Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects download or installation attempts of specific trojanized versions (2.35 and 2.36) of the Admin Menu Editor Pro plugin, which were distributed via a compromised update channel on adminmenueditor.com.
Detects the invocation of the undocumented ntdll function 'EtwpCreateEtwThread', which is used as an alternative to standard thread-creation APIs like CreateThread or CreateRemoteThread. This technique is often associated with advanced shellcode execution, such as MovieReaper, designed to evade common thread-creation monitoring sensors.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
Detects bulk filesystem operations (create, copy, rename, move, delete) performed by the masqueraded process 'msedge.exe' located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicative of the MovieReaper 'file manager' module performing mass file manipulation.
This rule detects the creation of specific system mutexes commonly used by malware for persistence or to avoid multiple infections (Mutual Exclusion). It monitors for both a specific hardcoded mutex and a pattern-based approach (15-20 alphanumeric characters) initiated by executables from common temporary or user-writable directories, which is a frequent indicator of malicious secondary payloads or droppers.
This rule detects the creation of specific system mutexes commonly used by malware for persistence or to avoid multiple infections (Mutual Exclusion). It monitors for both a specific hardcoded mutex and a pattern-based approach (15-20 alphanumeric characters) initiated by executables from common temporary or user-writable directories, which is a frequent indicator of malicious secondary payloads or droppers.
This rule detects the creation of specific system mutexes commonly used by malware for persistence or to avoid multiple infections (Mutual Exclusion). It monitors for both a specific hardcoded mutex and a pattern-based approach (15-20 alphanumeric characters) initiated by executables from common temporary or user-writable directories, which is a frequent indicator of malicious secondary payloads or droppers.
This rule monitors for processes named 'msedge.exe' executing from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. The rule filters out legitimate Edge update processes and common browser command-line arguments to isolate potentially malicious masquerading attempts by identifying binaries that share the name of a legitimate application but reside in unexpected, often non-standard locations.
Detects evidence of the MovieReaper loader technique. This behavior involves registering or rewriting Vectored Exception Handlers, allocating memory with EXECUTE_READWRITE protection, and triggering debug-break exceptions to redirect execution into raw NtProtectVirtualMemory syscalls, effectively bypassing user-mode API hooks often used for monitoring.
Detects activity associated with the 'MovieReaper' threat campaign by identifying known malicious file hashes, command and control (C2) IP addresses, and communication with identified malicious domains. This rule monitors process execution, file operations, and network connections within the campaign's active timeframe.
Detects the creation of mutexes or named pipes containing the string 'SALITY', which is a characteristic indicator of the Sality malware family.
This rule detects activity associated with the 'Ghostcode' threat campaign by monitoring multiple telemetry sources. It identifies connections to known malicious IP addresses and domains, patterns consistent with phishing kit hosting, and specific URL structures used in credential harvesting or payload delivery. The rule correlates sign-in logs, device network events, DNS queries, and email telemetry to identify potential compromise.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
Detects the Kimsuky APT-C-55 'Stella_Gary' attack chain, where PowerShell is used to download a JavaScript verification script from an external C2 (InfinityFree), followed by the execution of that script via cscript.exe in temporary directories. This behavior is used to bypass anti-bot mechanisms and retrieve secondary payloads from hardcoded C2 infrastructure.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
Detects the execution of the Bun JavaScript runtime invoking 'index.js' as part of an npm lifecycle event (such as preinstall). This pattern is commonly used in supply chain attacks to execute arbitrary code during the installation of malicious packages.
Page 367 of 1908