Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects potential misuse of the WinGet configuration feature, where remote Desired State Configuration (DSC) YAML files are retrieved using masqueraded file extensions (e.g., .jpg or .txt) or suspicious outbound connections on port 8443, which may indicate an adversary attempting to hide malicious configurations or bypass network filtering.
Detects specific samples of the Rmrlx information stealer by identifying unique file artifacts, mutex names (e.g., Global\EVOLUTION), and debugging/staged files commonly associated with its execution environment, including samples exhibiting IP-checking evasion techniques.
This rule monitors outbound network traffic for the inclusion of a Windows-style hostname pattern (e.g., 'DESKTOP-XXXXXX'), which is often used by stealer malware or RATs to identify victim machines during C2 communication. It explicitly excludes Microsoft licensing traffic to reduce false positives.
Detects the use of the Windows 'tasklist' utility or command execution via 'cmd.exe' when the command line includes strings associated with common debugging tools (e.g., windbg, x64dbg). This behavior may indicate an adversary checking for the presence of analysis tools or attempting to manipulate running processes, which is often associated with debugger evasion or malicious environment reconnaissance.
Detects the execution of 'rundll32.exe' or 'dllhost.exe' with command-line arguments typically associated with loading Control Panel items (.cpl files). This behavior is often used by adversaries to proxy execution of malicious payloads or bypass security controls by leveraging legitimate Windows binaries.
Detects the creation of a file named 'Normaliz.dll' within an 'AppData\Roaming\Traiolx Custom Utils' directory. The rule matches a known malicious MD5 hash or a specific folder path structure, which is indicative of potential DLL sideloading or persistence mechanisms using an abnormally located DLL.
Detects execution of PowerShell with bypassed execution policy used to download or copy files from remote locations using curl.exe and Copy-Item. This pattern is commonly associated with file staging or retrieving malicious payloads from external URLs, including specific paths.
This rule detects the execution of the Windows FTP client (ftp.exe) using a command script file (via the -s: parameter). It monitors for process creation of ftp.exe with this flag, excluding known legitimate paths. It then correlates this with any child processes initiated by the FTP client to identify potential data exfiltration or automated file transfers.
This rule detects suspicious PowerShell activity including the use of PowerShell to invoke 'curl.exe' for data transfer or the creation of randomly named executables (6-10 characters) within the 'AppData\Local\Temp' directory, which is a common indicator of file staging or malware execution.
Detects execution of 'codeflush.exe' or attempts to rename files involving 'codeflush.exe' and 'pythonw.exe' within 'MusicLibrariesPackage' directories. This activity often indicates the execution of potentially malicious scripts or tools masquerading as legitimate software.
Detects unauthorized access, modification, or creation of the FileZilla 'sitemanager.xml' configuration file by a process other than the legitimate 'filezilla.exe'. This is a common indicator of an adversary attempting to steal stored FTP credentials or modify connection configurations.
Detects instances where an executable masquerading as 'msedge.exe' (Microsoft Edge) is launched from a user's Startup folder. The rule looks for files identified as 'msedge.exe' that contain metadata or product information associated with DISM (Deployment Image Servicing and Management) or base Windows operating system components, indicating a potential attempt to disguise a different utility or payload as a trusted web browser.
This rule detects potential malicious activity by monitoring for known malicious file hashes (MD5) across file and process events, and correlating them with known Command and Control (C2) infrastructure communication patterns, including specific IP addresses and URI paths.
Detects the creation of scheduled tasks using schtasks.exe that are configured to repeat every minute, specifically targeting known malicious or suspicious filenames such as 'MicrosoftUserInterfacePicturesUpdateTackMachine', 'userscreen.exe', or 'config.cat'. The rule monitors both process creation command lines and registry modifications within the Windows Task Scheduler tree.
This rule detects suspicious directory creation or file attribute modifications within the 'naverwhale' roaming AppData directory. Adversaries may use this path to stage malicious payloads, persistence mechanisms, or to impersonate legitimate browser files.
Detects execution of potential Python-based backdoors or loaders that reference specific configuration files named 'config.cat' or 'AccountConfig.cat'. This behavior may indicate an adversary utilizing Python for command and control or malicious script execution.
Detects the use of PowerShell command-line arguments designed to bypass or weaken execution policy restrictions. This includes setting the policy to 'Unrestricted' or 'Bypass' within a specific process scope, which is a common technique used by attackers to execute unsigned or malicious scripts.
Detects instances where PowerShell rapidly cycles through a known list of Microsoft-signed .NET binary utilities (LOLBins) located in .NET framework directories, within a short duration. This behavior is consistent with resiliency-spray techniques, such as those used by Veil#Drop, to find an available binary to host an injected .NET assembly.
Detects the use of PowerShell commands that leverage Reflection.Assembly.Load, a common technique for loading .NET assemblies directly into memory. This behavior is often associated with fileless malware, reflective DLL injection, or obfuscated payloads attempting to bypass security controls like AMSI.
This rule detects the manual instantiation of PowerShell ScriptBlock objects via the '::Create' method. This technique is commonly used by malicious PowerShell scripts and offensive security tools to bypass traditional command-line logging by executing code dynamically in memory, often avoiding disk-based signatures.
Detects post-infection data harvesting behavior associated with PureLogs Stealer. The rule monitors specific LOLBins (.NET binaries) and suspected masqueraded payloads (e.g., syscall.exe) as they attempt to access browser credential, cookie, or web data files from Google Chrome, Microsoft Edge, and Mozilla Firefox. It also tracks the creation of these suspicious processes when invoked by scripting interpreters like PowerShell, wscript, or cscript.
Page 281 of 1908