Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,085 detections
Filters
Last updated
All Time
Detection languages
937
669
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
208
171
Platforms
1,854
491
298
26
12
Products / Services
10,665
9,758
6,693
4,421
3,749
2,085
MITRE Techniques
760
704
336
308
238
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects common security product executables (MsMpEng.exe, SenseNdr.exe, csfalconservice.exe, CylanceSvc.exe) that are running from file paths inconsistent with their legitimate installation directories. This behavior is indicative of an adversary attempting to masquerade as trusted security software to evade detection or achieve persistence.
Modular remote access trojan associated with long-term espionage intrusions
Detects instances of wermgr.exe (Windows Error Reporting) interacting with Volume Shadow Copies or using specific Alternate Data Streams (WDFOO). This behavior is often associated with credential dumping tools (e.g., Mimikatz, SharpShadow) attempting to access sensitive files from shadow copies under the context of a non-system user, potentially indicating evasion techniques or credential harvesting.
Detects the creation of scheduled tasks using schtasks.exe with suspicious command line parameters or originating from unusual parent processes. This includes tasks created to run as SYSTEM, tasks configured with ONSTART triggers, tasks referencing common temporary directories, or tasks created by processes typically unrelated to scheduled task management (e.g., Teams, remote assistance tools, or command processors).
Detects cross-process memory or thread injection activity where an untrusted or non-system process attempts to inject code into critical system processes such as svchost.exe, explorer.exe, or lsass.exe. This excludes legitimate system process-to-system process interactions to reduce noise.
This rule monitors for large outbound network data transfers (greater than 10MB) over standard web ports (80/443) initiated by processes typically associated with office productivity applications (e.g., WinWord, Excel, Outlook) or credential dumping tools (lsass.exe). It further correlates this activity with preceding network connections to common directory service ports (LDAP/Global Catalog) on the same host, indicating potential credential collection followed by data exfiltration.
Detects execution patterns associated with Payouts King malware, characterized by specific command-line arguments, obfuscated execution flags, and execution from suspicious directories like Temp, AppData, or ProgramData. The rule uses a scoring mechanism to identify malicious behavior, including checking against known malicious SHA256 hashes.
Detects indicators of the IronWorm malware performing self-propagation by abusing npm Trusted Publishing (OIDC) token exchange, executing suspicious npm publish commands, and unauthorized access to ~/.npmrc configuration files. The rule monitors for network requests to npm OIDC endpoints from non-standard processes, npm publish operations originating from non-interactive shell or script environments, and file access to credential files by suspicious parent processes.
Open-source derived remote access trojan with plugin architecture
This rule detects the creation of local user accounts using administrative tools such as 'net.exe', 'net1.exe', 'powershell.exe', or 'pwsh.exe'. It monitors command-line arguments indicative of account creation (e.g., 'user /add', 'New-LocalUser') and excludes legitimate parent processes commonly associated with administrative activity, such as explorer.exe or services.exe, to reduce noise.
This rule detects potentially malicious npm activity, including the execution of preinstall hooks in non-standard locations, the use of publishing commands with external registry flags, and the execution of suspicious scripts located within node_modules directories, often indicative of a software supply chain compromise.
Detects instances where the Windows Event Viewer utility (eventvwr.exe) spawns a child process other than the Microsoft Management Console (mmc.exe). This behavior is a well-documented technique for bypassing User Account Control (UAC) because eventvwr.exe is an auto-elevating binary, which can be manipulated to execute arbitrary payloads with high-integrity privileges.
This rule detects a suspicious process execution chain where 'start.exe' or 'BQT.exe' is identified in a parent-child relationship. Specifically, it flags 'start.exe' spawning 'BQT.exe', or 'BQT.exe' subsequently invoking 'vssadmin.exe' with the 'delete shadows' command, which is a common technique used by ransomware to prevent system recovery.
Detects execution of QEMU binaries (e.g., qemu-system-x86_64.exe) that exhibit suspicious characteristics, including command-line references to disk images or databases, execution from user-writable directories (Temp, AppData, etc.), or spawning from unusual parent processes like script interpreters or remote access tools.
This rule detects network connections to the Telegram API (api.telegram.org) initiated by specific processes that are typically associated with scripting or unauthorized execution (BQT.exe, start.exe, python.exe, pythonw.exe), while explicitly excluding common web browsers. This behavior is often indicative of automated command-and-control (C2) communication or data exfiltration using Telegram as a transport layer.
Detects the execution of setup or precheck scripts from specific paths ('/tools/setup' or '/.github/scripts/precheck') when spawned by common development-related shell or Node.js processes. This pattern often identifies anomalous build-time activities or execution of unauthorized configuration scripts in CI/CD or development environments.
This rule detects potentially suspicious process execution behavior on Linux systems. It triggers on the execution of specific files often used as build tools or pre-check scripts ('/tools/setup', '/.github/scripts/precheck') or processes spawned from 'node_modules' directories by common Node.js package managers ('npm', 'node', 'npx') where the spawned executable lacks standard script file extensions (e.g., .js, .sh). This is indicative of potential execution of arbitrary binaries or obfuscated scripts within a development or CI/CD environment.
Detects a MobaXterm credential decryption utility reading session configuration or registry data before SSH or RDP activity, indicating potential credential access for lateral movement.
This rule detects instances where a process named 'systemd-userdbd' is executed from a file path other than the standard locations ('/lib/systemd/systemd-userdbd' or '/usr/lib/systemd/systemd-userdbd'). Such behavior is often indicative of masquerading, where malicious actors rename their executables to match legitimate system services to evade detection. The rule additionally flags when the parent process is a common interpreter or package manager, which increases the likelihood of malicious activity.
This rule detects non-standard processes (not identified as common web browsers) accessing browser extension configuration files associated with cryptocurrency wallets (MetaMask or Coinbase Wallet). The rule triggers when a process performs file I/O on multiple distinct extension configuration paths, and the initiating process is associated with build-time or package management tools like Node.js, npm, or Git, which may indicate malicious activity related to supply chain attacks or credential theft from browser storage.
This rule detects a process initiated by Node.js or NPM performing a DNS lookup for known malicious domains while simultaneously accessing sensitive local files such as SSH keys, AWS credentials, browser cookies, browser login data, or bash history. This pattern is indicative of a post-compromise activity where an adversary leverages a JavaScript runtime to perform credential theft and communicate with C2 infrastructure.
Page 51 of 100