Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,065 detections
Filters
Last updated
All Time
Detection languages
15,361
13,598
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,115
9,760
3,854
3,760
3,714
Platforms
40,065
7,331
6,542
3,907
3,666
Products / Services
10,442
9,679
6,724
1,888
1,879
MITRE Techniques
13,740
13,120
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects remote thread creation where the start function address is identified as 'AnimateWindow'. This behavior is associated with the SparroWocky technique, which uses thread execution hijacking by pointing the thread start address to legitimate UI-related Windows APIs to mask the actual malicious entry point, thereby evading traditional detection mechanisms that monitor for suspicious thread start addresses.
This rule monitors for indicators of code execution anomalies commonly associated with process injection, ROP (Return-Oriented Programming) chains, or memory manipulation. It specifically looks for spoofed call stacks, return address validation failures, suspicious API usage in common thread initialization routines, and ROP gadgets within critical modules like kernel32.dll.
This rule detects potential masquerading activity where an executable is signed by 'Discord Inc' or 'Lenovo' but the image path does not correspond to expected legitimate installation directories or filenames. It flags processes that claim a trusted publisher identity while residing in suspicious or unexpected locations.
Detects ClickFix-style activity where a web browser or common application launcher spawns a terminal or PowerShell process to execute obfuscated, copied, or piped commands. This behavior often indicates a social engineering attack where a user is tricked into manually executing a malicious command script.
Detects the creation of a registry value named 'SnapCart' within the Windows Run keys. Adversaries use Run keys to ensure that malicious programs execute automatically upon user login or system startup, establishing persistence on the compromised host.
This rule detects high-frequency, sub-second screen capture activity typically associated with malwares utilizing screen scraping to exfiltrate changed screen regions. It specifically monitors API calls related to graphical interface manipulation (BitBlt, GDI) and screen capture events, triggering when the frequency of these calls reaches a consistent, rapid interval.
Detects anomalous child processes spawned by a Chrome renderer process. This behavior is often indicative of exploitation attempts, such as the BlueMoon exploit kit leveraging CVE-2026-85046, where a compromised renderer attempts to escape the sandbox or execute arbitrary code in the host process.
Detects network communication to known malicious infrastructure associated with the GRAYRABBIT malware campaign. The rule correlates TCP connections on port 443 to the domain 'mail.uaiubifas.top' with process events attempting to discover system and user information (GetAdaptersAddresses, gethostname, GetUserNameA), which is characteristic of the malware's initial beaconing behavior.
Detects the spawning of cmd.exe from 7z.exe, which is characteristic of the GRAYRABBIT malware sideloading chain where 7z.exe is used to load malicious DLLs (e.g., boy.dll, core.dll) that subsequently initiate an interactive reverse shell.
Detects the spawning of cmd.exe from 7z.exe, which is characteristic of the GRAYRABBIT malware sideloading chain where 7z.exe is used to load malicious DLLs (e.g., boy.dll, core.dll) that subsequently initiate an interactive reverse shell.
Detects child processes spawned by 7z.exe when it is executed from the 'C:\Users\Public\Documents\' directory. This is consistent with the behavior of the GRAYRABBIT backdoor, where a trojanized 7z.dll or boy.dll is sideloaded into the 7z.exe process to facilitate silent arbitrary process execution.
Detects anomalous behavior indicative of the GRAYRABBIT shellcode which uses manual module walking and hash-based API resolution to load 'urlmon.dll' dynamically, followed shortly by an outbound network connection to a known malicious staging IP. This pattern reflects an evasion technique designed to avoid static import table analysis.
Detects potential data exfiltration activity associated with the GRAYRABBIT threat actor, where a local file is accessed or modified by a process shortly before or after that same process initiates a network connection to a known GRAYRABBIT C2 endpoint over port 443.
Detects the spawning of cmd.exe from 7z.exe, which is characteristic of the GRAYRABBIT malware sideloading chain where 7z.exe is used to load malicious DLLs (e.g., boy.dll, core.dll) that subsequently initiate an interactive reverse shell.
Detects behavior indicative of the GRAYRABBIT malware, specifically identifying network connections to known command-and-control (C2) infrastructure (mail.uaiubifas.top) followed within a short time window (10 minutes) by reflective in-memory module loading activities within the same process. This pattern suggests the delivery and execution of a plugin or additional malicious payload without writing the binary to disk.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
This rule detects potential credential dumping attempts targeting the Local Security Authority Subsystem Service (LSASS) process. It identifies suspicious file execution based on a blocklist of known credential dumping utility hashes, unauthorized OpenProcess calls to lsass.exe with specific access rights, and the creation of process memory dump files (e.g., .dmp, .dump) correlated with an lsass.exe access event.
This rule detects potential DLL side-loading activity by identifying when known malicious file hashes are loaded by a specific set of executable files that are commonly abused for side-loading, or when these executables are executed from locations outside of their standard, verified installation directories.
This rule detects potential DLL side-loading activity by identifying when known malicious file hashes are loaded by a specific set of executable files that are commonly abused for side-loading, or when these executables are executed from locations outside of their standard, verified installation directories.
This rule detects potential DLL side-loading activity by identifying when known malicious file hashes are loaded by a specific set of executable files that are commonly abused for side-loading, or when these executables are executed from locations outside of their standard, verified installation directories.
This rule detects potential credential dumping attempts targeting the Local Security Authority Subsystem Service (LSASS) process. It identifies suspicious file execution based on a blocklist of known credential dumping utility hashes, unauthorized OpenProcess calls to lsass.exe with specific access rights, and the creation of process memory dump files (e.g., .dmp, .dump) correlated with an lsass.exe access event.
Page 378 of 1908