Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects a process hollowing technique where legitimate system processes (svchost.exe or notepad.exe) are spawned by non-standard parent processes, followed by suspicious memory manipulation API calls (such as NtUnmapViewOfSection, NtWriteVirtualMemory, or NtResumeThread) from an non-system process, indicative of malicious code injection.
Detects the execution of QEMU hypervisor binaries (qemu-system-x86_64, qemu.exe, etc.) when initiated from non-standard parent processes or from non-standard directories, or when associated with disk image files. This behavior may indicate the unauthorized deployment of virtualization software to facilitate lateral movement, data exfiltration, or environment evasion.
Detects unauthorized access to sensitive developer credential files and browser credential stores, typical of the IronWorm Rust-based infostealer. The rule monitors processes that are not known developer or browser tools as they read paths associated with AWS, SSH, Kubernetes, Docker, browser login data, and cryptocurrency wallets.
Detects execution of the Tailscale or Tailscaled process that is not initiated by standard system or management processes. This may indicate unauthorized installation or use of the Tailscale VPN software for covert command and control or lateral movement, especially when combined with immediate network activity to Tailscale infrastructure or ports.
This rule detects potentially malicious activity related to Node.js environments. It monitors for the execution of Node.js or NPM commands involving specific sensitive files ('sync-peer.cjs', 'peer-math.js') or suspicious packing destinations, as well as the creation of 'index.js' or 'package.json' files within a 'node_modules' directory, which can indicate software supply chain manipulation or malicious dependency installation.
Detects instances of the 'systemd-userdbd' process that are either spawned from an unexpected parent process or exhibit path-based anomalies (such as running from 'node' or 'node_modules' directories), which may indicate masquerading or malicious activity.
Detects the presence and activity of Tailscale VPN, including process execution, command-line arguments, network connections to Tailscale infrastructure, and communications within the Tailscale CGNAT address range (100.64.0.0/10). This rule identifies the potential use of Tailscale for tunneling or remote access, which may be unauthorized in some environments.
Detects Node.js processes or npm-related parent processes writing suspicious files (e.g., .cjs, .tgz, package.json) into the node_modules directory. This behavior is often indicative of malicious supply chain activities, such as dependency confusion or post-install script injections observed in campaigns like Operation Poisson.
Detects the ConfigurationRemotingServer.exe process spawning the Windows Service Control Manager (sc.exe). This pattern is often associated with the manipulation of Windows services, which can be an indicator of service-based persistence or command execution.
This rule monitors network connections initiated by a process named 'setup.exe' to known malicious or suspicious IP addresses. Legitimate installers should not be initiating network connections to these specific external addresses.
This rule monitors and alerts on network connections established from endpoints to a predefined list of known malicious IP addresses, which may indicate command-and-control (C2) communication or unauthorized exfiltration attempts.
This rule detects potentially malicious activity associated with the MetaKit software, including DNS lookups to the 'metakit.fireant.vn' update server and the execution of 'setup.exe' processes spawned by parent processes associated with 'metakit'. This pattern is indicative of potential supply-chain execution or suspicious software update behavior.
Detects execution of a process named 'IntelAudioService.exe' located in a user-specific subdirectory under 'IntelAudio\Service\'. This pattern is frequently used by adversaries to masquerade malicious activity by mimicking the naming convention of legitimate Intel audio drivers while executing from non-standard locations.
This rule detects potentially malicious HTTP POST requests directed at a specific URI path ('/V1/Update/GetUpdate') associated with software update functionality. It identifies suspicious traffic by analyzing parameters in the request body (such as Id, Hostname, Mac, Version, Arch) and potential process names (e.g., setup.exe, IntelAudioService.exe). High-risk scores are assigned based on the destination IP and the presence of these specific identifying parameters, which may indicate command-and-control (C2) beaconing or data exfiltration masquerading as legitimate update check traffic.
This rule detects potential lateral movement and privilege escalation activity associated with the SPECTRALVIPER framework. It identifies suspicious process launch events where method names indicative of token manipulation (e.g., StealToken, MakeToken, Impersonate_ThisThread) are present in the command line, or where the OneDrive Sync Service process is used as an indicator of this specific activity.
This rule detects the execution of Windows Subsystem for Linux (WSL) components, including wsl.exe, wslhost.exe, and wslservice.exe. WSL can be leveraged by adversaries to execute malicious code within a Linux environment on a Windows host, potentially bypassing Windows-specific security controls.
Detects the modification or creation of shared object files (.so) within common Linux Pluggable Authentication Modules (PAM) directories. Adversaries often modify these modules to establish persistence, capture credentials, or create backdoors for authentication bypass.
This rule detects activities related to the Windows Subsystem for Linux (WSL2), including the execution of wsl.exe, wslhost.exe, or wslservice.exe, as well as the active presence of the vmmemWSL virtual machine process. Monitoring WSL2 activity is important as adversaries can use the Linux environment to bypass traditional Windows security controls, execute Linux-native tools, or maintain persistence.
This rule detects when the Windows Subsystem for Linux (WSL) process (wsl.exe) launches common Windows binaries or scripting engines. This behavior is indicative of potential cross-environment execution, where attackers use the Linux subsystem to bypass Windows-based security controls or to execute malicious payloads, living-off-the-land techniques, or command-and-control activities within the Windows environment.
Detects the suspicious execution of fltMC.exe or the loading of FLTLIB.dll from temporary directories, which is a known behavior of JFMBackdoor malware. It also detects known SHA256 hashes associated with this threat.
Detects execution and staging activity associated with the NUKESPED (ThreatNeedle) malware family. The rule looks for the execution of known secondary executable names, payload files staged in the ProgramData directory, and a specific process lineage where PowerShell is spawned from WScript or CScript to launch processes from the ProgramData directory.
Page 45 of 100