicious installer unpacking and executing Python scripts in a stealthy, non-standard location.
Detects the presence of KRSID ransomware by identifying specific embedded strings associated with its configuration, including ransom notes (README_KRSID.Txt), log files (ransomware-silent.Log), encrypted file extensions (.krsid), and common command-line arguments used for operational control.
Detects the execution of files related to 'UBPPatch' or 'HTSPnew', specifically looking for PowerShell scripts (.psh) or executables (.exe) that match these potentially non-standard or obfuscated update/patch filenames. The rule also looks for command lines referencing 'Update.Lst', often associated with custom or unauthorized patch mechanisms.
Detects behavior indicative of KRSID ransomware, characterized by mass file renaming to the .krsid extension and the creation of a 'ransomware-silent.Log' file. The detection specifically correlates this activity with the absence of vssadmin shadow copy deletion commands, which is an atypical behavior for most ransomware families, thereby serving as a distinguishing heuristic.
Detects the execution of suspicious binaries from the user's AppData Local Temp directory, often associated with AutoIt scripting or similar automation tools that utilize configuration (.ini) files to drive malicious activity.
Detects the execution of suspicious binaries from the user's AppData Local Temp directory, often associated with AutoIt scripting or similar automation tools that utilize configuration (.ini) files to drive malicious activity.
Detects the creation of a .bat file in the Windows Startup directory, followed by the execution of a command process from a temporary location using a specific command line pattern. This behavior is indicative of persistent malware or a dropper attempting to execute an initial payload upon user logon.
Detects the invocation of the C# compiler (csc.exe) by PowerShell, where the command line includes specific references to .cmdline files. This pattern is commonly used in fileless execution techniques to compile and execute malicious code in memory after delivery.
Detects SVG image files that contain embedded HTML or script payloads, often used as an initial delivery vector to smuggle malicious code (such as downloaders or web redirects) into a target environment. This technique has been associated with the delivery of various remote access trojans (RATs).
Detects MSBuild.exe establishing a network connection to a specific remote IP address (212.34.141.103) on port 4521. This behavior is indicative of MSBuild being used to proxy execution of malicious code, often associated with downloading and executing second-stage payloads or beaconing to a command-and-control (C2) server.
This rule detects the loading of the 'Microsoft.Management.Configuration.dll' module by specific Windows system processes involved in package management and configuration, namely 'ConfigurationRemotingServer.exe' and 'WindowsPackageManagerServer.exe'. While these are legitimate components of the Windows Package Manager and DSC services, monitoring this activity can establish a baseline for identifying potential process injection or unauthorized library loading within these security-sensitive management binaries.
Detects suspicious command-line strings stored in the Windows Explorer RunMRU registry key. Adversaries may use this location to store persistence commands or to obfuscate command-line arguments that are intended to be executed by the user or via automated processes.
This rule detects persistence attempts via Component Object Model (COM) hijacking. It identifies a specific process 'December_blob.exe' creating or modifying registry keys associated with COM CLSIDs (specifically InprocServer32) and simultaneously dropping or utilizing a file named 'hvcsrv.dll' within an 'IdentityNexusIntegration' directory. This combination of registry modification and file system activity suggests the registration of a malicious COM object to achieve execution persistence.
Detects suspicious execution of the certutil.exe utility for file operations, specifically targeting the copying of certutil or the decoding of files with naming patterns (kid*.exe, kid*.tmp, kid*.bat) within the \Users\Public\Downloads\ directory. This pattern is commonly associated with file staging and deobfuscation of malicious payloads.
This rule detects attempts to query or access the MachineGuid registry key located in HKLM\SOFTWARE\Microsoft\Cryptography. This registry key is commonly used to uniquely identify a Windows installation and is frequently targeted by malicious software to perform system identification or fingerprinting.
Detects the use of PowerShell script interpreters that utilize .NET runtime methods, such as 'RunspaceFactory' and 'CreateRunspace', to dynamically create and execute scripts, pipelines, or invoke methods. This technique is often used by fileless malware and offensive security tools to bypass traditional command-line logging by interacting directly with the System.Management.Automation assembly.
Detects ClickFix-style social engineering attacks where users are lured to 'cloudrobots.cloud' and subsequently execute malicious commands via Windows shell tools (cmd, powershell, mshta, etc.). The rule correlates browser network events to a specific domain, subsequent process launches by explorer.exe, and suspicious registry modifications associated with the Windows RunMRU, which is often abused to store and execute commands pasted by victims.
Page 254 of 1908