Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,705
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Open-source derived remote access trojan with plugin architecture
macOS malware used by JINX-0164 against cryptocurrency developers
Detects specific suspicious behaviors associated with the Payouts King ransomware. It monitors for indirect command execution where cmd.exe is spawned by non-shell processes to programmatically execute schtasks, or the direct invocation of schtasks.exe to execute tasks hidden within paths mimicking Mozilla-related directories for persistence.
Detects the execution of anti-forensic techniques often associated with the Payouts King ransomware campaign. The rule monitors for the deletion of volume shadow copies via vssadmin, the clearing of Windows event logs using wevtutil, and the clearing of the recycle bin. The correlation of these events suggests an attempt to inhibit system recovery and remove indicators of compromise.
Detects the creation of scheduled tasks by decompression utilities or Office applications. This behavior is indicative of a dropper technique where malicious artifacts extracted from archives or spawned by Office documents establish persistence. The rule specifically monitors schtasks.exe command lines that target user-writable directories or involve rundll32-based execution, commonly used by the Obsidian Sandstorm/SilverGorilla threat actor activity.
Detects command-line clearing of security, system, application, or PowerShell event logs to impede investigation. This rule specifically looks for the use of 'wevtutil.exe', 'powershell.exe', or 'cmd.exe' with command-line arguments indicative of clearing event logs, such as 'wevtutil.*(cl|clear-log)', 'Clear-EventLog', or 'Remove-EventLog'.
Detects the installation of the OpenSSH Server feature or the creation of an 'sshd' service on Windows workstations. Adversaries may install OpenSSH as a persistent, covert backdoor to maintain access to a compromised host.
Detects instances where the ConfigurationRemotingServer.exe process spawns tools like schtasks.exe, powershell.exe, or pwsh.exe to create a scheduled task. This behavior is indicative of an attacker abusing the WinGet configuration management (DSC) engine, specifically via the 'winget configure' mechanism, to establish persistence by triggering the creation of a new scheduled task through a DSC script resource.
Detects outbound network connections initiated by ConfigurationRemotingServer.exe on port 443, which may indicate a reverse shell connection established via DSC (Desired State Configuration) resources.
Detects suspicious service-based persistence activity associated with JFMBackdoor, specifically when fltMC.exe (a known host process) initiates child processes sc.exe or services.exe to create or start a service, using file paths located in C:\ProgramData\Microsoft\Network and specific registry key modification patterns.
Detects the creation or modification of Windows services using sc.exe or PowerShell New-Service where the binary path points to suspicious user-writable directories such as Temp or AppData, a technique observed in the Red Lamassu JFMBackdoor infection chain.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
Detects attempts to clear Windows Event Logs using either the wevtutil command-line utility, PowerShell Clear-EventLog cmdlets, or by monitoring specific Windows Security Event IDs 1102 and 104 which indicate logs have been cleared.
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
Detects the creation of a Windows service named 'MixedSvc' that points to the suspicious path 'C:\Program Files\Windows Media Player\Mixed Reality.exe'. This behavior is associated with DcRAT's Operation DragonReturn, where the malware attempts to establish persistence on the host by masquerading as a Windows Media Player component.
Detects the creation or modification of WMI event subscriptions via EventID 5861 from the Microsoft-Windows-WMI-Activity log. This activity, involving EventFilters, EventConsumers, or FilterToConsumerBindings, is a well-known technique used by adversaries to establish persistence and achieve execution triggered by system events, often resulting in elevated SYSTEM privileges.
Detects the LokiBot malware querying the 'MachineGuid' registry value located under 'HKLM\SOFTWARE\Microsoft\Cryptography'. This value is used by the malware to calculate an MD5 hash, which serves as a mutex name to ensure that only a single instance of the malicious process runs on the infected host.
Detects the creation or modification of a Windows service configured for automatic startup under the LocalSystem account that references the GitLab Runner executable. This pattern is commonly used for persistence via CI/CD runner abuse, including threats like the Shai-Hulud worm.
Detects various methods employed by LCRYX ransomware to disable security software and firewall configurations. The rule identifies suspicious process executions, including PowerShell commands to modify Windows Defender settings, netsh commands to disable firewalls, sc.exe commands to stop security services, and the termination of various antivirus processes (e.g., MsMpEng.exe, avp.exe, bdagent.exe) via taskkill. It specifically monitors these actions when spawned from script hosts like wscript, cscript, or shells like powershell and cmd.
This rule detects when the Windows Security Event Log (Event ID 1102) or the System Event Log (Event ID 104) has been cleared. Clearing event logs is a common tactic used by adversaries to remove evidence of their activities on a compromised system.
This rule detects when the Windows Security Event Log (Event ID 1102) or the System Event Log (Event ID 104) has been cleared. Clearing event logs is a common tactic used by adversaries to remove evidence of their activities on a compromised system.
Page 29 of 61