Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,759
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects the use of native Windows administration and system tools commonly used for reconnaissance and discovery of running processes, domain controllers, and system configuration.
Detects instances where a process, other than known benign applications, writes a screen capture image file (BMP, JPG, JPEG, or PNG) to a temporary directory, followed by a network connection to an external IP address within two minutes by the same process.
Detects the execution of system information discovery utilities (systeminfo, ipconfig, whoami, net) by specific process names (BQT.exe or start.exe), followed by a DNS request to api.telegram.org within a 30-minute window. This behavior is indicative of malware performing reconnaissance and using Telegram for command and control or data exfiltration.
Detects exploitation attempts against Langflow targeting unauthenticated API endpoints (/api/v1/build_public_tmp or /run) for remote code execution, as well as downstream process spawning activity on Linux hosts where Python processes execute shell commands (e.g., curl/wget piping to sh) to download known malicious dropper payloads.
Detects execution of the RustDesk remote access tool from non-standard, user-writable directories, or when spawned by suspicious parent processes such as shells or scripting hosts. This rule is designed to identify unauthorized use of RustDesk as a persistence or remote access mechanism by adversaries attempting to bypass standard software management.
Detects suspicious execution patterns originating from or associated with crontab, crond, or anacron processes. The rule identifies potential persistence or malicious task scheduling by monitoring specific command-line indicators such as execution from /tmp or /dev/shm, unusual execution intervals, or specific shell command patterns associated with cron job abuse.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
This rule monitors for potential DLL sideloading by detecting specific known executable names loading suspicious modules such as 'dtlcrashcatch.dll' or 'setupui.dll'. It further validates the suspicion by analyzing command-line arguments for sideloading indicators (e.g., '-uidll', '/appmodel') or high-entropy arguments, and checking if the loaded module resides in the same directory as the host process, which is a common pattern for DLL sideloading.
Detects the execution of ConfigurationRemotingServer.exe initiated by the Winget package manager. This activity is associated with applying system or application configuration files (e.g., .yaml configuration files) via the Windows Package Manager 'winget configure' command.
This rule detects the execution of ConfigurationRemotingServer.exe, which is the backend process used by the Windows Package Manager (winget) when applying configuration files. The detection specifically monitors for this process being spawned by winget.exe with flags indicating the acceptance of configuration agreements and the execution of a configuration command.
Detects outbound network connections to the domain 'financemachinelearning.com' from any host. This domain may be associated with suspicious activity or command and control infrastructure.
Detects the execution of the suspicious binary 'AdgNsy.exe', including scenarios where it is spawned by the WMI Provider Host (WmiPrvSE.exe). This pattern is often associated with malicious activity, including potential persistence mechanisms or arbitrary code execution via WMI event subscriptions.
Detects execution and network activity associated with the NUKESPED (ThreatNeedle) backdoor component identified as 'zlrenu8.exe'. The rule monitors for outbound network connections to Fastly CDN infrastructure, which is frequently used by this actor for command-and-control or data exfiltration, as well as file operations within the 'ProgramData' directory indicative of staging activity.
This rule detects network connections to a predefined list of known Microstealer malicious domains. These domains are often associated with malware command and control (C2) infrastructure, phishing, or other malicious activities. Monitoring connections to such domains can help identify compromised systems or active malware infections.
This rule detects potential process injection attempts targeting the Windows Update Service (wusvc.exe). It monitors for suspicious API calls, including VirtualAlloc, VirtualProtect, WriteProcessMemory, and QueueUserAPC, or memory page protections set to PAGE_EXECUTE_READWRITE within the context of the wusvc.exe process. The detection requires multiple distinct indicators of injection to be present, reducing the likelihood of flagging benign administrative activities.
Detects instances where a process launch exhibits PPID spoofing (where the reported parent PID does not match the actual creator PID) followed by that spoofed process attempting to access high-privileged system processes such as lsass.exe, services.exe, or winlogon.exe within a two-minute window. This behavior is indicative of privilege escalation attempts.
Detects the execution of wusvc.exe (Windows Update Service) from suspicious locations such as Downloads or Temp folders with high integrity level, which is characteristic of masquerading techniques used by adversaries to hide malicious activity as a legitimate system process.
Detects the execution of known diagnostic, debugging, or analysis tools (such as IDA Pro, Process Hacker, Wireshark, etc.) by processes other than standard Windows system processes. This behavior may indicate an adversary conducting reconnaissance, attempting to bypass protections, or analyzing system artifacts.
This rule detects activities associated with VILE ransomware, focusing on unsigned Go-based binaries. It flags processes performing cross-process operations, creating specific file artifacts (e.g., vile_deadlines.json, vile_Decryptor), or invoking direct NT system calls such as NtCreateWaitCompletionPacket to evade EDR hooks.
This rule detects the execution of python.exe or python3.exe using the '-m init' command line flag while attempting to establish a network connection over specific, often non-standard, ports (4444, 1337, 9001, 9002, 5555, 6666, 7777, 8888). This pattern is commonly associated with reverse shells or C2 agent check-ins initiated via Python scripts.
Detects Remcos RAT-related User Account Control (UAC) bypass activity. The rule identifies suspicious process creation and cross-process patterns where non-Microsoft signed executables, specifically those often masquerading as explorer.exe or interacting with system-level binaries (e.g., iexplore.exe, svchost.exe, fsutil.exe), attempt to elevate privileges using COM interfaces such as CMSTPLUA.
Page 38 of 100