Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects known side-loaded PlugX RAT host processes ('GRrte.exe' or 'Jarte.exe') located in 'JartePortable' directories attempting to modify process tokens or privileges. This behavior is indicative of privilege escalation preparation, a common activity for the PlugX modular RAT.
Detects removable-media/storage interaction events initiated by the PlugX side-loaded process chain (GRrte.exe / Jarte.exe), consistent with the PlugX core's drive-type query and removable-media ejection behavior (GetDriveTypeW / DeviceIoControl)
Detects high-volume file/directory enumeration behavior by the PlugX side-loaded process GRrte.exe, consistent with PlugX's use of FindFirstFileW/FindNextFileW/FindFirstFileExW for file and directory discovery (T1083).
Detects execution of the PlugX side-loaded host process (Jarte.exe / GRrte.exe) from the JartePortable directory. This process performs in-memory host/system profiling (GetComputerNameW, GetVersionEx, system directory queries) via the decoded PlugX core (T1082), which is not directly visible as command-line telemetry.
Detects execution of the PlugX side-loaded host process (Jarte.exe / GRrte.exe) from the JartePortable directory. This process performs in-memory host/system profiling (GetComputerNameW, GetVersionEx, system directory queries) via the decoded PlugX core (T1082), which is not directly visible as command-line telemetry.
This rule detects persistence mechanisms involving the 'JartePortable' application by monitoring Registry Run keys. It flags when a Registry key is created or modified to include a startup entry for 'Jarte.exe' located in 'C:\Users\Public\JartePortable\'. The detection specifically looks for a suspicious registry value data pattern.
Detects browser extension manifest.json files requesting declarativeNetRequest and content_scripts/host_permissions covering AI assistant vendor domains (BragJack attack class)
This rule detects the opening of a specific PDF file named 'OIC_Invitation_General_Official.pdf' by Adobe Acrobat. The detection logic triggers either when Acrobat processes this file or when the file itself is identified on the system. This pattern has been associated with the delivery of the PlugX remote access tool, often used in targeted spearphishing campaigns.
Detects the execution of taskkill.exe to forcibly terminate the iediagcmd.exe diagnostic process, initiated by the process GRrte.exe. This behavior is indicative of an attempt to impair security or diagnostic tools on the endpoint.
Detects instances where web server or application-related processes (pc-app, java, pc-tomcat, PCClient) spawn command shell interpreters (cmd, powershell, pwsh). This behavior is often indicative of exploitation of a web application vulnerability, such as remote code execution.
This rule detects the execution of a malicious PowerShell command chain initiated by explorer.exe, consistent with the PlugX malware infection sequence. The detection monitors for specific command-line arguments, including the use of curl for file downloads, tar for extraction, and the launching of associated malicious executables like 'GRrte.exe' following the execution of a shortcut file named 'OIC_Invitation_General_Official.lnk'.
Detects the execution of command interpreters or scripting engines spawned by the ManageEngine ADSelfService Plus GINA client process (typically present at the Windows logon screen). This activity is highly suspicious as it indicates potential command injection or abuse of a pre-authentication component running at SYSTEM privileges.
Detects web requests to 'wp-admin/theme-install.php' containing suspicious query parameters that indicate an attempt to force an unauthenticated theme installation via a Cross-Site Request Forgery (CSRF) exploit (Click2Shell). The rule identifies requests with malicious payloads in the 'theme' parameter, specifically looking for indicators that attempt to bypass CSRF protections when originating from an external site or a non-admin session context.
This rule detects attempts by AutoIt scripts (running as AutoIt3.exe or from Temp directories) to perform process injection into the Windows Character Map utility (charmap.exe). It monitors for suspicious API calls like OpenProcess, CreateRemoteThread, and VirtualAllocEx, specifically looking for memory access and protection flags commonly used during malicious process injection.
This rule detects the creation or modification of registry keys within the RunOnce path in both HKEY_CURRENT_USER and HKEY_LOCAL_MACHINE. These keys are commonly abused by adversaries to achieve persistence, as programs referenced in them execute automatically upon the next user logon or system start.
This rule detects the creation of a synchronization mutex with a specific naming pattern ('Global\EVOLUTION') often used by malware families to ensure only a single instance of the malicious process runs on the infected host. The rule monitors DeviceEvents for 'MutexCreated' or 'MutexEvent' and parses the synchronization object name to identify this specific indicator.
Detects instances where Outlook (OUTLOOK.EXE) spawns an executable named 'ai.exe' with a command line containing a 16+ character hexadecimal string, followed closely (within 10 minutes) by a Microsoft Edge (msedge.exe) process execution acting as a network utility. This pattern is indicative of a potential phishing-initiated attack where a malicious payload is executed and subsequently leverages browser components for network communication or C2 activity.
Detects the execution of ConfigurationRemotingServer.exe initiated by winget.exe. This could indicate usage of the Windows Package Manager to facilitate remote configuration or management tasks, which warrants investigation for potential unauthorized use or process manipulation.
This rule detects instances of MSBuild.exe executing or communicating over the network while referencing .NET Framework paths. MSBuild is often abused as a LOLBAS (Living Off the Land Binary and Script) to execute arbitrary code or bypass application control, and unusual network activity from this process is a common indicator of beaconing or command-and-control communication.
This rule detects the use of 'winget' or 'ConfigurationRemotingServer.exe' to execute Windows Configuration DSC (Desired State Configuration) files, specifically targeting the invocation of 'PSDscResources/Script' resources, 'SetScript', 'TestScript', or 'GetScript' operations. This technique may be leveraged by attackers to execute arbitrary code or maintain persistence through the configuration management framework.
Detects successful network connections initiated by the ConfigurationRemotingServer.exe process. This binary is associated with Windows configuration remoting services and may be used for remote administrative tasks or unauthorized remote management activities.
Page 280 of 1908