Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
Detects a specific attack chain attributed to ClosedQuorum, involving LSASS memory dumping, subsequent access to browser-based credential stores or cryptocurrency wallet files, and finally staging the stolen data in C:\Windows\Temp\ within a short time window.
Detects the use of the ntdsutil.exe utility to create an Install From Media (IFM) backup. This technique is often used by adversaries to create a copy of the Active Directory database (NTDS.dit) for offline credential extraction.
Detects the execution of MSI installers from user-writable directories (e.g., Downloads, Temp, Public) that masquerade as legitimate software applications like Spotify, Zoom, or Microsoft Teams. This behavior is indicative of 'ClickFix' style social engineering lures, where users are prompted to download and execute malicious installers.
Detects the ChainScript RAT, executing via a masqueraded Node.js process, enumerating Local Extension Settings for browser wallet plugins. This reconnaissance activity is a precursor to exfiltrating crypto wallet data.
Detects processes spawned by Terraform or Go (e.g., during init, apply, or run) that exhibit suspicious access to local cloud credential files (AWS/Azure/GCP) or Terraform state files. This behavior is indicative of a malicious module attempting to exfiltrate cloud credentials from a developer's workstation or a CI/CD build host.
Detects the execution of 'ClickFix' or 'fake-CAPTCHA' patterns where a user is tricked into copying and pasting a malicious command into the Windows Run dialog. The rule specifically identifies the launch of conhost.exe from explorer.exe with --headless arguments, utilizing command-line tools like curl, iex, or irm to fetch and execute external payloads.
Detects attempts to create a memory dump of the Local Security Authority Subsystem Service (LSASS) process using well-known utilities such as procdump, rundll32 with comsvcs.dll, and taskmgr, which are frequently used by adversaries to perform credential dumping.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to inhibit system recovery by deleting shadow copies, backup catalogs, or disabling automatic recovery features. This behavior is commonly observed in ransomware attacks.
Detects an outbound network connection initiated by 'rnpkeys.exe' when executing from a non-standard 'ProgramData\keyroll' directory. This behavior is associated with the early stages of a Command and Control (C2) registration sequence, where an encrypted loader initiates network contact before subsequent staged communication.
Detects the presence of MSI installer packages associated with the Sauron Loader malware, which stage malicious files (rnpkeys.exe, rnp.dll, and tdwp.dll) into the C:\ProgramData\keyroll directory to facilitate DLL side-loading.
Detects suspicious behavior where an identical executable (same path and SHA256) is launched twice within a short window (60 minutes) following a system reboot, utilizing two distinct persistence methods: one triggered via the Task Scheduler (under svchost.exe -k netsvcs) and one via a user logon autostart mechanism (spawned by explorer.exe).
Detects execution of staged payloads within the %TEMP% directory initiated by processes associated with the Sauron Loader (rnpkeys.exe or processes running from ProgramData\keyroll). The rule monitors for common living-off-the-land binaries (rundll32.exe, regsvr32.exe, msiexec.exe, cmd.exe, powershell.exe, wscript.exe) acting as task handlers for the loader.
Detects execution of staged payloads within the %TEMP% directory initiated by processes associated with the Sauron Loader (rnpkeys.exe or processes running from ProgramData\keyroll). The rule monitors for common living-off-the-land binaries (rundll32.exe, regsvr32.exe, msiexec.exe, cmd.exe, powershell.exe, wscript.exe) acting as task handlers for the loader.
Detects DLL side-loading activity where the legitimate-looking process rnpkeys.exe, located in a non-standard ProgramData sub-directory, loads a malicious rnp.dll from the same directory, a behavior observed with the Sauron Loader malware.
Detects the creation of a remote thread targeting the native Windows utility 'attrib.exe'. This behavior is characteristic of code injection techniques, such as those used by the Sauron loader, where malicious shellcode is executed within the context of a legitimate system process to evade detection and maintain persistence.
Detects the Sauron Loader malware utilizing the process rnpkeys.exe as a parent to spawn common LOLBins (Living-off-the-Land Binaries) or execute payloads from temporary directories. This behavior is indicative of a secondary stage execution chain typical of the Sauron Loader.
Detects the execution of the Sauron Loader malware, which utilizes a DLL side-loading chain involving rnpkeys.exe loading rnp.dll or tdwp.dll from a specific ProgramData path, indicating potential malicious activity.
Detects the execution of msiexec.exe (the Windows Installer) as a child process of remote support applications such as Quick Assist, Microsoft Remote Assistance (msra.exe), or AnyDesk. This pattern is commonly associated with remote access trojans and unauthorized software deployment during social engineering campaigns.
Detects the execution of msiexec.exe (the Windows Installer) as a child process of remote support applications such as Quick Assist, Microsoft Remote Assistance (msra.exe), or AnyDesk. This pattern is commonly associated with remote access trojans and unauthorized software deployment during social engineering campaigns.
Detects the execution of msiexec.exe performing the installation or staging of specific binary files (rnpkeys.exe, rnp.dll, and tdwp.dll) into the C:\ProgramData\keyroll\ directory, which is a known behavior associated with the Sauron Loader malware.
Page 39 of 465