Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,085 detections
Filters
Last updated
All Time
Detection languages
937
669
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
208
171
Platforms
1,854
491
298
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,085
MITRE Techniques
760
704
336
308
238
CVEs
8
7
6
6
6
IDS Protocols
1
Detects the malware presenting telephone or support instructions after blocking banking access, encouraging the victim to contact an attacker-controlled operator. This rule specifically looks for process creation events where the executable name matches common RAT naming conventions (banana, client, update, service) and the command line contains keywords related to calling support or telephone numbers, often in the context of banking or security issues.
Detects evidence of potential data exfiltration activities including the execution of known exfiltration scripts, the use of netcat for unauthorized data transfer to a specific C2 IP, and the presence or access of BloodHound dump files. The rule also monitors for network communication with a known command and control IP address.
Detects Python scripts or processes accessing common browser credential and cookie storage files (such as Login Data, key4.db, or cookies.sqlite) and subsequently making outbound network connections, indicating potential theft and exfiltration of browser data.
This rule detects potential Pony malware anti-sandbox evasion techniques by correlating WMI queries for virtual machine artifacts and registry reads for BIOS/VM strings with the termination of short-lived processes (less than 30 seconds). This behavior is indicative of malware attempting to determine if it's running in a sandbox environment and exiting if it detects one.
Detects the execution of the SharpGPOAbuse utility or the use of its specific command-line arguments intended for manipulating Active Directory Group Policy Objects (GPOs) to achieve privilege escalation or persistence.
Detects the execution of common reconnaissance and discovery tools on Windows systems, including network and domain trust enumeration tools, and system information utilities. This rule alerts on suspicious usage of binaries like fscan, SharpGPOAbuse, and administrative commands (net, nltest, whoami, ipconfig) used to gather information about the environment, domain trusts, or local system configuration.
This rule detects network connection events where the AutoGen Studio application (identified by its image filename) initiates connections to localhost (127.0.0.1 or ::1) on ports 8080 or 8081. This is typical behavior for the AutoGen Studio web interface or API server running locally.
Detects instances where SystemSettings.exe is spawned from non-standard directories often associated with the SharkLoader malware family, such as AppData roaming subdirectories or KasperskyLab program folders. This behavior is indicative of masquerading and malicious staging.
Detects processes invoking common Windows API functions typically used to detect the presence of debuggers (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess, GetTickCount) when these processes are executed from suspicious locations (such as specific AppData subdirectories) or masquerading as system binaries (SystemSettings.exe). These behaviors are commonly used by malware to detect analysis environments or debuggers and alter execution flow to evade detection.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring memory protection changes (VirtualProtect) targeting the AmsiScanBuffer function within the amsi.dll module. Attackers often modify this function's memory permissions to PAGE_EXECUTE_READWRITE to inject code or patch the function, effectively disabling AMSI scanning capabilities.
Detects instances where a process named wusvc.exe is executed from suspicious directories (such as Downloads, AppData, Temp, or Public folders) instead of the legitimate Windows system directories (System32 or SysWOW64). It further restricts the scope to processes spawned by common user applications like web browsers or explorer.exe, indicating potential masquerading or execution of malicious binaries disguised as the Windows Update service.
Detects execution of 7za.exe with specific command line arguments containing 'Avast', 'data2.bin', and a specific numeric password string, which indicates potential staging or archiving of data, possibly related to malware behavior.
Detects the use of specific Windows API functions or terms commonly associated with process hollowing, code injection, or advanced process manipulation within command-line strings. The monitored functions include NtCreateWaitCompletionPacket, NtAssociateWaitCompletionPacket, RtlGetCurrentPeb, ProcessPrng, and PowerRegisterSuspendResumeNotification.
Detects suspicious command-line arguments indicative of potential credential access attempts (cmdkey /list), or execution of hidden processes (excluding Java applications), or communication with a known malicious domain (staybud.dpdns.org).
Detects regsvr32 with silent, unregister, or scriptlet options referencing a remote or user-writable resource. This behavior is often associated with malware like InstallFix to execute malicious code.
Detects the creation of an mcp.json file within the .amazonq directory, followed shortly by the execution of suspicious child processes (bash, python, curl, etc.) by VS Code (Code.exe). This pattern is often indicative of an adversary abusing developer tools or IDE extensions to perform credential discovery or data exfiltration from a development environment.
Detects the execution of script interpreters (mshta, wscript, cscript) or PowerShell initiated by Microsoft Office applications (Word, Excel, PowerPoint, Outlook). This pattern is a common indicator of malicious macro or embedded script execution, often used to deliver secondary payloads.
This rule detects attempts to disable, stop, or tamper with security-critical Linux system services and configurations. This includes stopping AppArmor, disabling firewalls (iptables, nftables, ufw), disabling SELinux, and modifying file attributes with 'chattr' to potentially hinder security monitoring or unauthorized file modifications.
This rule detects potentially malicious command-line arguments used with common Linux utilities. It monitors for: the use of 'unshare' for namespace manipulation often used for privilege escalation or container escapes, the 'ip xfrm' command for configuring IPsec policies, and the loading of kernel modules ('modprobe'/'insmod') with suspicious parameters ('esp4', 'esp6', 'rxrpc') which could indicate the installation of malicious rootkits or kernel-level backdoors.
This rule detects the execution of common scripting interpreters (PowerShell, WScript, CScript) that include command-line arguments referencing major cloud storage providers and file-hosting services. This behavior is frequently associated with data exfiltration or the staging of malicious payloads using legitimate web services.
Detects the execution of PowerShell commands that query system hardware and environment configurations often used by malware for sandbox detection, virtualization identification, or anti-analysis checks. The rule looks for queries related to VM guest tools (VMware, VirtualBox), BIOS/BaseBoard information, CPU core counts, total memory, and environment variables related to sandbox artifacts.
Page 50 of 100