Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,057 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,110
9,757
3,852
3,759
3,713
Platforms
40,057
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,879
MITRE Techniques
13,737
13,117
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of base64 encoded PowerShell commands initiated by conhost.exe with the --headless flag. The decoded command contains specific suspicious patterns, including accessing environment variables, reading file content, and deleting files, which is characteristic of malicious scripts attempting to stealthily interact with the environment.
Detects the execution of PowerShell with encoded commands, specifically when initiated by a 'conhost.exe' process running with the '--headless' flag. The rule further inspects the decoded command to identify patterns indicative of .NET reflection-based code execution, often used in malicious activity such as reflective assembly loading.
Detects the execution of PowerShell with encoded commands, specifically when initiated by a 'conhost.exe' process running with the '--headless' flag. The rule further inspects the decoded command to identify patterns indicative of .NET reflection-based code execution, often used in malicious activity such as reflective assembly loading.
Detects the execution of PowerShell with encoded commands, specifically when initiated by a 'conhost.exe' process running with the '--headless' flag. The rule further inspects the decoded command to identify patterns indicative of .NET reflection-based code execution, often used in malicious activity such as reflective assembly loading.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
This rule detects attempts to tamper with the Anti-Malware Scan Interface (AMSI) or suspicious modifications to the memory of common scripting and proxy processes (powershell.exe, pwsh.exe, rundll32.exe, mshta.exe, wscript.exe, cscript.exe). Such activities are often indicative of an adversary attempting to bypass security detection mechanisms to execute malicious code or hide their presence.
Detects in-memory tampering of the EtwEventWrite function within ntdll.dll, a technique commonly used by malware and loaders to disable Event Tracing for Windows (ETW) telemetry to avoid detection by security products.
Detects in-memory tampering of the EtwEventWrite function within ntdll.dll, a technique commonly used by malware and loaders to disable Event Tracing for Windows (ETW) telemetry to avoid detection by security products.
Detects in-memory tampering of the EtwEventWrite function within ntdll.dll, a technique commonly used by malware and loaders to disable Event Tracing for Windows (ETW) telemetry to avoid detection by security products.
Detects the execution of 'bun' during a Node.js package installation process (npm or node). This behavior can be indicative of a supply chain attack where malicious actors attempt to leverage alternative runtimes during the 'preinstall' phase or package installation to execute arbitrary code or bypass security controls typically associated with standard Node.js installations.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
This rule detects potentially malicious memory manipulation and thread execution activity originating from the ERAAgent.exe process. It specifically identifies when ERAAgent.exe calls VirtualProtect or VirtualAlloc to set memory as PAGE_EXECUTE_READWRITE, followed shortly by a CreateThread or CreateRemoteThread operation. This behavior is indicative of process injection or reflective code loading, where an executable image is manually mapped into memory and executed, bypassing traditional file-based detection.
Detects instances where processes other than the primary web browsers (Chrome, Brave, Firefox) create, rename, or modify sensitive browser data files like 'Cookies' or 'Login Data'. This behavior is indicative of credential theft or data exfiltration attempts where an adversary is accessing browser-stored information.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects suspicious command executions (e.g., whoami, downloadstring, iex, registry modifications) initiated by processes associated with the CrowdStrike Falcon agent. It also correlates these executions with the loading of unsigned or unverifiable DLLs by the same Falcon processes within a 5-minute window, which may indicate attempts to tamper with or masquerade as the security agent.
Detects suspicious activities originating from CrowdStrike Falcon remediation processes (e.g., CSFalconService.exe, CSFalconContainer.exe). The rule identifies two distinct patterns: either a file operation (delete, modify, rename, quarantine, or restore) followed within 2 minutes by the loading of an unsigned or non-standard DLL, or the spawning of an elevated SYSTEM process from a non-SYSTEM parent process. This behavior is indicative of potential LPE (Local Privilege Escalation) abuse via the Falcon remediation engine, often referred to as FalconFlank-style exploitation.
Detects execution patterns associated with 'NinjaMare' style malware, where a process masquerading as a browser (e.g., tenbrowser.exe, fireflybrowser.exe) performs an external IP geolocation lookup followed by suspicious registry or file modifications indicative of browser hijacking or extension installation within a five-minute window.
This rule detects the execution of processes or network connections that impersonate 'WhatsApp' or 'Instagram' companion applications. It identifies specific file names and process command lines that mimic these applications, often associated with browser-launched or malicious payloads, and monitors for associated network traffic directed toward suspicious endpoints like herokuapp domains.
Detects the creation of PHP files within the 'wp-content/uploads/elementor/forms/' directory of a WordPress installation. This behavior is highly suspicious as it often indicates an attempt by an attacker to deploy a web shell or other malicious script following successful exploitation of the Elementor plugin, which allows for arbitrary file uploads.
Detects anomalous activity originating from PostgreSQL processes, including the spawning of shells (cmd, powershell, sh, bash), access to sensitive files (e.g., /etc/shadow, SSH keys), and file creation outside the standard PostgreSQL data directories, which is consistent with the abuse of SQL functionality like pg_read_file() or lo_export().
Page 382 of 1908