Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,759
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects suspicious activities originating from OpenVPN Connect processes, including the spawning of command-line interfaces, scripts, or proxies, as well as the creation of specific ACE marker files and modifications to browser proxy settings, which are indicative of potential exploitation or post-exploitation activity.
This rule detects attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring processes such as PowerShell, cscript, wscript, and mshta for command-line arguments that attempt to modify AMSI memory structures. It specifically looks for patterns involving AmsiInitialize, memory nullification, and the loading of amsi.dll using techniques like DllImport or Add-Type.
This query hunts for malicious scripts that are logged on Crowdstrike EDR telemetry via the event type: ScriptControl
Detects the execution of Control Panel applets (.cpl) via unconventional proxy binaries like dllhost.exe or rundll32.exe. This pattern is commonly observed in malware attempting to execute malicious DLLs by leveraging Windows system binaries to bypass security controls and application whitelisting.
Detects the execution of 'aws sts get-caller-identity' combined with 'curl' operations utilizing stdin data piping, often associated with unauthorized identity enumeration and data exfiltration in cloud-native environments, particularly when initiated from developer tool contexts like Amazon Q/MCP configurations.
Detects modifications to Chrome or Chromium browser preference files that indicate either the installation of a specific malicious extension or the overriding of the default search provider to a known suspicious domain (perplexity-ai.online). This indicates potential browser-based persistence or search hijacking.
This rule detects the creation of specific temporary directories following a pattern often used by installers or malware, and the subsequent writing of 'wermgr.exe' (Windows Error Reporting manager) into these temporary locations. This behavior is indicative of potential masquerading or process hijacking attempts, where a malicious executable is disguised as a legitimate Windows process by operating from an unexpected, temporary directory.
Detects instances where the Windows Error Reporting process (wermgr.exe) attempts to open files located within a Volume Shadow Copy path. This behavior is atypical and may indicate an attempt to access sensitive files from a shadow copy, a technique often used in credential dumping or discovery activities.
Detects instances where a user account is created or modified (e.g., added to a local admin group) shortly after a network logon event (Logon Type 3 or 10). This behavioral correlation is highly indicative of lateral movement followed by local privilege escalation or persistence establishment.
This rule detects token manipulation and impersonation behaviors characteristic of Cobalt Strike post-exploitation activity. It specifically identifies instances where common child processes (cmd.exe, powershell.exe, net.exe, whoami.exe) are spawned from non-standard parent processes associated with Cobalt Strike payloads (e.g., rundll32.exe, msiexec.exe, svchost.exe), often accompanied by a discrepancy between the effective username and the parent process username or the use of discovery tools post-impersonation.
Detects the BQT/start.exe loader exhibiting suspicious behavior indicative of sandbox or analysis environment evasion, including checking for common analysis tools, enumerating processes, or querying the registry for VMware-related artifacts.
Detects the execution, installation, or configuration of Tailscale, a legitimate remote access tool. The rule monitors for common command-line arguments like '--authkey' and 'up', service-related activity, and execution from non-standard file paths. It flags instances where Tailscale is spawned by common script interpreters or command shells, which is a common indicator of unauthorized remote access or C2 implant activity.
Detects the creation of a potentially malicious shared library (libcache.so) in /usr/local/lib followed by a modification of the /etc/ld.so.preload file on Linux systems within a short time frame. This technique is commonly used for persistence and code injection, where the dynamic linker is forced to load the malicious library before others.
Detects DLL sideloading patterns associated with OceanLotus (APT32), specifically targeting known sideloaded module filenames or legitimate processes loading modules from user-writable and non-standard directories using suspicious command-line flags.
Detects OneDrive synchronization service processes or associated modules invoking suspicious token manipulation or privilege enumeration APIs, such as 'StealToken', 'Impersonate_ThisThread', or 'GetPrivileges'. This behavior is indicative of potential privilege escalation or process injection techniques disguised within legitimate cloud sync service processes.
This rule detects instances where rundll32.exe is spawned from scripting engines (wscript.exe, cscript.exe, powershell.exe, pwsh.exe) or executes from non-standard directories like AppData\Local\Temp or ProgramData. This behavior is commonly indicative of malicious proxy execution to bypass security controls.
Detects modifications to Windows service registry keys (ImagePath, Start, or Type) performed by the native reg.exe or regedit.exe command-line utilities. This behavior is often associated with the creation or modification of services for persistence or privilege escalation.
Detects the installation of a new Windows service using sc.exe from a non-standard parent process (not services.exe) or the installation of a service with an executable path located in suspicious directories such as Temp, AppData, ProgramData, or Users folders.
This rule detects potentially malicious modifications to Windows service registry keys. It monitors the 'Services' registry hive for changes to the 'Start' value to identify services set to start automatically or at boot, or modifications to the 'ImagePath' value that do not conform to expected system-protected paths. This behavior is indicative of an adversary attempting to establish persistence by creating or modifying a malicious service.
This rule monitors for the creation of a new .sys file outside of the standard Windows system driver directories (System32 or SysWOW64) within a 15-minute window of a corresponding registry update to the 'ImagePath' of a service. This sequence is indicative of a persistence mechanism involving the installation of a potentially malicious kernel-mode driver, often used by rootkits or malware to achieve high-privilege execution.
Detects suspicious execution patterns originating from Gitea act_runner that indicate potential container escape attempts or host namespace manipulation. The rule flags the use of sensitive docker flags such as --pid=host, --ipc=host, --cap-add=ALL, and security profile unconfining, alongside the execution of 'nsenter' or the existence of specific proof-of-concept markers related to container escape vulnerabilities.
Page 36 of 100