Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
368 detections
Filters
Last updated
All Time
Detection languages
165
76
61
21
19
Contributors
104
64
59
35
30
Categories
109
79
71
56
40
Platforms
349
9
5
3
2
Products / Services
10,665
9,773
6,705
4,421
3,749
368
MITRE Techniques
128
87
68
40
36
CVEs
7
5
5
2
2
IDS Classtypes
1
IDS Protocols
1
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
Detects attempts to clear Windows Event Logs using either the native 'wevtutil.exe' utility or the 'Clear-EventLog' PowerShell cmdlet. Clearing event logs is a common technique used by adversaries to hide traces of their activities on a compromised host.
This rule detects activity associated with the SHARDLOADER malware loader. It monitors for the presence of specific DLL files ('SolidPDFCreator.dll' or 'MediumInstStart.exe') in process image paths or process names, and explicitly checks for the creation of a unique mutex artifact named 'uydgcfteionxcfd' as a high-confidence indicator of execution.
Detects the loading of amsi.dll by processes running from suspicious or user-writable directories (e.g., Temp, AppData) or common scripting interpreters like Python. This behavior is often indicative of an attempt to tamper with or bypass the Antimalware Scan Interface (AMSI) for malicious purposes.
Detects the loading of the avicap32.dll library (a legacy Windows Multimedia API used for webcam capture) by processes other than recognized media or conferencing applications. This is a common indicator of RATs (such as Atlas RAT or Gh0stRAT) attempting to clandestinely record video or audio from the victim's device.
Detects various methods of anti-forensics activity commonly used to hide attacker presence, including clearing Windows Event Logs via wevtutil or PowerShell, deleting the USN Journal via fsutil, and bulk file deletion using command-line utilities.
Detects application crash events recorded in the Windows Application Event Log involving executables named 'quickshare.exe' or 'nearby.exe'.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Detects behavioral indicators associated with VILE ransomware, specifically focused on defense evasion through Windows event log clearing, termination of security-related processes, and the presence of specific ransomware-related configuration or identity files in common staging directories.
Detects indicators of compromise associated with CVE-2026-45115 in OpenVPN Connect, including suspicious child processes spawned by OpenVPN, the creation of known PoC marker files, and the execution of commands containing exploitation strings related to echo script injection.
This rule monitors for indicators of Impacket toolset usage across multiple data sources, including named pipe access (Event 5145), service creation (Event 7045), scheduled task creation (Event 4698), and process execution (Event 1). It flags suspicious activity associated with modules like secretsdump, wmiexec, psexec, and smbexec, aggregating findings by source host and user to evaluate the breadth of potential unauthorized activity.
This rule monitors for recurring application crashes involving 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. Frequent crashes of these components may indicate instability, misconfiguration, or an attempt to exploit vulnerabilities within these specific file sharing services.
This rule detects Windows application crash events (Event IDs 1000 and 1001) specifically for 'NearShare.exe', 'NearbySharing.exe', or 'quickshare.exe' processes. The detection triggers when the crash description contains indicators of memory-related instability, such as access violations, heap corruption, or invalid virtual calls, which may suggest exploitation attempts or service instability.
This rule detects potential exploitation activity related to CVE-2026-45657 involving the Windows Kernel tcpip.sys driver. It monitors for a combination of system crashes (Kernel-Power 41 or EventLog 6008) correlated with Windows Error Reporting (WER) events referencing 'tcpip.sys', or significant spikes in external authentication attempts occurring shortly before a system crash. The rule aims to identify potential remote code execution attempts manifesting as kernel instability.
Monitors IIS web servers for signs of potential exploitation by tracking suspicious child processes spawned by worker processes (w3wp.exe/iisexpress.exe), tracking unexpected WER (Windows Error Reporting) crashes associated with IIS workers, aggregating IIS-related application crashes, and detecting anomalous W3C IIS log request patterns (e.g., malformed content-length, negative bytes, or suspicious URI characteristics).
Detects attempts to clear Windows event logs using the wevtutil command-line utility or PowerShell cmdlets (Clear-EventLog, Remove-EventLog). Adversaries often clear event logs to hinder forensic investigations and remove evidence of their malicious activity.
Detects the execution of WinRAR or rar.exe with command-line arguments specifying password protection or outputting to common staging directories. This behavior is frequently associated with attackers staging and compressing sensitive data prior to exfiltration.
Detects attempts to clear Windows event logs using the native 'wevtutil' command-line utility or PowerShell 'Clear-EventLog' command. The rule applies elevated risk levels when the activity is initiated by system-level processes or accounts, which is often indicative of adversary activity attempting to remove forensic evidence of post-exploitation actions.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects a sequence of suspicious activities associated with LCRYX ransomware, starting with PowerShell execution containing AMSI bypass strings (e.g., AmsiInitFailed, amsiContext), followed by event log clearing using wevtutil or PowerShell Clear-EventLog, or disabling of audit policies using auditpol.
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Page 5 of 18