Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects a high frequency of process terminations occurring within a 5-minute window on a device where specific driver-related processes or command lines ('nvfsflt64.sys', 'Alinubx.sys') have been identified. Such behavior is characteristic of malicious activity attempting to disrupt system security components or clear traces, potentially indicating an endpoint denial of service or evasion attempt.
This rule detects a multi-stage attack pattern consistent with a Bring Your Own Vulnerable Driver (BYOVD) chain. It identifies the installation of specific known vulnerable drivers (e.g., Alinubx.sys, nvfsflt64.sys) and the registration of a corresponding service (NvFsFilter), followed by the mass termination of various security software and EDR processes within a short timeframe. This behavior is indicative of an adversary using kernel-mode privileges to disable security controls.
Detects the deletion of registry keys or values associated with Google Chrome's extension settings preferences. This activity may indicate an attempt to disable installed extensions or tamper with browser security configurations.
Detects the execution of potentially malicious utilities (curl, finger, cmd, powershell) that are launched by the Windows Explorer process (explorer.exe). This pattern is often indicative of malicious activity where an adversary uses legitimate OS processes to spawn command shells or network tools for further exploitation or file retrieval.
Detects the loading or execution of known SloppyRAT DLL samples. This malware is identified for its implementation of Hell's Gate-style indirect syscalls, utilizing techniques such as DJB2 API hashing and NTDLL stub parsing to evade EDR hooks. The rule monitors for specific file hashes and potential masquerading behaviors (e.g., hostfxr.dll) across image loading, file, and process events.
Detects techniques used by SloppyRAT, including indirect NTDLL syscalls bypassing API hooks (Hell's Gate style), and the use of DJB2 API hashing for NtAllocateVirtualMemory and NtCreateThreadEx. It monitors for CallTrace patterns indicating unbacked memory calls into ntdll.dll, detection of hardcoded DJB2 hash constants, or the presence of the B8 (mov eax, imm32) instruction followed by the 0F 05 syscall opcode.
Detects instances where PowerShell is executed with an explorer.exe parent process, but the actual creating process differs from explorer.exe. This behavior is indicative of parent PID (PPID) spoofing, a technique often used to evade detection or masquerade the execution source by abusing the PROC_THREAD_ATTRIBUTE_PARENT_PROCESS flag in the Windows API.
Detects the loading of .NET Common Language Runtime (clr.dll) and System.Management.Automation.dll into a process that is not a recognized PowerShell binary (e.g., powershell.exe, pwsh.exe). This behavior is associated with the 'PSInline' technique used by SloppyRAT, where PowerShell capabilities are invoked directly via COM objects to execute commands in memory. The rule further correlates this activity with the creation of files with a .png extension in temporary directories, which is consistent with the exfiltration staging behavior of the malware.
This rule monitors for indicators of compromise (IOCs) associated with the Rapuncel/Cruciferra 'Bring Your Own Vulnerable Driver' (BYOVD) malware-as-a-service (MaaS) campaign. It detects malicious file hashes (associated with dropped binaries or drivers), connections to known malicious command-and-control (C2) IP addresses, and network requests to domains used by the infrastructure.
Detects the suspicious execution of ServiceModelReg.exe or command lines containing the 'Elevation:Administrator!new:' string, which is associated with bypasses of Windows User Account Control (UAC). The rule excludes trusted system processes like msiexec, TrustedInstaller, and svchost to reduce noise.
Detects the execution of IronPython or generic Python interpreters where the command line contains suspicious obfuscation patterns, including base64-encoded strings, zlib compression/decompression, and the use of the subprocess module. This pattern is commonly used by adversaries to execute hidden or obfuscated malicious payloads.
This rule monitors process creation, file system activity, and HTTP logs for indicators associated with the 'GHOST-VAULT' or 'GHOST-CRED' threat activity. It specifically triggers on files or paths containing 'GHOST-VAULT-', processes named 'ghost_' or containing 'ghost_' in the command line, and HTTP requests containing 'GHOST-CRED/3.0', 'GHOST-VAULT/', or 'GHOST/0day'.
Detects the execution of processes that contain command-line arguments indicative of debugger evasion techniques, such as checking for the presence of a debugger using functions like 'IsDebuggerPresent' or 'CheckRemoteDebuggerPresent'. This is commonly associated with malware attempting to evade dynamic analysis in sandboxes or by security researchers.
Detects execution of the Windows diskpart utility using a script file, initiated by a process with a name ending in _win64.exe. This pattern is commonly used in malicious scripts for disk manipulation or inhibiting system recovery.
Detects instances where AI-assisted coding tools (such as Claude, Copilot, or Gemini) initiate Git operations (clone, checkout, fetch) in a non-interactive context. This behavior may indicate an automated process using AI tools to perform code repository interactions that should typically be user-initiated or are otherwise suspicious in a non-interactive environment.
Detects execution of PowerShell or Command Prompt where the command line contains obfuscated indicators or specific suspicious files and IP addresses, while simultaneously bypassing the execution policy. This is characteristic of malicious script execution or payload delivery attempts.
Detects execution of PowerShell or CMD commands originating from Windows Explorer (explorer.exe) that exhibit characteristics of malicious command-line obfuscation, such as encoded commands, bypass flags, or caret-based character obfuscation.
Detects the use of .NET reflection and assembly loading techniques within PowerShell or C# compiler (csc.exe) command lines. Attackers frequently use these methods to load malicious payloads directly into memory, bypassing disk-based detection mechanisms. The rule looks for the combination of reflection-related namespaces/methods and indicators of obfuscation or encoding such as Base64 strings, Gzip compression, and decryption routines.
Detects instances where PowerShell initiates process injection behaviors, specifically targeting common user-facing applications such as browsers (chrome.exe, msedge.exe), build tools (csc.exe), or indexing services (SearchIndexer.exe). The rule identifies memory allocation and thread manipulation activities often associated with reflective code injection or memory-based payloads.
Detects the installation or service creation of 'gdrv.sys', a known vulnerable GIGABYTE driver often abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to escalate privileges.
Detects the execution of ReAgentC.exe with the /disable flag, which disables the Windows Recovery Environment (WinRE). This activity is often used by adversaries to prevent system recovery or to facilitate data impact, such as ransomware deployment.
Page 273 of 1908