Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of s5cmd.exe with command line arguments indicative of data transfer operations (sync, cp, mv, run) to or from an 's3://' URI. s5cmd is a high-performance command-line tool frequently used for parallel S3 operations, which may be leveraged by adversaries for rapid data exfiltration or staging.
Detects the execution of known Remote Monitoring and Management (RMM) agent installers or binaries via PowerShell. This activity may indicate an attempt to establish unauthorized remote access to a system, a common technique used by threat actors to maintain persistence or conduct post-compromise activities.
This rule monitors for the execution of 'net.exe' or 'net1.exe' with command line arguments containing 'user', '/add', and a specific suspicious string 'Numlock!123'. This pattern is indicative of an adversary attempting to create a local user account on a Windows system using a hardcoded or known adversary credential.
Detects execution of the s5cmd command-line tool performing synchronization, copy, or move operations to a cloud storage URI (s3://) followed by an outbound network connection on port 443 within a 10-minute window. This behavior is indicative of potential data exfiltration to cloud storage.
Detects the execution of the CRPx0 ransomware Stage 2 stager DLL via rundll32.exe. The attack leverages ordinal-based invocation (exporting crypto globals rather than named functions) and masquerades the malicious DLL as a system file named 'WindowsUpdate.log'.
Detects the use of bcdedit.exe to modify the boot configuration to enable 'safeboot' with 'network' (Safe Mode with Networking). This technique is often used by adversaries to bypass security software that may not load or function correctly in Safe Mode.
Detects modifications to registry keys under 'Software\Classes\ms-settings' associated with the fodhelper.exe UAC bypass technique, where an adversary manipulates the registry to hijack execution flow and escalate privileges.
Detects instances where Windows Explorer (explorer.exe) launches common script interpreters like PowerShell or mshta, often indicative of a 'ClickFix' social engineering attack where a user is coerced into pasting malicious commands into the Windows Run dialog.
Detects the use of the Windows Management Instrumentation Command-line (WMIC) utility to delete individual Volume Shadow Copy (VSS) snapshots. This technique is commonly used by ransomware families to inhibit system recovery by preventing users from restoring files from shadow copies.
Detects the UAC bypass technique using fodhelper.exe, where an adversary modifies the 'Software\Classes\ms-settings\shell\open\command' registry key to execute malicious code, followed by the execution of the fodhelper.exe binary, which inherently runs with elevated privileges.
Detects a host initiating rapid sequential SMB tree connections to more than 10 distinct remote hosts within a 5-minute window. This behavior is indicative of network reconnaissance, specifically the enumeration of accessible SMB shares, which is a common precursor to lateral movement and large-scale ransomware encryption activity as observed in DragonForce-related incidents.
Detects the execution of base64 encoded PowerShell commands used by CRPx0 to stage a DLL payload, specifically saving it as 'WindowsUpdate.log' followed by the execution of that payload using rundll32.exe.
Detects the rapid termination of multiple critical processes (security, database, backup, and office applications) consistent with the kill list behavior exhibited by DragonForce ransomware. The rule monitors for a pattern of three or more unique processes from a defined list being terminated on the same host within a 5-minute window, a common precursor to file encryption.
Detects the use of vulnerable kernel drivers, specifically TrueSight.sys and rentdrv2.sys, as part of a Bring Your Own Vulnerable Driver (BYOVD) technique. This activity, associated with DragonForce ransomware, involves registering or accessing these drivers and sending specific IOCTL codes (0x22E044 or 0x22E010) to terminate security software processes.
Detects processes attempting to read the ntdll.dll file directly from the disk, a technique commonly associated with EDR bypass attempts where adversaries map a fresh copy of the library to overwrite hooked syscall functions (e.g., NtAllocateVirtualMemory/NtWriteVirtualMemory) to evade detection. The rule excludes common, legitimate system processes that may legitimately access this file during startup or normal operation.
Detects the silent installation of remote monitoring and management (RMM) software using 'msiexec.exe' initiated by scripting engines (powershell.exe, wscript.exe, or cscript.exe). The rule targets installations occurring in user-writable directories, such as Temp or Downloads, which are common staging locations for malicious droppers, while excluding known legitimate software deployment paths.
Detects the silent installation of remote monitoring and management (RMM) software using 'msiexec.exe' initiated by scripting engines (powershell.exe, wscript.exe, or cscript.exe). The rule targets installations occurring in user-writable directories, such as Temp or Downloads, which are common staging locations for malicious droppers, while excluding known legitimate software deployment paths.
This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.
Detects the execution of known GoCaracal malware samples, identified by specific file hashes or staging file paths, occurring in conjunction with low-level keyboard hook installations using SetWindowsHookEx. This behavior is indicative of active keylogging activity.
Detects the GoCaracal lightweight implant performing process injection by identifying combinations of remote process memory allocation (VirtualAllocRemoteApiCall), memory writing (WriteProcessMemoryRemoteApiCall), and remote thread creation (CreateRemoteThreadApiCall) associated with specific suspicious filenames. It also monitors command-line activity for injection-related flags.
This rule detects the installation of browser extensions that occur during an idle user session (greater than 7 minutes). This behavior is consistent with automated, remote-driven synthetic input injection, often utilized by malware (e.g., NinjaMare) to install malicious extensions without user consent while the system is unattended.
Page 365 of 1908