Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,085 detections
Filters
Last updated
All Time
Detection languages
937
669
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
208
171
Platforms
1,854
491
298
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,085
MITRE Techniques
760
704
336
308
238
CVEs
8
7
6
6
6
IDS Protocols
1
Detects execution of fltMC.exe from a location other than the standard Windows System32 directory, correlated with recent file creation or modification events in sensitive directories like ProgramData or User Public folders. This behavior is indicative of an attacker attempting to load malicious kernel-mode drivers or perform system-level operations using a renamed or moved system utility.
This rule detects two potentially malicious activities: the execution of 'fltMC.exe' from a 'Temp' directory, which is a known masquerading technique for the legitimate Windows filter manager utility, and the creation of an executable file within the 'C:\ProgramData\Windows Multimedia\ROG\' directory, which is a common path used by threat actors to stage malicious binaries.
This rule detects potentially malicious activity related to the 'node-gyp' build tool used by npm. It monitors for two patterns: 1) npm spawning node-gyp, which can be an automated trigger for malicious binding.gyp files, and 2) node-gyp spawning node.exe with command-line arguments indicative of obfuscated JavaScript (e.g., base64 encoding, eval, AES-GCM patterns), a technique often seen in malicious Node.js packages.
Detects outbound network connections from endpoint processes to domains associated with a malicious browser extension. The extension is known to fetch scriptlets that enable main-world JavaScript injection and potential credential theft (e.g., document.cookie).
Detects unauthorized cross-process memory operations targeting high-value Windows processes (e.g., lsass.exe, svchost.exe) by unsigned or untrusted processes. It also detects indicators of reflective DLL injection within process command lines.
Detects the execution of known credential dumping tools and techniques on Windows systems. This includes targeting LSASS process memory using procdump or rundll32 with comsvcs.dll, and attempts to extract NTDS.dit via ntdsutil, vssadmin, or diskshadow.
Detects the execution of 'fscan', a common command-line tool used by adversaries for network service discovery, port scanning, and vulnerability identification on a target host.
Detects behavior consistent with the SharkLoader malware, including the creation of malicious components in %APPDATA% subdirectories (xwreg, xgdf), the execution of SystemSettings.exe from these non-standard directories, and the execution of commands via cmd.exe initiated from these paths. It also identifies file staging activities in %TEMP%\aswerf.
This rule detects potential malicious activity involving the 'wusvc.exe' executable. It flags instances where 'wusvc.exe' is executed from the user's Downloads folder or other non-standard paths, particularly when the file size is abnormally small (less than 100KB), which is indicative of masquerading or a dropper payload. The rule also checks for a known malicious file hash associated with the Snowlight dropper.
Detects the execution of VBScript files containing 'ragecore' in the command line, specifically when launched via wscript.exe or cscript.exe from common staging or persistence directories such as Windows Temp, Users Public, or Startup folders.
This rule detects the execution of processes named win_guard_*.exe or those residing in directories often used for malicious staging (Users\Public, Windows\Temp, ProgramData). Additionally, it detects when these identified suspicious processes load user32.dll, a common indicator of initiating a low-level keyboard hook (WH_KEYBOARD_LL) often used by keyloggers to capture user input.
Detects processes located outside of standard Windows system directories (System32 and SysWOW64) that load the advapi32.dll library. Advapi32.dll is a core Windows API library frequently used for security-related functions, including service control and registry manipulation; its loading by non-system binaries can be indicative of masquerading or malicious activity.
Detects suspicious execution patterns involving Windows file management utilities (takeown.exe, icacls.exe) or the deletion of command-line interpreter binaries through cmd.exe. These patterns are often associated with unauthorized modifications of file permissions or attempts to clear forensic evidence during an intrusion.
Detects multiple execution attempts of common Windows built-in utilities (bcdedit, vssadmin, wbadmin, wmic) used to disable recovery features or delete volume shadow copies within a 5-minute window. This behavior is highly characteristic of ransomware or destructive malware aiming to prevent system recovery.
Detects the creation of a local user account followed immediately by the addition of that same account to the local Administrators group using the built-in Windows net.exe or net1.exe utilities. This pattern is commonly observed during adversary post-exploitation activity to establish persistence or escalate privileges.
Detects execution of PowerShell commands that use the ExecutionPolicy Bypass flag while concurrently attempting to suspend BitLocker protection. This behavior is highly characteristic of ransomware activity, specifically associated with the ShrinkLocker malware, where the adversary disables disk encryption protection to facilitate malicious operations or subsequent encryption.
This rule detects the use of native Windows utilities to inhibit system recovery capabilities. It monitors for the execution of 'wbadmin.exe' to delete the backup catalog and 'bcdedit.exe' to disable automatic boot recovery or ignore boot failures, which are common tactics used by ransomware and other malware to prevent system restoration after data destruction.
Detects unauthorized attempts to terminate, stop, or access Endpoint Detection and Response (EDR) or Antivirus agent processes. This is identified by monitoring command-line utilities like taskkill, net, and sc targeting known security service names, as well as detecting suspicious cross-process access (e.g., OpenProcess) by unauthorized processes targeting security agent PIDs.
Detects instances where 'node.exe' or 'node' initiates the deletion of 'setup.cjs' from the 'node_modules/easy-day-js' directory. This includes both direct file system deletion (fs.rmSync) and shell-based deletion commands (e.g., 'del /f', 'rm -f') executed by 'node.exe'. This activity is indicative of potential malicious behavior, possibly related to supply chain attacks or post-exploitation cleanup.
Detects network connections to common IP lookup services (e.g., ip-api.com, ipify.org) initiated by processes often associated with malware, such as Remcos RAT components or hijacked system processes like iexplore.exe. This activity is frequently used by adversaries for reconnaissance or C2 heartbeats to identify the external IP address of a compromised host.
This rule detects anomalous process execution patterns associated with Remcos RAT, specifically monitoring for the spawning of 'rmclient.exe', unauthorized spawning of 'fsutil.exe', or 'svchost.exe' being launched by processes other than system-critical services. These patterns are characteristic of Remcos RAT deploying its watchdog or performing process injection.
Page 46 of 100