Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,057 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,110
9,757
3,852
3,759
3,713
Platforms
40,057
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,879
MITRE Techniques
13,737
13,117
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
This rule detects potentially malicious activity by monitoring the execution of Python interpreters or specific suspicious executable names from within the C:\ProgramData directory. The detection logic focuses on processes launching from directories associated with configuration or data storage folders, often used by malware for staging or execution to avoid detection. It specifically flags Python execution involving certain suspicious file or argument strings, and the launch of named executables (e.g., RuntimeSSH.exe, smqdservice.exe) located in specific ProgramData subdirectories.
This rule detects potentially malicious activity by monitoring the execution of Python interpreters or specific suspicious executable names from within the C:\ProgramData directory. The detection logic focuses on processes launching from directories associated with configuration or data storage folders, often used by malware for staging or execution to avoid detection. It specifically flags Python execution involving certain suspicious file or argument strings, and the launch of named executables (e.g., RuntimeSSH.exe, smqdservice.exe) located in specific ProgramData subdirectories.
Detects msiexec.exe executing from the Temp directory with suspicious command-line arguments (such as hidden windows) and spawning child processes like cmd.exe, tasklist.exe, or taskkill.exe. This behavior is often indicative of malicious installation scripts attempting to perform discovery or terminate security processes while remaining stealthy.
This rule detects instances where a process named 'wsc_updata.exe' executing from a Temp directory loads a library named 'wsc.dll'. This behavior is characteristic of DLL side-loading or DLL hijacking, where a malicious or potentially unwanted executable attempts to load a library from a user-writable directory to execute arbitrary code.
This rule monitors network traffic for requests directed at a specific domain ('luizestrelhashapr.online') and path ('/google_api/b83fa72d.css'), which is identified in threat intelligence as an indicator of browser history exfiltration.
Detects outbound network communication from common web browsers (chrome.exe, msedge.exe) to a specific malicious domain and path associated with suspected Kremlin-linked screenshot exfiltration activities.
Detects outbound network communication from common web browsers (chrome.exe, msedge.exe) to a specific malicious domain and path associated with suspected Kremlin-linked screenshot exfiltration activities.
This rule detects the execution of the SentinelOne memory scanner process (SentinelMemoryScanner.exe) or the loading of the associated SentinelOne core library (SentinelAgentCore.dll) from a directory path outside of the standard SentinelOne installation locations (Program Files\SentinelOne or Program Files (x86)\SentinelOne). This behavior is indicative of potential masquerading or tampering where an adversary attempts to execute a renamed or moved security tool to bypass policy or evade detection.
This rule detects the execution of the SentinelOne memory scanner process (SentinelMemoryScanner.exe) or the loading of the associated SentinelOne core library (SentinelAgentCore.dll) from a directory path outside of the standard SentinelOne installation locations (Program Files\SentinelOne or Program Files (x86)\SentinelOne). This behavior is indicative of potential masquerading or tampering where an adversary attempts to execute a renamed or moved security tool to bypass policy or evade detection.
Detects the creation of a scheduled task using schtasks.exe where the command line involves 'MicrosoftNodeRuntimeUpdater' and references 'node.exe' or '.js' files, specifically when initiated by script engines like node.exe, wscript.exe, or cscript.exe, while excluding known legitimate nodejs installation paths.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) launches suspicious command-line interfaces or interpreters (PowerShell, CMD, cscript, etc.), or executes scripts from sensitive/temporary directories. The rule includes exclusions for common management tools to reduce noise.
Detects the use of net.exe to stop critical system services commonly associated with ransomware operations, such as volume shadow copies, security services, and Windows update services, to facilitate data encryption or prevent system recovery.
Detects the presence of OpnKey ransomware-specific configuration strings related to size-tiered file encryption settings in process command lines. These indicators suggest the execution of a binary with hardcoded logic to categorize files for encryption based on their size.
This rule monitors network connections for specific domains and URL patterns associated with the 'FlowerStorm' campaign. It flags potential phishing attempts by identifying low-prevalence connections to known malicious infrastructure from browser or PDF reader processes.
Detects remote command execution using WMI by monitoring RPC calls to the IWbemServices interface (UUID {9556DC99-828C-11CF-A37E-00AA003240C7}). The rule specifically targets the ExecMethod operation (opnum 24) commonly used by tools like Impacket's wmiexec to execute Win32_Process.Create on remote targets. Filter for COMSPEC to increase fidelity for detecting wmiexec.
Detects instances where Windows Filtering Platform (WFP) has blocked outbound network connections initiated by critical Microsoft Defender components (e.g., MsSense.exe, MsMpEng.exe). Such blocks may indicate security software interference, misconfiguration, or attempts to disrupt endpoint security monitoring.
Detects the creation of executable or script files within non-system directories that were initiated by the OneDrive sync process. This activity may indicate a user downloading malicious files via a compromised OneDrive account or a malicious payload being synced to the local system.
Detects suspicious modifications to browser 'Secure Preferences' files associated with known bypass techniques for extension integrity checks, coupled with browser process termination and subsequent relaunch using the --restore-last-session flag. This pattern is consistent with adversary activity attempting to inject malicious browser extensions by manipulating browser configuration files.
Detects potential local privilege escalation via Windows ALPC (Advanced Local Procedure Call) heap-based buffer overflow by identifying a non-SYSTEM Chrome process tree spawning child processes with SYSTEM privileges. The rule specifically monitors for suspicious child binaries or paths characteristic of exploit payloads while excluding legitimate Chrome update and crash handler processes.
Detects anomalous child processes spawned by a Chrome renderer process. This behavior is often indicative of exploitation attempts, such as the BlueMoon exploit kit leveraging CVE-2026-85046, where a compromised renderer attempts to escape the sandbox or execute arbitrary code in the host process.
Detects the execution of REAgentC.exe with the /disable command-line argument. This utility is used to manage the Windows Recovery Environment (WinRE). Adversaries often disable WinRE to prevent system recovery and impede incident response, often as a prelude to data destruction or ransomware attacks.
Page 393 of 1908