Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,680
9,759
6,693
4,421
3,750
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects the creation or connection of a named pipe with a name containing 'RoguePlanet'. Named pipes are a common inter-process communication mechanism that may be abused by malicious software for command and control, lateral movement, or execution, and identifying specific naming conventions associated with known threats is a common detection strategy.
This rule detects the execution of cmd.exe with a command line argument (/c) spawned directly from common application entry points such as Microsoft Office (Word, Excel, PowerPoint, Outlook) or scripting engines (wscript.exe, cscript.exe). This pattern is a common indicator of malicious macro-based execution, weaponized document exploitation, or script-based secondary payload execution.
Detects the execution of a hidden PowerShell process that initiates a TCP network connection using the .NET System.Net.Sockets.TCPClient class. This pattern is commonly used in fileless reverse shell implementations where a command-line process (like cmd.exe) spawns PowerShell to establish an outbound connection to an attacker-controlled remote host.
This rule identifies endpoints that have transferred a total of more than 50MB of data to a single external, non-private IP address. The detection filters out RFC1918 private subnets and local loopback traffic, aggregating byte counts and connection attempts per endpoint, computer, and destination. This is indicative of potential data staging or exfiltration activities.
Detects execution of processes associated with the CrySome Remote Access Trojan (RAT), identified by known binary names ('patch_diag.exe', 'patch.exe') or file hash. Additionally, it monitors for outbound network connections to a specific, hardcoded C2 IP address (193.26.115.42) on port 5555, which is associated with CrySome RAT's hVNC-enabled client.
Detects the execution of known Mimikatz credential dumping commands, specifically 'lsadump::dcsync' used for Active Directory credential extraction, and 'sekurlsa' used for extracting credentials from the LSASS process memory.
This rule detects the execution of processes named 'MiniBrowse' or access attempts to common web browser credential storage files (Google Chrome 'Login Data', Microsoft Edge 'Login Data', and Mozilla Firefox 'logins.json' or 'key4.db'). These patterns are characteristic of browser credential stealing malware or unauthorized data collection tools.
Detects the creation of suspicious scheduled tasks using the 'schtasks.exe' utility. The rule flags tasks that are created from suspicious paths (e.g., Temp, ProgramData), tasks executing common script extensions (vbs, ps1, bat, hta, js), or tasks that masquerade as legitimate Windows or System update tasks.
Detects the creation of DLL files in suspicious locations (AppData, Temp, ProgramData, Users\Public, Downloads) that are initiated by specific processes commonly associated with software that might be vulnerable to DLL side-loading, such as Microsoft, Citrix, VMware, or Fortinet binaries, when those processes are executing from outside standard protected directories.
Detects the use of the Sysinternals ADExplorer tool for Active Directory environment exploration, including the creation of snapshots or data dumps, as well as the use of the native 'net' utility to enumerate domain users and groups. These activities are common indicators of internal reconnaissance and discovery phases during an attack.
This rule detects a multi-stage attack pattern involving the execution of PowerShell via explorer.exe, followed by subsequent sub-process activity that attempts to access sensitive browser-stored credentials (Login Data or Cookies) or specific cryptocurrency wallet data, combined with a concurrent network connection attempt, indicative of credential exfiltration via a command-and-control (C2) beacon.
Detects instances where a process is spawned with a spoofed parent process ID (PPID) that points to a known security software or EDR component. Attackers perform this technique to inherit the security exclusions applied to trusted security processes, thereby effectively bypassing EDR/AV monitoring.
This rule detects rapid sequential DNS queries by a single host for multiple domains that mirror common brand impersonation patterns (e.g., login, business, empresas, post-app). The detection logic flags when at least two unique domains matching these patterns are queried within an 18-minute window, which is indicative of potential credential harvesting or phishing reconnaissance.
This rule detects potential network port scanning behavior by identifying a host that initiates connections to both ports 3333 and 3334 on a remote destination within a short time window (15 seconds). This specific pattern is often associated with automated discovery or lateral movement tools probing for specific services.
This rule monitors for a suspicious execution pattern where a browser (Chrome or Edge) is launched with specific command-line flags ('--no-first-run', '--disable-gpu', 'about:blank') by a non-standard parent process, followed shortly by the loading of the 'elevation_service.exe' from 'services.exe' and the loading of 'DPAPI.dll' by the browser process. This sequence is often associated with automated browser credential dumping activities, where attackers attempt to bypass UI requirements or programmatically extract secrets from the browser's credential storage.
This rule detects processes accessing sensitive browser credential files ('passwords.json' or 'cookies.json') located in common browser profile output directories. Accessing these files is a common technique used by malware and adversaries to steal stored credentials from web browsers.
Detects instances where common scripting or package management tools (e.g., node.exe, python.exe, pip.exe, npm.exe) launch Windows command line interpreters (powershell.exe, cmd.exe, wscript.exe, etc.) with command-line arguments indicative of potentially malicious activity, such as base64-encoded strings, command execution flags, or high-entropy command lines.
This rule detects the use of GSocket and GS-Netcat utilities, which are often used for creating reverse shells and persistent network tunnels. It monitors for either direct network connections associated with these tools or command-line activity indicating these tools are being configured for persistence using cron jobs, systemd services, or @reboot triggers.
Detects instances where the Console Host process (conhost.exe) is executed at a System integrity level with a parent process of the Windows Error Reporter (wermgr.exe). This pattern is atypical as conhost.exe typically runs within the context of the user session or the initiating process, and spawning it from wermgr.exe at System level may indicate an attempt to hide a console window or manipulate system processes via an elevated parent.
Detects a sequence of suspicious activities characteristic of information-stealing malware (e.g., Vidar/SnappyClient). The rule correlates browser credential access (Login Data/Cookies), screen capturing (GDI API calls), and keylogging (SetWindowsHookEx) with subsequent archive staging activities (compression of sensitive data in temp folders) within a one-hour window.
Detects the execution of FortiEndpoint_Patch.exe with specific command-line arguments used for configuration or information gathering.
Page 32 of 100