Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects file creation, renaming, or deletion events within the Recycle Bin directory involving suspicious filenames or PDF files, which may indicate an adversary attempting to hide, stage, or delete evidence.
Detects the execution of regasm.exe or regsvcs.exe where the command line arguments reference paths typically used for temporary files, user downloads, or public directories. These signed .NET utilities can be abused to proxy the execution of malicious code by loading custom COM assemblies via ComRegisterFunction or ComUnregisterFunction attributes, effectively bypassing application control.
Detects execution of MSBuild.exe (Microsoft Build Engine) where the project file is located in a potentially user-writable, temporary, or staging directory, or when the command line includes indicators of inline task compilation (e.g., UsingTask or TaskFactory). This behavior is often associated with the use of MSBuild to proxy execution of arbitrary code to bypass application control mechanisms.
Detects the execution of an executable named 'Windowsupdate.exe' located in non-standard user-writable directories (e.g., AppData\Local) when initiated by an FTP client process. This is a common pattern for malicious masquerading or persistence mechanisms.
This rule detects potential User Account Control (UAC) bypass attempts involving the abuse of the COM object associated with 'sppextcomobj.exe'. The rule looks for scenarios where 'rundll32.exe' initiates 'sppextcomobj.exe', which in turn triggers 'slui.exe'. This behavioral chain is a known technique for achieving elevated privileges by exploiting how Windows handles COM auto-elevation.
Detects file creation, modification, or renaming activity within AppData directories associated with VPN clients (CyberGhost, NordVPN, ExpressVPN). This rule is intended to identify potential unauthorized access, staging, or tampering with VPN configuration files or credentials often stored in these application directories.
Detects the use of dnscmd.exe to register a server-level plugin DLL for the Windows DNS service. This action is a known persistence mechanism that can be used to achieve arbitrary code execution within the context of the DNS service (dns.exe) upon service restart. The rule specifically alerts when a DLL file path outside of standard System32 or SysWOW64 directories is configured.
This rule detects behaviors associated with the Hannibal Stealer, specifically the identification of the Bitcoin Core wallet directory via registry lookups (strDataDir) followed by the unauthorized copying of 'wallet.dat' files into a staging directory structure, commonly used for cryptocurrency wallet exfiltration.
Detects the use of dnscmd.exe to register a server-level plugin DLL for the Windows DNS service. This action is a known persistence mechanism that can be used to achieve arbitrary code execution within the context of the DNS service (dns.exe) upon service restart. The rule specifically alerts when a DLL file path outside of standard System32 or SysWOW64 directories is configured.
Detects non-standard processes loading the iphlpapi.dll library and subsequently executing commands related to ARP network discovery, such as GetBSSID, SendARP, GetDefaultGateway, or GetAllNetworkInterfaces. This behavior is characteristic of network reconnaissance and fingerprinting activities often employed by information stealers like Hannibal Stealer.
Detects remote lateral movement attempts using DCOM to launch the Microsoft Management Console (mmc.exe) via svchost.exe (RPCSS/DCOM), followed by mmc.exe spawning an unexpected child process. This pattern indicates potential remote execution and abuse of signed binary proxies for post-exploitation activities.
This rule detects instances where the DISM core library (DismCore.dll) is loaded by a process named 'index.exe', or where a process named 'index.exe' is executing from or interacting with a folder path containing 'DISM'. This behavior is characteristic of malicious tools or scripts attempting to proxy execution through the Deployment Image Servicing and Management (DISM) binary, a common technique for bypassing security controls.
Detects modifications, creation, or renaming of common cryptocurrency wallet files (e.g., wallet.dat, .wallet files) within known storage directories. This behavior is often associated with infostealers or malware attempting to exfiltrate or manipulate user financial assets.
Detects presence of configuration markers associated with the Hannibal Stealer 'clipper' functionality. These markers (e.g., 'cclipper', 'clipboard_check_delay') are used by the malware to monitor the system clipboard and replace cryptocurrency wallet addresses with attacker-controlled addresses.
Detects components of the LucidPawn malware family using DLL side-loading (e.g., index.exe loading DismCore.dll) or renaming DISM binaries within WindowsApps folders. The detection identifies these processes subsequently querying system locale or language registry keys, indicating a geo-targeting execution gate used to determine if the environment matches the intended target profile (specifically zh-TW).
Detects instances of the Hannibal Stealer module that attempt to masquerade as the legitimate 'CefSharp.BrowsersSubprocess.dll' by spoofing publisher metadata ('LLC Windows'). The detection triggers when this process is identified initiating network connections shortly after execution, which aligns with the malware's known behavior of performing geolocation-based checks before continuing activity.
Detects the use of WMI (via wmic.exe, PowerShell, or other scripting engines) to query the Win32_Process class for process identification or path resolution. This behavior is commonly used by malicious actors, including info-stealers, to map active processes and their file locations for discovery purposes.
Detects the execution of PowerShell with specific Pester build script arguments, initiated by Windows Explorer, followed within 5 minutes by the execution of 'index.exe' on the same host. This sequence may indicate malicious activity involving script execution leading to the spawning of an unknown or suspicious 'index.exe' binary.
This rule detects potential information stealer activity by identifying the staging of files (.html, .txt, .log) in common user directories like AppData or Temp, combined with process command lines querying sensitive system information (e.g., BIOS, wallets, screen resolution) and network connections to the Telegram API for likely exfiltration.
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
Detects the on-disk presence of a malicious Firefox browser extension, 'pdf-para-texto@extensao.local', used for credential or data harvesting. The rule monitors for the creation of its manifest file or XPI package in specific directories, indicating the staging or installation of the malicious extension.
Page 310 of 1908