Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects suspicious process creation patterns indicative of process hollowing. The rule identifies processes spawned by common script interpreters (powershell.exe, wscript.exe, cscript.exe, conhost.exe) in a suspended state, followed by memory operations involving ntdll.dll and APIs such as NtUnmapViewOfSection or ResumeThread, which are characteristic of hollowing injection techniques.
Detects execution of LausivLoader by identifying suspicious process creation patterns typically associated with process hollowing. This includes a parent process (powershell.exe or conhost.exe) launching a child process in a suspended state (CREATE_SUSPENDED), followed by behavioral indicators of memory manipulation and code replacement.
Detects execution of PowerShell scripts attempting to modify Windows Defender settings by adding directory exclusions (including the C:\ drive) via cmdlets like Add-MpPreference, Set-MpPreference, or WMI/CIM methods, often followed by a forced Group Policy refresh. This pattern is associated with malicious staging activity, including malware loaders like LausivLoader.
Detects the creation of a Volume Shadow Copy followed by an attempt to access or copy the Active Directory database file (ntds.dit) from the shadow copy. This pattern is commonly used by adversaries to perform offline credential dumping.
Detects PNG image files containing an 'iTXt' metadata chunk and a specific byte marker (FF 89 AD 4A). This signature is characteristic of LausivLoader, which hides an encrypted payload within the image using steganographic techniques, intended for subsequent extraction via XOR decryption and DEFLATE decompression.
Detects attempts to patch ETW (Event Tracing for Windows) functions such as EtwEventWrite within the memory space of PowerShell or PWSH processes. This is a common technique used by attackers to suppress telemetry and evade security monitoring tools, often associated with bypassing AMSI/ETW logging mechanisms.
Detects attempts to patch ETW (Event Tracing for Windows) functions such as EtwEventWrite within the memory space of PowerShell or PWSH processes. This is a common technique used by attackers to suppress telemetry and evade security monitoring tools, often associated with bypassing AMSI/ETW logging mechanisms.
Detects the creation of a JavaScript file masquerading as a legitimate Microsoft PhotoEngine component ('PhotoStudio.js') within the '%LOCALAPPDATA%' directory. This behavior is associated with the LausivLoader malware, which uses this masquerading technique to evade detection.
This rule detects the LausivLoader initial-stage obfuscated JavaScript dropper. It identifies the malware either by specific file hashes (MD5/SHA256) or by detecting characteristic behaviors: small file size (<1MB), the presence of 'String.fromCharCode' obfuscation techniques, excessive junk comments, and supply-chain related lure strings.
This rule monitors for two distinct stages of potential account recovery abuse. First, it detects the execution of suspected Python scripts on an endpoint that contain command-line arguments related to password recovery or authentication codes. Second, it monitors network proxy/web logs for a high volume of API requests to the 'easy4ipcloud.com' domain associated with password reset or device probe endpoints, which may indicate automated credential stuffing or unauthorized device account recovery attempts.
Detects 32-bit PE files that are packed using UPX and utilize specific file names (1.exe or xeno.exe) associated with the SalatStealer credential harvester. The rule also checks for a zeroed compile timestamp in the PE header, which is a common characteristic of this malicious file.
Detects the execution of PowerShell via script interpreters (wscript.exe, cscript.exe) or terminal hosts (conhost.exe) where the command line contains specific environment variable lookups and obfuscated string identifiers. This pattern is commonly associated with malware or malicious payloads attempting to execute PowerShell commands indirectly to evade detection.
This rule detects PowerShell commands that exhibit multi-stage suspicious behavior indicative of fileless malware execution. It monitors for combinations of cryptographic operations (AesManaged), decompression (GZipStream), and reflective assembly loading (System.Reflection.Assembly), which are common tactics used by attackers to decrypt, decompress, and execute malicious payloads directly in memory.
Detects the execution of wscript.exe spawning a child process of powershell.exe where the command line arguments are highly suspicious, including headless mode, encoded commands, and hidden window parameters. This pattern is commonly used by attackers to execute obfuscated malicious scripts while attempting to avoid detection.
This rule detects potentially malicious activity involving the patching of process memory or tampering with security instrumentation (such as Event Tracing for Windows - ETW) by common scripting host processes. It flags events like 'PatchProcessMemory', 'ProcessInjection', or references to 'AmsiScanBuffer' and 'EtwEventWrite' associated with PowerShell, WScript, or CScript, which are often used in post-exploitation scenarios to evade security controls and telemetry collection.
Detects attempts to bypass or tamper with the Antimalware Scan Interface (AMSI) via direct memory modification or through script command-line arguments. The rule monitors DeviceEvents for AMSI-specific events (e.g., buffer patching, provider tampering) and looks for common PowerShell and scripting engine command-line patterns indicative of AMSI bypass techniques.
Detects removable-media/storage interaction events initiated by the PlugX side-loaded process chain (GRrte.exe / Jarte.exe), consistent with the PlugX core's drive-type query and removable-media ejection behavior (GetDriveTypeW / DeviceIoControl)
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
Detects the execution or file activity associated with the 'OrionQuests-Setup.exe' installer. This rule monitors both process creation and file system activity to track the presence and usage of this specific installer executable, which may indicate the installation of potentially unauthorized or untrusted software.
Detects the execution of PowerShell with encoded commands or Base64 decoding attempts initiated by common Windows shell applications (explorer, mshta, wscript, cscript) launched from an LNK file. This pattern is commonly associated with malicious LNK shortcuts used as initial access vectors or stage-two downloaders.
Page 296 of 1908