Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects the loading of specific suspicious library files (SyncRes.dat, SystemSettings.dll, DscCoreR.mui) from the AppData Roaming directory subfolders 'xwreg' or 'xgdf'. This activity is often associated with file masquerading or persistence techniques where malicious code is executed under the guise of legitimate-sounding system files.
This rule monitors for potentially malicious process activity characterized by either cmd.exe executing commands with PDF-related arguments, or specific executables often associated with installers or update mechanisms (GoogleUpdateStepup, AutoUpdate, AnyConnect-win) being executed or spawning processes. This behavior is indicative of potential application masquerading, software installer abuse, or malicious document execution.
This rule detects when 'SystemSettings.dll' is loaded by a process other than the legitimate 'SystemSettings.exe' located in the Windows ImmersiveControlPanel directory. This behavior can be indicative of DLL hijacking or unauthorized code injection into a system-level component.
Detects anomalous activity associated with the SharkLoader malware, which masquerades as the legitimate Windows SystemSettings.exe process. The rule identifies suspicious characteristics such as execution from non-standard directories (AppData), use of MinHook for API hooking, loading of known payload-related files (syncres.dat, dsccorer.mui), and unauthorized remote thread creation.
This rule detects potentially malicious behavior where a PDF reader or command-line utility (executing a PDF) spawns msiexec.exe shortly after, when the parent process is running from a suspicious directory (e.g., AppData, ProgramData, or other temp locations). This pattern is commonly associated with dropper activity where a malicious PDF is opened and subsequently triggers an MSI installer to deploy malware.
Detects common system binaries and command-line tools spawned by or from a parent context containing 'autogenstudio'. This behavior may indicate an attacker leveraging the AutoGenStudio framework for post-exploitation, reconnaissance, or command execution.
Detects the loading of DLLs from suspicious locations such as AppData, Temp, or ProgramData into common browser processes. This activity is often associated with process injection techniques like Cobalt Strike's keylogging jobs or other credential theft attempts.
Detects the execution of wusvc.exe (Windows Update Service) from suspicious file paths or when associated with user, host, or directory names containing keywords like 'sandbox', 'malware', 'virus', or 'sample'. This behavior is indicative of potential masquerading or the analysis of malicious samples.
Detects potential Cobalt Strike Beacon behavior where a process originating from AppData or ProgramData injects into a legitimate Windows process (e.g., svchost.exe, explorer.exe, notepad.exe, msiexec.exe). This is followed by the injected host process establishing an outbound HTTPS network connection to an external, non-RFC1918 IP address within 60 seconds.
Detects the execution of wusvc.exe (Windows Update service) from non-standard locations, specifically the user Downloads folder or locations other than the authorized C:\Windows\System32\ directory. This pattern is commonly used to masquerade malicious payloads as legitimate system services.
Detects the execution of cmd.exe or powershell.exe where the command line contains references to the Avast directory. This behavior may indicate an attempt to tamper with, interact with, or bypass security software components.
Detects the execution of PowerShell (powershell.exe or pwsh.exe) using a combination of arguments and commands commonly associated with script obfuscation or file-less execution patterns. This includes the use of ReadAllText for file reading, environment variable manipulation, and common execution aliases (iex/Invoke-Expression) combined with the -nop (NoProfile) flag.
Detects the GT_NET or Gt_net executable calling the VirtualProtectEx API to modify memory permissions to PAGE_EXECUTE_READWRITE. This behavior is a common indicator of process injection, where an attacker modifies memory to execute shellcode or malicious payloads within the context of a legitimate process.
Detects the execution of 7-Zip (7za.exe) with specific command-line arguments that include a password, a specific data file (data2.bin), and references to Avast antivirus. This pattern is indicative of potential unauthorized data staging or decryption operations, possibly involving malicious archives intended to bypass security controls.
Detects the execution of notepad.exe where the command line arguments reference a file named 'HowToRestoreFiles.txt'. This behavior is characteristic of ransomware variants that launch Notepad to display instructions to victims after file encryption has occurred.
Detects instances where a process command line includes both 'base64' and '.env', indicating potential encoding of sensitive .env files. Attackers often encode these files before exfiltration to bypass basic Data Loss Prevention (DLP) string matching and obscure the data.
Detects the installation or execution of ScreenConnect originating from the Azure Run Command extension context. This indicates potential unauthorized remote access tool deployment.
Detects execution of native Go binaries associated with the Overlord C&C framework (UNK_DeadDrop). The detection logic specifically looks for process events where the filename starts with 'google-update-support-' and contains either 'amd64' or 'arm64', indicating architecture-specific binaries.
Browser extension wallet discovery
Cortex XDR
This rule detects command-line activity that searches for sensitive information within browser extension storage, specifically targeting data related to cryptocurrency wallets, password managers, or authenticator applications. It looks for commands executed by common interpreters like cmd, PowerShell, or Python that include keywords associated with extensions and sensitive data like 'wallet', 'metamask', 'password', 'authenticator', '2fa', or 'crypto'. The rule is designed to provide causality and actor information for investigation.
Detects regsvr32 with silent, unregister, or scriptlet options referencing a remote or user-writable resource. This behavior is often associated with malware like InstallFix to execute malicious code.
Detects a banking trojan (Banana RAT) attempting to intercept or replace PIX QR payment data from the clipboard, browser, or screen content. The rule looks for processes with names indicative of the RAT (banana, client, update, service) and command-line arguments related to PIX, QR codes, or clipboard manipulation.
Page 58 of 100