Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
This rule monitors for processes executing from within the 'AppData\Roaming\Traiolx Custom Utils\' directory that subsequently load specific DLLs (7z.dll, normaliz.dll, or user32.dll). This behavior pattern is indicative of potential malicious activity, such as side-loading or execution of masqueraded binaries.
Detects the creation or usage of specific DLLs and batch files within a directory path containing 'Traiolx Custom Utils'. This pattern often suggests the deployment or execution of components related to specific tools or potentially malicious software, leveraging DLL side-loading or path-based execution.
This rule detects potential BeepRat malware activity by monitoring for specific file names associated with the threat, combined with reconnaissance behaviors. The rule identifies processes performing system information discovery, specifically machine identification (GetHWID), hardware metrics (ProcessorCount, DriveInfo), and cryptographic operations (MD5CryptoServiceProvider) which are commonly used in the initial stages of malware execution to profile target systems.
Detects the execution of AWS Security Token Service (STS) CLI commands (such as get-caller-identity) initiated by development-related processes like VS Code (Code.exe), Code Helper, or Node.js. This behavior may indicate an attacker leveraging developer environments to perform cloud infrastructure discovery or enumerate AWS permissions.
This rule detects execution patterns associated with the BeepRAT malware family. It identifies the presence of known loaders (HFY.exe or tcc.exe) or processes exhibiting specific command-line arguments and configuration loading behavior often used by this malware. The rule also aims to identify child process activity consistent with keyboard hooking.
Detects suspicious process execution patterns associated with the 'HFY.exe' utility, including potential User Account Control (UAC) bypass attempts via auto-elevating Windows binaries like eventvwr, fodhelper, and sdclt, as well as specific command-line parameters for 'tcc.exe'.
This rule detects web browser processes (Chrome, Edge, Brave, Chromium) or potential browser extension files interacting with the 'perplexity-ai.online' domain. This is often associated with malicious browser extensions or phishing campaigns attempting to lure users to fraudulent sites.
Detects the execution of cloud CLI tools (aws, curl) or shell interpreters (bash, sh, cmd, powershell) triggered by development-related processes like Node.js, VS Code, or Amazon Q. This pattern is indicative of potential command-and-control activity or credentials theft occurring via compromised developer environments.
This rule monitors for the execution of suspicious processes named 'HFY.exe' or 'tcc.exe' located in specific directories, and identifies any child processes spawned by them. This is often used to track the activity of specific malicious binaries or unauthorized tools that attempt to launch further processes to carry out additional stages of an attack.
Detects the execution of specific suspicious binaries (tcc.exe or LuaJit.exe) with command-line arguments indicative of shellcode loading, followed by a network connection to known C2 infrastructure (IP 207.56.8.166 or Port 18848) from the same host within 15 minutes.
Detects instances where image processing utilities (ImageMagick's magick.exe or convert.exe) launch Ghostscript binaries (gs, gswin64c.exe) from non-standard directories (such as temp, user profile, or appdata folders) or utilize suspicious command-line arguments that attempt to bypass security policies. This activity is often associated with exploitation of image processing vulnerabilities where attacker-supplied files trigger arbitrary command execution.
Detects execution of rundll32.exe with 'phsvc' command line arguments, and the subsequent spawning of potentially malicious child processes (cmd, powershell, wscript, mshta, calc) from the SystemInformer.exe process. This behavior indicates potential abuse of the PhSvcApiCreateProcessIgnoreIfeoDebugger functionality within SystemInformer to bypass debugger-related detection or gain unauthorized execution context.
Detects the establishment of persistence via Registry Run keys, Scheduled Tasks, or Windows Services, where the executed file or binary path is located in suspicious directories such as AppData, Temp, or ProgramData. This indicates potentially malicious code staged in temporary or user-writable locations to maintain access.
Detects the execution of Windows command-line utilities (icacls, cacls, attrib, takeown) used to modify file permissions or attributes, specifically when these operations are directed at sensitive system or temporary directories (e.g., ProgramData, Temp, AppData, etc.) and executed by non-system service accounts.
Detects Visual Studio Code spawning common command-line shells or interpreters (cmd.exe, powershell.exe, python, etc.) with suspicious command-line arguments, such as network download utilities (curl, wget, Invoke-WebRequest) or potentially malicious obfuscated/long arguments, which may indicate developer environment exploitation or software supply chain attacks.
Detects instances where the Python interpreter (python.exe or python3.exe) is spawned as a child process of common development environments like Visual Studio Code (code.exe) or Node.js runtime processes. This behavior may indicate an adversary using development tools as a proxy for executing malicious scripts or unauthorized code during post-exploitation activities.
Detects network connections to known blockchain and crypto-related domains (trongrid.io, aptoslabs.com) initiated by common programming and development tools (node, Code, python, python3). This pattern is often associated with the deployment of unauthorized cryptocurrency miners, blockchain interaction scripts, or malicious actors leveraging development environments.
This rule detects instances where development-related processes (such as Code.exe or node.exe) spawn web browser processes (like chrome.exe, firefox.exe, or msedge.exe). This pattern is often indicative of an adversary attempting to leverage developer environments or cross-platform applications to interact with browser-based session data, cookies, or cached credentials.
This rule detects the execution of common command-line tools (npm, node, or go) where the command arguments contain known malicious or suspicious strings associated with recent supply chain or exploitation activity (such as malicious npm packages, specific GitHub repositories, or unusual file path access).
This rule detects the loading or execution of known vulnerable kernel drivers. These drivers are often leveraged by adversaries in Bring Your Own Vulnerable Driver (BYOVD) attacks to achieve privilege escalation by exploiting vulnerabilities in the driver to execute code in kernel mode.
This rule detects potentially malicious clipboard data access by scripting engines (Python, Node.js) and command-line utilities (xclip, xdotool, PowerShell). It monitors for specific API calls, module imports, or command arguments that signify reading or interacting with the system clipboard, often used by malware for credential theft or data exfiltration.
Page 55 of 100