Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
177 detections
Filters
Last updated
All Time
Detection languages
177
Contributors
177
Categories
55
30
22
22
19
Platforms
155
27
3
1
Products / Services
10,799
9,795
6,757
4,421
3,768
MITRE Techniques
65
45
31
23
21
CVEs
1
Detects SilentEncryptor ransomware by correlating Encryptor.exe execution with a mass file-rename burst and creation of encrypted_files_V/encryption_log_V artefacts.
Detects CoolClient process injection into a suspended synchost.exe instance via remote thread creation and thread-context redirection.
Detects DLL sideloading of a malicious, AES-256-encrypted borlndmm.dll masquerading as an NVIDIA graphics library, loaded via the legitimate ACCA Software S.p.A.-signed ABRSubProcess.exe to launch OnyxC2.
Detects registry modification/deletion attempts blocked with STATUS_ACCESS_DENIED on hosts running msagent.sys, restricted to msagent/RNG-related key paths.
Detects execution of the typosquatted process synchost.exe (distinct from the legitimate svchost.exe) when unsigned or running outside System32.
Detects access-token duplication combined with CreateProcessAsUserA spawning the non-standard synchost.exe process outside System32 under a target interactive session.
Detects PlugX-style initial-foothold staging: process injection followed within minutes by a dropped file that is then executed, excluding known-benign AV/EDR/updater injectors and targets.
Detects SilentDataCollector host-based surveillance: recurring screenshot capture, keylogging, WhatsApp Web automation, or known stealer binary execution.
Detects an unsigned Loader.exe spawning a second unsigned executable that performs immediate outbound network fetch, matching the StopAndProtect loader/downloader chain with sandbox-evasion checks.
Detects sideload installation of the malicious 'PDF Viewer' browser extension used by Jewelbug, identified by manifest content requesting cookies, debugger, native-messaging, and all-site scripting permissions together from a non-Web-Store install path.
Detects JWR phishing kit's fake loading progress-bar overlay (p-bar/_pbar with a maximal z-index) used to mask the hidden iframe's C2 negotiation while building victim trust.
Detects the JWR phishing kit's JwrControlInstruction mechanism relaying operator commands to the victim browser across branded login, OTP/2FA capture, and card-retry page flows.
Detects creation of a scheduled task named 'IntelSoftwareUpdater' via schtasks.exe that launches pythonw.exe with run.pyw, used by the UNC5142 DeviceManager RAT for persistence, relaunching every 10 minutes.
Detects Abyssos's SELF_DELETE technique: a cmd.exe process using the exact 'ping 127.0.0.1 -n 3 >nul & del /F /Q <path>' pattern to delete a file that was the parent of the current process within the prior 15 minutes, excluding common shell/terminal parents.
Detects msagent.sys driver load correlated with subsequent protection (reduced handle access rights) of an unsigned, non-standard synchost.exe process within a 1-hour window.
Detects DKOM-style kernel process hiding: processes created but never appearing in periodic enumeration snapshots across multiple consecutive polls.
Detects installation of the 'media_updaten' Windows service configured to run Sang.exe with the 'work' argument, used by CoolClient for persistence.
Detects scheduled-task persistence launching masqueraded defender.exe/Sang.exe with SYSTEM privileges at startup, outside legitimate Windows Defender/Sangfor install paths.
Detects registry key/value creation, modification, or deletion by the unsigned OnyxC2 dropper process (Setup_File_92.118.3096.exe) running from a Temp\Rar or Downloads path, consistent with OnyxC2 configuration/persistence storage.
Detects DNS/HTTP beaconing to known OnyxC2 domains or suspicious top-level domains (.top, .cyou, .lol, .online) initiated by a non-browser or newly-created process, plus correlated network-IDS alerts.
Detects the unsigned/untrusted AutoIt interpreter binary OptiDrive.exe staged under the masquerade path %LOCALAPPDATA%\DriveOptimize Technologies\, mimicking legitimate 'DriveOptimize Technologies' software.
Page 4 of 9