Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,665 detections
Filters
Last updated
All Time
Detection languages
10,181
119
110
99
60
Contributors
2,815
2,800
1,768
504
492
Categories
4,275
2,971
2,237
1,829
1,457
Platforms
10,376
1,102
802
155
98
Products / Services
10,665
9,773
6,705
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects the execution of legitimate .NET framework utilities (Aspnet_compiler.exe, RegAsm.exe, vbc.exe) launched by scripting engines like PowerShell or WScript. This behavior is a known TTP for process hollowing, as seen in Agent Tesla campaigns, where malware injects its code into a trusted process to evade defenses.
Detects a command-line pattern associated with the Metasploit 'getsystem' command. This technique involves echoing a string into a named pipe to elevate privileges to SYSTEM, often executed via a newly created service.
This rule detects potential port scanning activity from a single host. It identifies scenarios where a device attempts to connect to a large number of unique remote ports (20 or more) or a large number of unique remote IP addresses (25 or more) within a 10-minute window. This behavior is indicative of an adversary attempting to discover open ports or active hosts on a network.
Detects modifications to the RubyGems 'operating_system.rb' file, a technique used by APT37's SNAKEDROPPER malware to achieve persistence by hijacking the Ruby interpreter's execution flow. The rule specifically looks for file creation or modification events on the 'operating_system.rb' file within the RubyGems directory structure, while excluding legitimate 'gem install' operations to reduce false positives.
Detects PowerShell launching RegSvcs.exe, a technique used by TA584 to deliver the 'P0WER' variant of XWorm via process hollowing. The 'P0WER' variant of XWorm uses a custom .NET loader that starts RegSvcs.exe in a suspended state, which is a strong indicator of process hollowing. Legitimate use of RegSvcs.exe by developers is possible but uncommon from PowerShell.
This rule detects the creation of suspicious child processes by Microsoft Office applications. This behavior is commonly associated with malicious macros embedded in Office documents or phishing attacks that leverage Office documents to execute arbitrary commands. The rule specifically looks for Office applications (Word, Excel, PowerPoint, Outlook, OneNote, Publisher, Visio, Access) spawning known suspicious executables like command prompts, PowerShell, script interpreters (wscript, cscript), and various utility tools (mshta, regsvr32, rundll32, certutil, bitsadmin, wmic, schtasks, whoami, net, netsh, nslookup, curl).
Detects the Java process, commonly associated with Apache ActiveMQ, spawning certutil.exe to download a file from a remote URL. This behavior is a strong indicator of initial compromise via vulnerabilities like CVE-2023-46604.
This rule detects network connections or email URLs that match a list of known Indicators of Compromise (IOCs) associated with Signal-targeted phishing infrastructure and explicit phishing destination domains. These IOCs were identified in Unit 42's research on QR code attack vectors. The rule queries email URL information, URL click events, device network events, and common security logs (proxy/firewall/WAF) to identify activity related to these malicious domains.
Detects web navigation to Amazon and AliExpress that contains specific hardcoded affiliate tags used by the 10xprofit extension network. The presence of these tags indicates active affiliate hijacking, likely due to a malicious browser extension.
Detects periodic network traffic (beaconing) from browser processes to external domains, which may indicate automated data exfiltration by a malicious extension like the ChatGPT Stealer. This threat is known to exfiltrate data at approximately 30-minute intervals.
Detects PowerShell executing a self-parsing command to extract a hidden payload from a batch file. This technique was observed in the Dead#Vax campaign. The malware reads its own batch file content to find a line starting with '@' which contains the next-stage encrypted payload.
This rule detects outbound network connections from devices to IP addresses identified as malicious by a threat intelligence feed. It joins device network events with threat intelligence indicators, specifically looking for successful connections or connection requests to IPs with a confidence score greater than 50. The alert provides details about the device, the remote IP, the initiating process, and the threat intelligence context.
This rule detects the execution of PsExec or similar tools (psexec.exe, psexec64.exe, paexec.exe) which are commonly used for lateral movement within a network. It also identifies the use of PsExec service (psexesvc.exe) or command-line arguments indicative of PsExec activity, such as accessing administrative shares (ADMIN$, C$, IPC$) or the '-accepteula' flag.
This rule detects the presence of hardcoded tokens associated with the dYdX supply chain attack. These tokens were used for C2 authentication and as an API key for data exfiltration. The rule searches across process command lines, network URLs, network headers, and common security logs for these specific tokens.
This rule detects PowerShell execution containing keywords related to AES decryption combined with a Base64 encoded MZ header ('TVqQAAM'). This pattern is indicative of reflective loading of malicious assemblies in memory, a technique used by malware like Agent Tesla to bypass disk-based defenses.
Detects a PowerShell process initiating a network connection to download an image or text file from domains associated with a Remcos RAT campaign. In this campaign, PowerShell is used to download a steganographic image containing the next stage payload.
This rule detects network connections from common web browsers to known command and control (C2) domains associated with the ChatGPT Stealer campaign. These domains are used to exfiltrate stolen AI session tokens and conversation data.
This rule detects attempts to bypass User Account Control (UAC) by monitoring modifications or creations of specific registry keys. Adversaries often manipulate these registry keys to achieve privilege escalation without triggering a UAC prompt, allowing them to execute malicious code with elevated permissions. The rule specifically looks for changes to registry paths commonly abused in UAC bypass techniques, such as those related to ms-settings, mscfile, Environment\UserInitMprLogonScript, exefile, Folder, and Image File Execution Options.
This rule detects the behavioral pattern of the dYdX RAT, which executes Python scripts from temporary directories with suppressed output. It looks for Python processes (identified by original filename) executing from common temporary directories while also suppressing output (e.g., redirecting to /dev/null or using CREATE_NO_WINDOW).
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
Identifies a Windows Script Host process (wscript.exe or cscript.exe) creating a JScript (.js) file in a Startup folder. This is a common persistence technique used by malware, including the JScript downloader in the Remcos RAT campaign.
Page 449 of 508