Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,061 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,759
3,853
3,760
3,714
Platforms
40,061
7,331
6,542
3,907
3,664
Products / Services
10,439
9,679
6,724
1,888
1,879
MITRE Techniques
13,740
13,119
8,066
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the creation of a Windows scheduled task named 'Google Chrome Update' where the command-line action does not point to the legitimate GoogleUpdate.exe binary. This behavior is indicative of persistence mechanisms used by threat actors, notably the Kimsuky group, to masquerade malicious tasks as legitimate software updaters.
Detects persistence mechanisms associated with BabylonRAT that utilize Windows Registry Run or RunOnce keys. The rule specifically identifies instances where a file named 'firefox.exe' is executed from the 'ProgramData' directory, which is a common indicator of a masqueraded malicious binary attempting to achieve persistence.
This rule detects PowerShell commands or script blocks that enumerate running processes and query WMI/CIM classes (such as Win32_ComputerSystem or Win32_BIOS) to identify indicators of virtualization, sandboxing, or the presence of security analysis tools. This behavior is indicative of anti-analysis and sandbox-evasion techniques, commonly used by threat actors like Kimsuky to verify their execution environment before proceeding with malicious activity.
Detects network activity and HTTP traffic associated with the Iron Man System kit, specifically targeting hardcoded C2 infrastructure (IP-based) and lure domain patterns involving specific brand tokens combined with disposable TLDs.
Detects network communication with Google Sheets API endpoints that contain specific indicators of C2 behavior, such as suspicious User-Agents, specific spreadsheet cell references, or input options characteristic of automated data exfiltration or command retrieval.
Detects attempts to inhibit system recovery by deleting volume shadow copies or modifying backup/boot recovery configurations. The rule monitors for the execution of vssadmin, wmic, wbadmin, and bcdedit with flags known to facilitate system recovery inhibition, often observed as a precursor to ransomware activity.
This rule detects unauthorized persistence attempts by monitoring for the creation of a registry value named 'DailyFitnessTracker' under the HKEY_CURRENT_USER Run key. It triggers when 'reg.exe' is used to add the key, PowerShell is used to set the registry property, or when a general registry event indicates the creation of this specific key. This behavior is indicative of a persistence mechanism designed to launch a potentially malicious or unwanted program upon user logon.
Detects execution of cmd.exe originating from potentially malicious or unexpected parent processes associated with RUSTYSHADE malware activity. This rule monitors for cmd.exe invoked by processes like 'DriverInstaller.exe' or 'Automata-20.exe', or processes other than standard Windows system processes (explorer.exe or services.exe), which is indicative of command-line shell abuse for malicious operations.
This rule detects potential data exfiltration by monitoring for screen capture activity, identified by API calls like BitBlt or CopyFromScreen or the loading of gdi32.dll, followed by the creation of a screenshot file and subsequent network connections to GitHub domains.
Detects the creation of suspicious scheduled tasks using either schtasks.exe or PowerShell's Register-ScheduledTask cmdlet. The rule specifically looks for masquerading attempts involving names like 'StandAloneOneDriveUpdater-2626', the usage of AtLogOn triggers, and the execution of the binary 'Automata-20.exe'.
Detects the execution of a scheduled task named 'MicrosoftEdgeUpdateTaskUserS-1-5-24' which triggers conhost.exe with the --headless argument or PowerShell with an EncodedCommand. This behavior is indicative of a malicious persistence mechanism masquerading as a legitimate Edge update task, specifically associated with the retrieval of payloads from the malicious domain 'indiatodays.org'.
This rule detects the execution of the HTSPnew.Exe ransomware payload, associated with a trojanized HTS DLL, and subsequent ransomware-related file operations, such as the creation of .krsid encrypted files and the dropping of a Korean-language ransom note (README_KRSID.Txt).
Detects the execution of 'HTSPnew.Exe', a utility associated with suspicious activity or ransomware simulation, combined with command-line arguments that suggest testing, batch execution, or help requests.
This rule detects scenarios where a specific parent process generates five or more child processes, which can be an indicator of suspicious automation, scripting activity, or potential brute-force behavior. It groups events by host and parent process image to identify potential anomalous process density.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects the creation or renaming of specific files ('windowSysUpdates.txt' or 'GymTraniningShedule.exe') within the user's Local AppData directory or its 'SystemFolder32'/'System Folder32' subdirectories. This behavior is indicative of potential malicious activity, such as staged malware persistence or disguised payloads.
Detects the use of PowerShell to enumerate system disks, volumes, and partitions, specifically targeting removable media identifiers. This behavior is commonly associated with reconnaissance activities where an adversary attempts to identify attached storage devices for potential data staging or exfiltration.
Detects the execution of processes named 'DriverInstaller.exe' or 'Automata-20.exe', the invocation of cmd.exe as a child process of these executables, or network requests originating from these processes to GitHub API and raw content endpoints. This pattern is indicative of potential initial access, tool staging, or malicious payload retrieval.
Detects modifications to the Windows Registry 'Run' key or execution of commands via reg.exe or PowerShell that attempt to create or modify a persistence entry named 'DailyFitnessTracker'. This technique is commonly used by malware to ensure execution upon user logon.
Detects the creation or modification of scheduled tasks using the 'schtasks.exe' utility, specifically looking for indicators associated with persistence mechanisms such as task names or commands like 'StandAloneOneDriveUpdater-2626' and 'Automata-20.exe'.
This rule detects potentially malicious command patterns involving PowerShell and the Windows Task Scheduler. It identifies suspicious uses of Microsoft Edge update task names, PowerShell commands executing encoded scripts, and specific external download patterns associated with potential dropper or downloader activity.
Page 371 of 1908