Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the execution of rundll32.exe with the '/sta' command-line flag and a GUID-formatted CLSID. This technique is often used by malware (e.g., DarkME RAT) to proxy execution through COM components, which hides the actual path of the loaded DLL or payload, aiding in evasion.
This rule detects the execution of 'clspack.exe' from within the AppData\Microsoft directory. 'clspack.exe' is a legitimate Windows utility normally residing in System32 or SysWOW64. Execution from user-writable directories like AppData is a common indicator of masquerading or binary hijacking.
Detects unauthorized processes (other than known browsers like Chrome, Edge, or Firefox) attempting to access sensitive browser files such as 'Login Data', 'Cookies', or 'Web Data'. This behavior is commonly associated with credential stealing or browser session hijacking.
Detects user-initiated execution of scripts or binaries directly from the root of a drive letter. This pattern is commonly associated with phishing campaigns delivering malicious payloads via mounted ISO or IMG files, which allow attackers to bypass mark-of-the-web or macro security controls.
Detects the installation or execution of common remote access tools (e.g., AnyDesk, ScreenConnect, Atera, Splashtop) using silent or unattended installation flags. This rule explicitly excludes activity originating from known administrative and management platforms such as Microsoft Intune and SCCM.
Detects attempts to create a memory dump of the Local Security Authority Subsystem Service (LSASS) using either the built-in 'comsvcs.dll' library via 'rundll32.exe' or by requesting specific sensitive process access rights to 'lsass.exe' from unauthorized processes.
Detects user-initiated execution of scripts or binaries directly from the root of a drive letter. This pattern is commonly associated with phishing campaigns delivering malicious payloads via mounted ISO or IMG files, which allow attackers to bypass mark-of-the-web or macro security controls.
Detects the installation or execution of common remote access tools (e.g., AnyDesk, ScreenConnect, Atera, Splashtop) using silent or unattended installation flags. This rule explicitly excludes activity originating from known administrative and management platforms such as Microsoft Intune and SCCM.
Detects a Go toolchain process (go.exe) spawning potentially suspicious child processes such as secondary 'go run' commands or Node.js execution. This behavior is indicative of a malicious Go module executing embedded or decrypted code during the build process, a tactic seen in supply chain attacks targeting development environments.
Detects instances where a process that is not a recognized web browser accesses or enumerates the file storage path of the MetaMask browser extension. This behavior is indicative of unauthorized reconnaissance or credential theft attempt targeting cryptocurrency wallet data stored locally, often performed by malware following successful system compromise.
Detects the use of legitimate Windows binaries (certutil.exe and bitsadmin.exe) to download files from remote URLs to sensitive or common staging directories (Temp, AppData, ProgramData). Attackers frequently abuse these built-in tools for 'living off the land' (LotL) to retrieve malicious payloads or secondary tools while bypassing traditional signature-based detection.
Detects persistence attempts on Windows by monitoring for modifications to common Registry Run/RunOnce keys or the creation of executable files within the user startup directory. The rule excludes common legitimate processes like msiexec.exe, trustedinstaller.exe, and explorer.exe to minimize false positives.
Detects instances where an unauthorized or non-standard source process performs cross-process access (such as OpenProcess or similar operations indicative of code injection techniques like CreateRemoteThread or QueueUserAPC) against a sensitive target host process, such as explorer.exe, svchost.exe, or notepad.exe.
Detects the creation of named pipes associated with default Cobalt Strike malleable profiles and common open-source C2 frameworks (e.g., Sliver, Havoc) via EDR pipe-creation telemetry. These pipes are frequently used for SMB beacon communication within compromised networks.
Detects WmiPrvSE.exe spawning child processes within 120 seconds of a Type 3 (Network) logon event. This behavior is a common indicator of remote command execution, frequently used by lateral movement tools like Impacket's wmiexec or similar WMI-based remote execution frameworks.
Detects lateral movement techniques leveraging Windows Management Instrumentation (WMI). The rule identifies instances where the WMI provider host, WmiPrvSE.exe, spawns common administrative or interactive shell tools (e.g., cmd.exe, powershell.exe). This pattern is consistent with the abuse of Win32_Process.Create() via WMI/DCOM/RPC for remote command execution, a method frequently utilized by frameworks like Impacket (wmiexec.py) for fileless, agentless lateral movement.
Detects processes requesting specific access rights to the Local Security Authority Subsystem Service (LSASS) process, which are commonly associated with credential dumping techniques. The rule filters out known security software that performs legitimate LSASS inspection.
This rule detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to perform actions associated with ransomware, such as deleting volume shadow copies, deleting the backup catalog, or disabling system recovery features. This is a common precursor to data encryption to prevent the user from restoring files.
Detects the abuse of signed Windows system binaries (LOLBins: certutil, mshta, regsvr32, rundll32, bitsadmin, msiexec) through the identification of command-line arguments that suggest malicious activity, such as downloading remote content, decoding files, executing scriptlets, or loading DLLs from temporary storage directories.
Detects attempts to bypass the Antimalware Scan Interface (AMSI) in PowerShell. The rule looks for command-line arguments referencing AMSI-related memory structures, methods, and DLLs such as AmsiUtils, AmsiScanBuffer, AmsiInitFailed, and amsi.dll. Bypassing AMSI is a common technique used by attackers to execute malicious scripts and deploy fileless payloads, such as Cobalt Strike or Sliver, while avoiding detection by endpoint security solutions.
Detects the use of data archival utilities (7zip, WinRAR) or command-line cloud synchronization tools (Rclone) to stage files in common temporary directories, immediately followed by network connections to known cloud storage endpoints. This pattern is characteristic of pre-encryption exfiltration activities often seen in ransomware campaigns.
Page 43 of 465