Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the presence of PIVOTPIPE loader artifacts, specifically the COFF sleep-mask object file (sleepmask.o) and its associated debug log (nb_sleep_dbg.txt), which are written to a randomly named subfolder within the Windows temporary directory as part of a sleep-obfuscation evasion sequence.
Detects the creation of specific named pipes often associated with Cobalt Strike and similar C2 frameworks used for peer-to-peer (P2P) lateral movement. The detection looks for anomalous pipe names created by processes other than standard Windows system processes (svchost, services, lsass), which is a common indicator of beacon communication relaying.
This rule detects the presence of ZigCryptoStealer malware deployed via a NativeAOT-compiled Windows executable. The detection relies on identifying specific hardcoded infrastructure strings, such as a BNB Smart Chain RPC endpoint and a specific contract address used to resolve C2 domains. It also looks for common sideloading hosts associated with the malware's delivery.
This rule detects unauthorized access, creation, or modification of Git credential files (.git-credentials, .netrc) by processes other than standard Git credential management utilities. It also monitors command-line activity that references these credential stores to identify potential attempts to exfiltrate or manipulate stored credentials.
Detects the PIVOTPIPE .NET loader's AMSI-bypass routine by monitoring for the suspicious concurrent loading of amsi.dll and .NET runtime modules (clr.dll, mscoree.dll, or coreclr.dll) within the same process. This behavior is indicative of an attempt to hook into the AMSI interface to disable security scanning before executing malicious payloads.
This rule detects suspicious process injection activity directed at explorer.exe. It looks for cases where explorer.exe is initiated by a non-standard parent process and performs remote thread creation, thread context manipulation, or process image mapping, which are common techniques used by malware to hide execution within a legitimate system process.
Detects high-frequency calls to the VirtualProtect API where memory protections are changed to read/write (PAGE_READWRITE) or executable read/write (PAGE_EXECUTE_READWRITE). This behavior is often indicative of process injection techniques or self-modifying code associated with unpacking, loading shellcode, or tampering with process memory.
This rule detects system calls originating from unbacked, private, or unknown memory regions, which is a common indicator of reflective code loading or process injection techniques. It also flags suspicious call stacks where standard processes like PowerShell, rundll32, or .NET execute system calls on ntdll.dll from non-standard module memory.
Detects the PIVOTPIPE loader extracting a 'sleepmask.o' Common Object File Format (COFF) file into a temporary directory prefixed with 'nb_'. This behavior is associated with the deployment of post-exploitation sleepmask functionality designed to obfuscate or encrypt beacon memory footprints to evade memory scanners.
Detects the presence of the known vulnerable DCRCVDrv.sys kernel driver, which has been identified as being abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security processes via unauthorized IOCTL calls to ZwTerminateProcess.
Detects malicious JavaScript/npm payloads that attempt to evade static analysis and string-based detection signatures by dynamically reconstructing sensitive strings at runtime using V8 string-object construction or obfuscated string tables.
Detects a specific execution pattern associated with the PIVOTPIPE RAT involving two consecutive operator-issued commands. First, a process impersonation action (token theft/impersonation) is detected via PROCESS_OPEN activity, followed by a 'RevertToSelf' call within the same process context. This sequence indicates an attempt to temporarily shift privilege context to impersonate another user before returning to the original security context.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., WebClient, hidden flags, or WebDAV paths) spawned directly from browser processes like chrome.exe or msedge.exe. This pattern is commonly associated with fileless delivery techniques where an attacker attempts to download and execute scripts directly from an internet-facing source.
Detects execution of rundll32.exe with command line arguments containing WebDAV paths (DavWWWRoot), which is a common technique used to execute malicious DLLs from remote locations.
Detects instances of explorer.exe being launched by a parent process other than expected system processes (explorer.exe, userinit.exe, or winlogon.exe). This behavior is highly irregular for Windows desktop environments and may indicate process injection or malicious process masquerading.
Detects the execution of PowerShell commands intended to gather system information, such as OS details, boot time, or video controller configurations. These techniques are often used during the discovery phase to profile a target machine before further malicious actions.
Detects instances where a process attempts to delete its own executable file on disk. This behavior is often associated with malware or adversary tools attempting to remove their footprint post-execution or as part of a cleanup routine.
Detects the creation of 'explorer.exe' originating from a source process other than known legitimate parent processes like 'userinit.exe', 'winlogon.exe', or 'services.exe'. This behavioral pattern is indicative of potential process hollowing or unauthorized process injection, which is a common vector for stealers like ZigCryptoStealer to gain a foothold before performing malicious activities such as clipboard manipulation.
Detects the execution of rundll32.exe where the command line points to a DLL file located on a remote WebDAV share (using the 'davwwwroot' path syntax). This technique is often used to execute malicious payloads while bypassing local disk protections.
Detects the installation of a new kernel-mode service using system utilities like sc.exe, cmd.exe, or powershell.exe, which is a common indicator of a Bring Your Own Vulnerable Driver (BYOVD) attack intended to gain kernel-level privileges.
Detects the execution of known NetSupport Manager remote access tool binaries from locations outside of the official installation directories. This behavior is indicative of unauthorized use or persistence of remote management software, often used as a RAT by adversaries.
Page 260 of 1908