Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects a banking overlay process showing an update, validation, or security-maintenance message while suppressing interaction with the real browser. This behavior is characteristic of certain banking Trojans or RATs that aim to trick users into providing credentials or other sensitive information by presenting a fake security update or maintenance prompt that overlays legitimate browser windows.
Detects a banking trojan invoking SendInput, mouse_event, keybd_event, or related APIs to control the victim session. The rule specifically looks for process events where the filename matches common RAT names (banana, client, update, service) and the command line contains API calls related to input injection.
A node/python/pip-driven package install resolves a domain that Palo Alto classifies as newly-registered within seconds of the install. This signals a potential malicious dependency or compromised package beaconing to attacker infrastructure (supply-chain compromise / install-time C2).
Detects the use of the 'chmod' command to modify file permissions on critical system directories or files such as /etc/passwd, /etc/shadow, and various log directories. This activity is often indicative of an adversary attempting to facilitate privilege escalation, maintain persistence, or hide malicious artifacts.
This rule detects activity associated with malicious or intrusive browser extensions, specifically identifying network connections to a known malicious command-and-control (C2) endpoint, execution of specific scriptlet keywords related to MAIN-world injection in browser processes, and the presence of known 'BadBlocker' extension IDs on endpoints.
This rule detects the execution of DcRAT by monitoring for its unique single-instance mutex 'Global\ShitSetupOn26126k' or the execution of processes known to be associated with DcRAT, specifically 'Mixed Reality.exe' in common locations or masquerading under the provided file name.
Detects a sequence of sensitive Windows API calls (AllocateAndInitializeSid, CheckTokenMembership, or ShellExecuteW with runas) occurring within the same process on a host. This behavior is indicative of privilege escalation attempts or unauthorized token manipulation, often observed in malicious processes attempting to elevate privileges or verify token permissions.
Detects modifications to Windows Registry Run keys (HKCU or HKLM) by suspicious processes (cmd, powershell, wscript, cscript, node). The detection specifically looks for cases where the written value points to a binary located in user-writable or temporary directories and the binary itself is unsigned or has low trust, indicating a potential persistence mechanism being established.
This rule monitors for processes that start after a delay (between 30 and 600 seconds) following the launch of common web browsers (Chrome, Edge) or PDF readers (Acrobat, Foxit). The rule excludes common background processes associated with these applications, focusing on potential delayed execution of malicious payloads or secondary stage activity after a user has opened a document or navigated a malicious site.
This rule detects the creation of synchronization objects with names matching specific patterns often associated with malicious setups or obfuscated file naming conventions. It joins these object creation events with process rollup data to provide context on the originating process, including command line arguments and file paths.
Detects unauthorized processes attempting to access sensitive web browser files (Login Data, Local State, Cookies) and subsequently copying or staging these files to temporary directories (Windows Temp or AppData Temp) within a 5-minute window, a technique often used for credential harvesting.
Detects a suspicious PowerShell command sequence involving network downloads to temporary directories followed by the execution of a Node.js binary from within the user's AppData directory within a 30-minute window. This behavior is indicative of a dropper pattern where a malicious script retrieves and executes a secondary stage payload.
Detects instances where node.exe is launched from common user-mode applications (like browsers or shells) and executes a JavaScript file from temporary or user application data directories, followed by a DNS request to domains associated with high-risk TLDs (shop, bond, sbs, cfd). This behavior is characteristic of certain remote access trojans (RATs) that utilize node.js for secondary payloads.
Detects instances where a process originating from common suspicious directories (AppData Roaming, AppData Local, or Temp) modifies a Windows Run registry key, which is a common persistence technique used to ensure code execution upon user logon.
Detects the correlation of a PowerShell process spawned by Explorer using a bypass execution policy, followed by a local Node.js process accessing web browser cookie files (Chrome, Edge, or Brave). This behavior is indicative of a potential credential theft attempt where an attacker uses PowerShell to prepare the environment and a helper process to extract browser session cookies.
This rule detects potential adversary activity by correlating the execution of known analysis or debugging tools (e.g., Wireshark, ProcessHacker, x64dbg) occurring within a 30-minute window of a process executing from suspicious, user-writable directories (typically AppData/Local or AppData/Roaming). This pattern is often indicative of an adversary staging tools to facilitate further analysis, reverse engineering, or credential harvesting on a compromised host.
Detects instances where rundll32.exe is spawned by common command-line or installer processes (cmd.exe or msiexec.exe), often associated with malicious script execution or payload deployment from user-writable directories (AppData\Roaming) or using batch files.
This rule detects the execution of command-line scripts (specifically .bat files) located within the user's AppData\Roaming directory. It specifically flags execution attempts associated with 'xupdate.bat' or files containing 'Traiolx Custom Utils'. This activity is characteristic of malicious persistence or background utility execution often seen in various malware strains that attempt to camouflage their operation within user profile directories.
This rule detects various behaviors associated with the LegionLoader malware, including suspicious process execution (msiexec/cmd spawning cmd/rundll32/dllhost via AppData), anti-debugging API calls (IsDebuggerPresent, SetUnhandledExceptionFilter), and specific registry modifications targeting Internet Explorer security settings used for sandbox evasion.
This rule detects potentially malicious activity where msiexec.exe is used to drop payloads or cmd.exe is used to execute batch scripts located within the user's AppData Roaming directory. This pattern is commonly associated with malware staging and execution, including specific indicators linked to LegionLoader.
Detects the execution of files with .exe, .msi, or .bat extensions located within the user AppData Roaming directory. This path is frequently abused by malware, droppers, and persistence mechanisms to execute code in a directory that is typically writable by the user without requiring elevated administrative privileges.
Page 54 of 100