Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects the Windows Update service (wusvc.exe) or any process with environment strings (command line or folder path) containing sandbox-related keywords such as 'sandbox', 'malware', 'virus', or 'sample'. This behavior is characteristic of malware attempting to detect if it is running within an analysis, sandbox, or virtual machine environment.
Detects activity associated with the SNOWLIGHT malware, specifically the dropping of a malicious executable named 'wusvc.exe' or 'WindowsUpdate' into user-writable directories (Downloads or AppData), followed by the creation of an automatically starting Windows service that executes the dropped file. This rule correlates process creation/service registration events with SCM event 7045 entries.
Detects modifications to Windows Registry keys related to Component Object Model (COM) objects (CLSID or InprocServer32) where the registry value points to suspicious file paths, specifically those within temporary directories like Temp or AppData. This behavior is indicative of an attacker attempting to establish persistence or perform privilege escalation by hijacking COM object execution flow.
Detects a sequence of events where ManageEngine or IDrive remote monitoring software is followed within 120 minutes by the execution of potential staging or encryption-related tools (servertool.exe or encrypt.exe) on the same device. This pattern may indicate the abuse of legitimate administrative tools for unauthorized activities or ransomware-like behavior.
Detects attempts to stop or clear Windows Event Logs using command-line utilities such as 'sc', 'net', or 'wevtutil'. This activity is often performed by adversaries to remove forensic evidence of their actions.
Detects modifications to Windows Registry keys related to Component Object Model (COM) objects (CLSID or InprocServer32) where the registry value points to suspicious file paths, specifically those within temporary directories like Temp or AppData. This behavior is indicative of an attacker attempting to establish persistence or perform privilege escalation by hijacking COM object execution flow.
Malvertising loader delivering CastleStealer via malicious Google Ads
Infostealer distributed via fake open-source tool impersonation sites
IoT botnet malware family used for DDoS and proxy infrastructure
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Form-grabbing and credential stealing malware-as-a-service
Fraud framework powering scam domains for crypto and gambling schemes
Fraud framework powering scam domains for crypto and gambling schemes
Loader malware delivering follow-on ransomware payloads
Credential and browser data stealer distributed via OXLOADER campaigns
This rule detects the execution of 'wermgr.exe' from a path other than the expected 'C:\Windows\System32'. This behavior is indicative of the 'RoguePlanet' exploit, where an adversary replaces a Windows Defender quarantine artifact with a malicious payload and triggers it via the 'QueueReporting' scheduled task, running with NT AUTHORITY\SYSTEM privileges.
Detects unauthorized access to wermgr.exe residing within Volume Shadow Copy paths or staged in specific temp directories. This behavior is associated with the RoguePlanet exploit, which uses this pattern to obtain SYSTEM-readable handles for subsequent oplock placement and TOCTOU (Time-of-Check Time-of-Use) race conditions to achieve privilege escalation.
Detects attempts to clear Windows event logs using built-in utilities including wevtutil.exe, PowerShell, or through direct event log event ID triggers (1102, 104). This activity is often associated with adversaries attempting to remove evidence of their presence on a system.
Detects attempts to clear Windows event logs using the native 'wevtutil.exe' utility or PowerShell cmdlets. Attackers often clear logs to remove evidence of their malicious activities after achieving persistence or executing other operations.
Detects attempts to clear Windows event logs using the wevtutil.exe command-line utility or by triggering native Windows Event Log IDs 1102 (Security log cleared) or 104 (System log cleared). Clearing these logs is a common technique used by adversaries to hide indicators of malicious activity following an intrusion.
macOS malware used by JINX-0164 against cryptocurrency developers
Page 28 of 61