Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,061 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,759
3,853
3,760
3,714
Platforms
40,061
7,331
6,542
3,907
3,664
Products / Services
10,439
9,679
6,724
1,888
1,879
MITRE Techniques
13,740
13,119
8,066
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects successful network connections to a known hVNC RAT (GapiUpdate) C2 infrastructure IP address on port 5556, based on DeviceNetworkEvents logs.
This rule monitors for suspicious memory-based code execution patterns, such as reflective loading or execution of code from memory segments marked with executable permissions (PAGE_EXECUTE_READWRITE or PAGE_EXECUTE_READ) that do not originate from a signed Microsoft file. It specifically flags memory regions containing the MZ header that lack a corresponding backing file, as well as specific known suspicious DLL patterns or memory protection flag changes indicative of process injection or fileless execution.
Detects thread creation where the start address resolves to the 'AnimateWindow' function within 'user32.dll'. This behavior is a known indicator of thread-hijacking techniques, such as those implemented by the SparroWocky framework using the MinHook library, where the thread entry point is spoofed to evade detection.
This rule detects the presence or execution of known malicious DLL files (winfsp-x64.dll or DukeQt.dll) by monitoring process rollups, image loads, and file operations. The detection is triggered by matching the file name against specific SHA1 hashes associated with known malicious activity.
Detects the creation of threads where the entry point or call stack is associated with 'kernel32.dll' but originates from memory regions that are unbacked by a file on disk (i.e., 'unbacked', 'unknown') or have a null return address. This pattern is highly indicative of reflective code injection or manual shellcode execution, where an adversary attempts to execute code within a legitimate Windows process without a corresponding file-backed image.
Detects the execution of a process named 's.exe' (or similar match) with a command-line argument consisting of a single character 's' followed by a digit. This pattern is commonly associated with malicious usage or obfuscation, where 's.exe' might be a renamed utility or a malicious artifact attempting to masquerade or execute specific tasks.
Detects instances where the Chrome browser process accesses camera or microphone hardware, or invokes media device APIs, potentially indicating unauthorized audio or video recording.
This rule detects rapid, repetitive state change operations (such as think, act, or mode changes) occurring within the Microsoft Edge browser context when interacting with Microsoft domains. This behavior is indicative of automated browser interactions, such as those performed by botnets, automated testing frameworks, or potentially malicious browser automation scripts.
This rule detects potentially malicious attempts to import certificates into the Windows certificate store using command-line tools like certutil or direct modification of the registry. This behavior is frequently associated with attackers attempting to establish persistence, bypass certificate validation, or install rogue trust anchors for man-in-the-middle operations.
Detects instances where common web browsers (Chrome, Edge, Firefox, Safari) or related desktop applications spawn shell interpreters (PowerShell on Windows, bash/zsh/sh on macOS) with command-line arguments indicative of malicious activity, such as base64-encoded payloads, hidden windows, or remote script downloading.
This rule detects the loading of specific DLLs (winfsp-x64.dll or dukeqt.dll) by processes from locations outside of the standard Windows System32 or SysWOW64 directories. This behavior is indicative of DLL side-loading, where an adversary attempts to execute malicious code by placing a rogue DLL in a path where a legitimate application might attempt to load it, or by intentionally side-loading it alongside an executable.
Detects browser-based processes (Chrome, Opera, Edge) making network requests to AI and cloud service domains (Google Gemini, Claude, Opera). This rule monitors for potentially unauthorized or excessive browser communication with these services.
Detects the creation of compressed archive files (zip, rar, 7z, dat) followed by a significant network upload (exceeding 5MB) on the same host within a 30-minute window, which is indicative of staging and exfiltrating collected data.
Detects instances where the Google Chrome browser process interacts with files or registry keys associated with audio and video capture devices, such as cameras and microphones. This may indicate unauthorized use of media peripherals by the browser process.
Detects the loading of specific DLLs ('winfsp-x64.dll' or 'DukeQt.dll') where the module path is empty or null. This behavior is indicative of potential memory-only execution or process injection (e.g., reflective loading), as the module is not associated with a valid file on disk.
Detects the presence of known synchronization objects (mutexes, events, or shared memory) associated with SparroWocky malware, identified via Microsoft Defender DeviceEvents and DeviceProcessEvents telemetry. The rule monitors for these specific markers in process creation, remote thread creation, and named pipe events.
This rule detects a process loading English (.en-US) MUI resource files from the C:\Windows\System32\en-US\ directory when the initiating process is located outside of standard system directories (System32, SysWOW64, Program Files). This behavior is indicative of a masquerading or camouflage technique where a malicious executable attempts to mimic a legitimate system process by loading its localized resources.
This rule detects remote thread creation where the start function address is identified as 'AnimateWindow'. This behavior is associated with the SparroWocky technique, which uses thread execution hijacking by pointing the thread start address to legitimate UI-related Windows APIs to mask the actual malicious entry point, thereby evading traditional detection mechanisms that monitor for suspicious thread start addresses.
This rule monitors for indicators of code execution anomalies commonly associated with process injection, ROP (Return-Oriented Programming) chains, or memory manipulation. It specifically looks for spoofed call stacks, return address validation failures, suspicious API usage in common thread initialization routines, and ROP gadgets within critical modules like kernel32.dll.
This rule detects potential masquerading activity where an executable is signed by 'Discord Inc' or 'Lenovo' but the image path does not correspond to expected legitimate installation directories or filenames. It flags processes that claim a trusted publisher identity while residing in suspicious or unexpected locations.
Detects ClickFix-style activity where a web browser or common application launcher spawns a terminal or PowerShell process to execute obfuscated, copied, or piped commands. This behavior often indicates a social engineering attack where a user is tricked into manually executing a malicious command script.
Page 377 of 1908