Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,045 detections
Filters
Last updated
All Time
Detection languages
15,346
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,106
9,754
3,848
3,756
3,712
Platforms
40,045
7,314
6,542
3,903
3,660
Products / Services
10,431
9,678
6,722
1,887
1,878
MITRE Techniques
13,736
13,114
8,062
5,947
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects SoftEther VPN bridge dropper/installer disguised as svchost.exe with masquerading MixedRealityOpen service, based on install script and dropped files (a.Bat, hamcore.se2, vpn_server.config)
Detects the use of the Windows reg.exe utility to copy Registry keys related to Radmin, a legitimate remote access tool that is frequently abused by threat actors for persistence and remote control. The command-line arguments /s and /f indicate a silent, forced copy operation, which is characteristic of script-based configuration tampering.
Detects the use of the native Windows registry utility 'reg.exe' to import configuration files (install.reg) related to the Radmin remote access software, specifically targeting the security settings registry path.
This rule detects the use of 'mshta.exe' to execute a file from a remote location by inspecting the command line for 'http' protocols and a specific suspicious domain. Adversaries often abuse mshta.exe to proxy the execution of malicious HTML Application (HTA) files or scripts to bypass security controls.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., encoded commands, hidden windows) initiated by mshta.exe, excluding instances where a .ps1 script file is involved. This pattern often indicates attempts to bypass execution policy or run obfuscated payloads in memory, which is a common behavior of malicious HTA files.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., encoded commands, hidden windows) initiated by mshta.exe, excluding instances where a .ps1 script file is involved. This pattern often indicates attempts to bypass execution policy or run obfuscated payloads in memory, which is a common behavior of malicious HTA files.
Detects Adblock.dll used by Docro Hijacker to bypass Chrome Secure Preferences HMAC-SHA256 integrity checks and register infected browser UUID via vendralo[.]info
Detects Adblock.dll used by Docro Hijacker to bypass Chrome Secure Preferences HMAC-SHA256 integrity checks and register infected browser UUID via vendralo[.]info
This rule detects the use of PowerShell to modify Microsoft Defender settings to disable real-time, behavior, and IOAV protection, while simultaneously adding a full-drive exclusion for the root directory (C:\). This behavior is characteristic of an adversary attempting to disable security monitoring to facilitate further malicious activity or avoid detection.
Detects suspicious persistence mechanisms initiated by the 'wscl.exe' executable. The rule monitors for registry run key modifications, service installation via command-line arguments, and service creation events, specifically filtering for non-standard execution paths (outside of System32, SysWOW64, or Program Files).
Detects instances where rundll32.exe is executed by a process named 'eld0.exe' residing in user-writable or temporary directories (e.g., Users, ProgramData, Temp, AppData). This behavior is characteristic of execution flow hijacking or malicious payload loading from suspicious file paths.
Detects instances where rundll32.exe is executed by a process named 'eld0.exe' residing in user-writable or temporary directories (e.g., Users, ProgramData, Temp, AppData). This behavior is characteristic of execution flow hijacking or malicious payload loading from suspicious file paths.
Detects instances where rundll32.exe is executed by a process named 'eld0.exe' residing in user-writable or temporary directories (e.g., Users, ProgramData, Temp, AppData). This behavior is characteristic of execution flow hijacking or malicious payload loading from suspicious file paths.
Detects successful Kerberos PKINIT authentication (Event 4768, PreAuthType 16) issued by on-premises certificate authorities. This activity is a potential indicator of Shadow Credentials or Active Directory Certificate Services (AD CS) abuse where attackers use forged or stolen certificates to authenticate as domain users or machines.
The following analytic detects the execution of `arp.exe` with the `-a` flag, which is used to list network connections on a compromised system. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, command-line executions, and related telemetry. Monitoring this activity is significant because both Red Teams and adversaries use `arp.exe` for situational awareness and Active Directory discovery. If confirmed malicious, this activity could allow attackers to map the network, identify active devices, and plan further lateral movement or attacks.
Detects rapid, repeated invocation of Microsoft Defender remediation processes (mpcmdrun.exe, MsMpEng.exe) occurring in conjunction with suspicious file write or rename operations in System32. This pattern is characteristic of a Time-of-Check to Time-of-Use (TOCTOU) race condition, where an attacker attempts to exploit the timing gap between Defender's detection and remediation actions to replace a file with a malicious version.
Detects the use of bcdedit.exe to disable automatic system recovery features, a common technique used by ransomware and other malware to prevent automated restoration of the operating system after compromise.
Detects the creation of a scheduled task named 'Windows Update ALPHV' using the schtasks.exe utility. This task is associated with the OpnKey ransomware, which uses this name to masquerade as a legitimate Windows Update task while running with SYSTEM privileges to maintain persistence.
Detects the execution of vssadmin.exe or WMIC.exe with commands intended to delete Volume Shadow Copies. This behavior is commonly associated with ransomware attempting to prevent system restoration by deleting local backups.
Detects HVNC backdoor payload containing hardcoded AV/EDR process names combined with process enumeration APIs and a hex-suffixed mutex naming pattern, reducing false positives from generic AV name or API string matches alone
Detects command-line execution containing 'Processes.KillRunningProcesses', a string characteristic of the OpnKey ransomware builder configuration, suggesting an intent to terminate critical processes to facilitate encryption.
Page 441 of 1907