Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects Atlas RAT anti-analysis behavior by monitoring for interactions with the Windows Defender Application Guard (WDAG) RunOnce registry key. This is a known sandbox evasion technique used by TA4922 before executing its primary payload.
Detects the execution of wscript.exe loading a script file from the C:\Users\Public\ directory, a behavior observed in the DesckVB RAT staging process. This technique is often used by adversaries to execute malicious scripts from a commonly accessible location.
This rule detects the execution of 'mshta.exe' when its command line contains a URL pointing to a '.7z' archive. This behavior is suspicious as mshta.exe is often abused by adversaries to download and execute malicious content, and downloading an archive directly via mshta.exe is not a typical legitimate use case.
Detects network connections to Azure App Services domains containing healthcare or service-themed keywords originating from non-browser processes. Obsidian Sandstorm utilizes these tailored subdomains for C2 communications to blend in with legitimate enterprise network traffic.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
This rule detects suspicious DLL side-loading activity. It looks for DLL files being loaded from common user-writable or temporary directories (like `\temp\` or `\users\`) by legitimate Windows processes such as `rundll32.exe`, `explorer.exe`, or `svchost.exe`. The rule specifically flags instances where a DLL is loaded more than 3 times within an hour by these processes, indicating potential malicious activity where an adversary might be attempting to execute their own malicious DLLs by hijacking the loading process of a legitimate application.
This rule detects potential Agent Tesla malware activity by correlating process execution with network connections. It looks for processes named 'agenttesla.exe', 'atsvc.exe', or 'atservice.exe' that execute with command-line arguments indicative of data exfiltration (e.g., 'smtp', 'ftp', 'http.post', 'exfil'). The rule then correlates these process events with outbound network connections to non-private IP addresses, flagging instances where multiple process runs and multiple network connections occur within a 30-minute window.
Detects wscript.exe initiating outbound network connections to non-standard HTTP ports (ports other than 80, 443, or 8080), which aligns with JS.MonoGlyphRAT's C2 communication profile. This rule specifically looks for successful network connections from wscript.exe to remote IPs that are not private and are not using standard web ports, indicating potential command and control activity.
Detects the creation of conhost.exe running as NT AUTHORITY\SYSTEM, excluding expected system parent processes like csrss.exe and smss.exe. This behavior can be indicative of privilege escalation or an interactive system shell delivery, as seen in exploits like RedSun (CVE-2026-41091).
Detects the creation, modification, or renaming of the TieringEngineService.exe executable within the System32 directory. This activity is associated with the RedSun exploit (CVE-2026-41091), which leverages Defender remediation redirection to plant a malicious binary. The rule specifically filters out legitimate Windows update operations originating from the WinSxS directory to reduce false positives.
Detects Python processes (python.exe, pythonw.exe) making more than 3 connections to public IP addresses. This activity could indicate data exfiltration, command and control communication, or other suspicious network behavior originating from a Python script.
Detects suspicious process activity originating from WSMProvHost, suggesting potential lateral movement or remote command execution
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
Detects VS Code or Cursor launching wscript.exe with specific command-line arguments indicating hidden execution of VBScript payloads. This behavior is associated with the UNK_DeadDrop campaign.
Detects the creation of disk image files (ISO, IMG, VHD, VHDX, WIM) within temporary folders under a user's AppData directory. This activity can be indicative of malware staging or unpacking, often associated with initial access techniques where malicious payloads are delivered as disk images.
Identifies instances where a Jupyter Notebook is opened and initiates suspicious child shell processes. This may indicate the execution of embedded malicious HTML or scripts attempting to automate UI interactions, such as bypassing extension installation prompts in VS Code environments.
This rule detects attempts to bypass User Account Control (UAC) by monitoring modifications or creations of specific registry keys. Adversaries often manipulate these registry keys to achieve privilege escalation without triggering a UAC prompt, allowing them to execute malicious code with elevated permissions. The rule specifically looks for changes to registry paths commonly abused in UAC bypass techniques, such as those related to ms-settings, mscfile, Environment\UserInitMprLogonScript, exefile, Folder, and Image File Execution Options.
This rule detects potential C2 beaconing behavior by identifying devices that make a high number of periodic outbound connections (20 or more within an hour) to a single external IP address on common web and C2-related ports (80, 443, 8080, 8443, 4444, 5555, 8888, 9001). The rule summarizes these connections by device, remote IP, and initiating process, highlighting sustained communication patterns indicative of command and control.
Detects PowerShell executions associated with Gamaredon's GammaSteel persistence mechanism, which reconstructs a payload path from the HKCU:\Printers registry key and executes it using [scriptblock]::Create. This technique indicates an attempt to maintain access by leveraging registry keys for autostart execution and dynamic script execution.
Detects the __DAEMONIZED=1 environment variable marker used by the vpmdhaj npm supply chain campaign (Mini Shai-Hulud) to spawn a detached credential-harvesting payload during npm install. This marker prevents re-entry when payload.bin is re-launched on subsequent require() calls. Microsoft explicitly recommends this detection, noting that the exact string __DAEMONIZED=1 has no legitimate npm ecosystem use, leading to near-zero false positives.
This rule detects various activities associated with the Nimbus Manticore implant, including its process execution with a specific argument, the creation of a scheduled task for persistence, and the staging of malicious files in a specific AppData directory. It looks for the execution of 'setup.exe' with 'doit' argument, the creation of a scheduled task containing 'BackupCheck', and the creation of specific files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' folder.
Page 429 of 509