Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,680
9,759
6,693
4,421
3,750
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Advanced hunt for injected payloads modifying the memory space of ntdll.dll to patch EtwEventWrite or NtManageHotPatch, blinding EDR telemetry. This rule specifically looks for WriteProcessMemory API calls targeting ntdll.dll from processes like InstallUtil.exe, MSBuild.exe, and powershell.exe, which are commonly abused for code execution and evasion.
Detects the execution of setup scripts (e.g., install.sh, Makefile) by shell interpreters that were spawned from common developer-oriented applications (e.g., IDEs, code editors, Python) within a short window after a git clone operation. This behavior is indicative of potential supply chain compromise or malicious project initialization.
Detects the execution of potential malware disguised as 'winupdate.exe' and specific network traffic associated with it. The rule identifies suspicious file paths (e.g., in AppData cache) and execution by the binary while communicating with external domains such as pastebin.com or discord.com, which are often abused for command-and-control or payload delivery.
Detects instances where Microsoft Teams or its associated process spawns remote assistance utilities such as Quick Assist, Microsoft Remote Assistance (msra), or Remote Desktop Connection Manager (msrdcw). This behavior may indicate an attacker abusing legitimate remote access software for command and control or unauthorized remote control.
Detects Node.js processes attempting to access sensitive files or environment variables associated with Claude AI (e.g., Anthropic API keys, .claude configuration files), which may indicate credential harvesting activity by malicious code.
This rule detects network communication (DNS, connection, or traffic) with known infrastructure and specific URI paths associated with the SpectralViper threat actor. It enriches these findings by identifying if the communication originated from processes commonly associated with SpectralViper, such as OneDrive Sync services or specific Intel audio service files.
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
This rule detects file system artifacts and network activity associated with a malicious Chromium-based browser extension (ID: flkebkiofojicogddingbdmcmkpbplcd). The extension utilizes service workers to intercept browser search queries and capture keystrokes, subsequently exfiltrating the data to an attacker-controlled domain.
Detects the creation of files within the Windows startup directory or Windows tasks folder. The rule specifically excludes known system binaries like schtasks.exe and mstask.exe to reduce noise, and attempts to categorize the artifacts based on specific naming patterns.
Detects evidence of process hollowing involving 'ServiceModelReg.exe', often used to conceal malicious stealer activity. The rule correlates the creation of this process with subsequent unexpected outbound network connections from the same process/host, and also monitors for specific debug/log strings indicative of failed or active process hollowing attempts (RUNPE techniques).
Detects unusual DNS requests initiated by common development, scripting, and administrative tools (e.g., node, python, powershell, curl) to domains that follow patterns often used for webhooks, relays, or command-and-control services. The rule specifically excludes common package management or source code repositories to reduce noise.
Detects instances where the Windows Error Reporter (wermgr.exe) process attempts to open a handle to a Volume Shadow Copy (VSS) device. This behavior is anomalous as legitimate VSS operations are typically performed by dedicated system processes (e.g., vssvc.exe, diskshadow.exe), and such access by wermgr.exe may indicate an attempt to bypass file locks for credential dumping or sensitive data exfiltration.
Detects instances where non-browser or system maintenance processes attempt to access browser credential storage files, such as 'Login Data', 'key4.db', or 'logins.json'. The rule uses a self-join to correlate access to these sensitive files with access to the Windows DPAPI protection directories, often used to decrypt these credentials.
Detects the execution of known Impacket framework tools (such as secretsdump, wmiexec, smbexec, atexec, GetUserSPNs, or ntlmrelayx) which are commonly used for credential dumping, remote service execution, and lateral movement.
This rule detects the execution of known offensive security and post-exploitation toolsets (such as Impacket, Metasploit, CrackMapExec, or NetExec) when initiated from virtualization processes like QEMU. This pattern is indicative of an adversary executing malicious payloads from within a virtual machine or using virtualization software as a proxy for malicious activity on the host.
Detects instances where the Windows COM Surrogate process (dllhost.exe) is executed with a command line argument referencing a .cpl (Control Panel) file. This behavior is indicative of an attempt to proxy malicious code execution via the Control Panel utility, a technique often used to evade application allowlisting.
This rule detects potential unauthorized remote access activity by correlating the execution or network activity of known remote access tools (Tailscale) or suspicious network patterns (DuckDNS, port 4444) with the subsequent execution or network activity of secondary RAT/remote desktop software (RustDesk, AnyDesk, TeamViewer) on the same host within a 10-minute window. This behavior is indicative of an adversary establishing an initial C2 connection followed by deploying secondary remote access tools for persistent remote control.
Detects wscript or cscript executing shell commands (del/delete) to remove .jse files. This pattern is commonly associated with malicious scripts attempting to clean up traces of their execution after running from temporary locations.
This rule detects when a single process account initiates a high volume (10 or more) of file move operations to folders associated with cloud storage services (e.g., 'cloud', 'dropbox', 'drive') within a one-hour window. This behavior could indicate data exfiltration or staging for exfiltration.
Hunting rule for nmap used for internal network discovery.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
Legitimate vulnerability management and pentests also run nmap; prioritize hits when the source is a server or workload not in your scanner inventory, the parent is an interactive shell or script dropped, or the event chains with
tunneling (chisel, proxychains), or lateral movement.
Strongest signals: RFC1918 subnet sweeps, proxychains-wrapped
-sT/-Pn scans, and full-port sweeps across private ranges.
This rule detects potentially malicious activity related to browser extensions, specifically targeting configuration file modifications (manifest.json, rules files) or the use of sensitive browser APIs (declarativeNetRequest, updateDynamicRules) that are commonly abused by malicious extensions. It also flags activity that includes keywords associated with affiliate/ad-click fraud platforms within command line arguments of major browsers like Chrome and Edge.
Page 34 of 100