Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of cmd.exe with command-line arguments typical of self-deleting batch scripts. The pattern includes a delay (timeout /t 2) followed by a file deletion command (del), often used to remove temporary scripts or malicious artifacts after execution.
Detects the installation or update of browser extensions that utilize 'declarativeNetRequest' or 'webRequest' APIs in conjunction with 'content_scripts' and either broad URL access ('all_urls') or access to sensitive web domains (e.g., Google Gemini, Microsoft Copilot, Perplexity, Claude). This combination is highly indicative of extensions designed for data interception, credential theft, or unauthorized web traffic manipulation.
This rule detects potentially malicious file access patterns by the executable 'comet.exe'. It alerts when this process accesses sensitive files or directories associated with credentials, configuration files, or sensitive browser data, while explicitly excluding benign locations such as Chrome data folders and temporary directories.
Detects the execution of a hidden PowerShell process that subsequently spawns a child process using the 'Start-Process' cmdlet with the '-Verb RunAs' argument within a short time window. This pattern is commonly associated with attempts to bypass User Account Control (UAC) or execute processes with elevated privileges silently.
Detects the execution of 'client32.exe', which is the executable associated with NetSupport Manager, a legitimate remote management software often abused by adversaries to establish persistence and provide remote interactive access to compromised systems.
This rule detects potentially unauthorized installation of root certificates on Windows and macOS systems. Attackers use this technique to bypass security warnings, establish adversary-in-the-middle capabilities, or inspect encrypted traffic by adding their own certificates to the system's trust store.
Detects the execution or loading of specific components (winfsp-x64.dll, DukeQt.dll) associated with the SparroWocky malware framework, or suspicious image load events lacking a defined module path that typically precede reflective mapping.
This rule detects Windows PE executables that are digitally signed with code-signing certificates attributed to 'Discord Inc.' or 'Lenovo'. It performs a negative check to verify that the file metadata (such as internal names or company strings) does not match legitimate software from these vendors. This is intended to identify potential abuse of stolen certificates by adversaries to bypass security controls and masquerade as trusted software.
Detects instances where a process named 'comet.exe' (or 'comet') accesses sensitive file system locations such as Documents, Desktop, Pictures, or system directories like /etc/ or C:\Windows\. This rule excludes known-legitimate installation and application directories associated with Comet software to reduce noise.
Detects persistent, periodic network communication patterns to remote IPs on common ports (443, 8080) that deviate from known administrative remote access tools. The rule identifies processes communicating with a consistent, low-frequency interval, which is highly indicative of automated Command and Control (C2) beaconing behavior.
Detects remote thread creation attempts (via CreateRemoteThread or NtCreateThreadEx) where the associated module path is empty or null, which is a common indicator of process injection techniques attempting to execute code without a backing file on disk.
Detects the creation of a 'manifest.json' file within a directory path containing 'Extensions' by common web browsers, followed by an immediate file access event from a non-standard browser location within one hour of the installation. This pattern is indicative of the installation of a potentially malicious or sideloaded browser extension followed by anomalous file activity.
Detects the execution of an executable file where the command line matches a specific pattern of a single character argument (e.g., '.exe s'). This behavior is frequently associated with malicious tools attempting to perform actions with minimal command-line footprints or potential process injection/tampering patterns when executed by a different user than the initiating process.
This rule identifies potential SparroWocky malware payload files by detecting a specific custom header (0x11328712 in both little-endian and big-endian format) used for identifying encrypted .dat files that contain embedded RC4 keys.
Detects threads created using CreateThread or CreateRemoteThread where the start address resolves to the AnimateWindow function in user32.dll. This technique is often used by malware, such as those leveraging the MinHook library, to disguise the true entry point of injected code by redirecting thread execution through a legitimate Windows API function (hooking).
Detects the allocation of executable memory regions (RWX or EXECUTE_READ) that are not backed by a file on disk (i.e., anonymous memory). This behavior is a common indicator of process injection, shellcode execution, or fileless malware techniques where code is injected into a process and executed directly from memory without a corresponding file on disk.
Detects the creation or modification of a registry value containing 'SnapCart', which is associated with the persistence mechanism of the SparroWocky backdoor.
Detects the creation or modification of a registry value containing 'SnapCart', which is associated with the persistence mechanism of the SparroWocky backdoor.
Detects the creation of a Windows service named 'ProcAuditManager', which is a known indicator of the SparroWocky backdoor attempting to establish persistence on a system.
Detects PE binaries that are either signed with Discord Inc. certificates but do not contain expected Discord metadata, or binaries that are signed with Lenovo certificates but contain indicators (e.g., 'DocSend') that suggest unauthorized use. It also detects any binaries claiming to be signed by these entities that contain invalid or untrusted signatures, identifying attempts to bypass security controls using stolen or spoofed certificates.
Detects the creation or modification of a browser extension 'manifest.json' file that requests both 'declarativeNetRequest' and 'contentScripts' permissions. These permissions are frequently associated with browser-based session hijacking, traffic redirection, and unauthorized data injection, common in malicious extensions.
Page 352 of 1908