Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects when the MpDlpService.exe process loads the 'mpclient.dll' library from a location other than the legitimate Windows Defender program directories. This behavior is indicative of potential DLL side-loading or hijack execution flow attempts targeting the Microsoft Data Loss Prevention service.
Detects malicious activity associated with the ClickFix/Vidar campaign, where adversaries create persistence using the Windows Run registry key while masquerading as the legitimate 'VoidTools Everything.exe' utility. The rule correlates registry modifications with the creation or execution of a file path mimicking the legitimate software in suspicious locations.
This rule detects malicious activity related to the exploitation of MpDlpService.exe. It looks for the execution or presence of known malicious file hashes associated with this threat, including a P-stage script, payload files, and a malicious mpclient.dll. Additionally, it identifies instances where the legitimate MpDlpService.exe binary is executed from a non-standard, suspicious directory, which is a common indicator of side-loading or persistence techniques.
This rule detects when the MpDlpService.exe process loads the 'mpclient.dll' library from a location other than the legitimate Windows Defender program directories. This behavior is indicative of potential DLL side-loading or hijack execution flow attempts targeting the Microsoft Data Loss Prevention service.
Detects malicious activity associated with the ClickFix/Vidar campaign, where adversaries create persistence using the Windows Run registry key while masquerading as the legitimate 'VoidTools Everything.exe' utility. The rule correlates registry modifications with the creation or execution of a file path mimicking the legitimate software in suspicious locations.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
This rule detects malicious activity related to the exploitation of MpDlpService.exe. It looks for the execution or presence of known malicious file hashes associated with this threat, including a P-stage script, payload files, and a malicious mpclient.dll. Additionally, it identifies instances where the legitimate MpDlpService.exe binary is executed from a non-standard, suspicious directory, which is a common indicator of side-loading or persistence techniques.
This rule detects potential command and control (C2) communication and malicious process execution associated with the Vidar stealer malware. It monitors both network connections and process command lines for indicators of known Telegram C2 channels and secondary Steam community profile C2 infrastructure. The rule specifically highlights activity originating from processes other than common web browsers to identify suspicious automated beaconing or control.
This rule detects a multi-stage malicious behavior chain: the execution of a suspected loader (identified by hash or specific mutex), followed by network communication to a known C2 domain or IP, and concluded by the placement of a file in the Windows Telemetry folder (typically mimicking msedge.exe). The events are correlated within a short time window (2 hours between each stage) on the same device.
Detects the execution of msiexec.exe to install an MSI package from a remote URL (http/https). The command line includes flags for passive installation (/passive) and an installation parameter (/i), initiated directly by Windows Explorer (explorer.exe), which is often associated with a user manually downloading and opening a malicious MSI file.
Detects the creation of a scheduled task or registry manipulation involving the string 'psychedelicloveUtils' occurring within 30 minutes of the execution of the process 'psychedeliclove.exe'. This pattern is indicative of a persistence mechanism being established by potentially malicious software.
This rule detects the creation of specific suspicious files (e.g., host.ps1, host.bat) within browser native messaging host directories, followed by the termination of the associated web browser process. This pattern suggests an adversary attempting to establish persistence or manipulate browser functionality via native messaging components.
Detects User Account Control (UAC) bypass attempts where an adversary writes to specific registry keys under HKCU\Software\Classes to hijack COM handlers, followed shortly by the execution of auto-elevating Windows binaries like fodhelper.exe, computerdefaults.exe, or sdclt.exe. This activity facilitates silent privilege escalation.
Detects process execution patterns consistent with the "ClickFix" social
engineering technique, where a user is lured (via a fake CAPTCHA, browser
error, or "verify you are human" page) into pressing Win+R, pasting a
pre-copied malicious command, and pressing Enter. This typically launches
PowerShell, mshta, cmd, or curl directly as a child of explorer.exe with
no legitimate parent chain (no browser, no script host), often with
obfuscated or encoded command lines, and frequently reaching out to
attacker infrastructure.
engineering technique, where a user is lured (via a fake CAPTCHA, browser
error, or "verify you are human" page) into pressing Win+R, pasting a
pre-copied malicious command, and pressing Enter. This typically launches
PowerShell, mshta, cmd, or curl directly as a child of explorer.exe with
no legitimate parent chain (no browser, no script host), often with
obfuscated or encoded command lines, and frequently reaching out to
attacker infrastructure.
Detects a suspicious process chain where an AutoIT loader (originating from temporary directories or associated with charmap.exe command line anomalies) executes charmap.exe, followed by the loading of amsi.dll within that charmap.exe process. This behavior is indicative of AsyncRAT injection patterns, specifically where charmap.exe is used as a host process to tamper with AMSI via in-memory patching of AmsiScanBuffer.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
This rule monitors network connections and DNS query responses for activity associated with known suspicious domains: 'getmacouscloud.com', 'ferncore13.com', and 'grove-89.com'. It identifies communication attempts (successes, failures, or DNS lookups) between endpoints and these domains, which is indicative of potential command and control (C2) activity.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects Microsoft Defender (MsMpEng) performing scan or remediation actions against non-standard filesystem paths, specifically NT object-manager namespace paths or CLFS-driver-prefixed paths. This behavior is indicative of an exploitation attempt (e.g., CVE-2026-69414) where an attacker uses symbolic links and CLFS driver namespaces to redirect the Defender scanning engine to arbitrary files on the system, potentially allowing file reads as SYSTEM.
Detects Python compiled bytecode (.pyc) files that have been renamed to .cat, a common Windows Security Catalog extension. This is a masquerading technique often used by backdoors to evade detection and facilitate malicious loader execution.
Detects Active Directory DCSync attempts by monitoring for Windows Security Event ID 4662 where the object properties contain GUIDs associated with directory replication services (DS-Replication-Get-Changes, DS-Replication-Get-Changes-All, and DS-Replication-Get-Changes-In-Filtered-Set). The rule excludes domain controller machine accounts and known legitimate service accounts used for synchronization or backup operations.
Page 299 of 1908