Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,087 detections
Filters
Last updated
All Time
Detection languages
937
671
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
210
171
Platforms
1,856
493
300
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,087
MITRE Techniques
760
704
336
308
240
CVEs
8
7
6
6
6
IDS Protocols
1
Detects IP geolocation lookups used to gather target network information
This rule detects the registration of a Vectored Exception Handler (VEH) by specific process names (gt_net.exe, grixba) or processes running from suspicious paths (e.g., C:\Users\Public\Music). This behavior is associated with the Grixba component of Play ransomware, which uses VEH for anti-debugging and execution hijacking.
This rule detects potentially malicious activity associated with process injection, specifically identifying memory regions allocated as Read-Write-Execute (RWX) or the loading of sensitive DLLs (amsi.dll, wldp.dll) from unbacked memory regions, which is a common indicator of process injection or shellcode execution.
This rule detects indicators of the Grixba v2/v3 ransomware group, specifically identifying the presence and execution of sideloaded XOR-encrypted payloads (inf_g.dll) and the utilization of specific reconnaissance file staging paths within C:\Users\Public\Music\, including the identification of malicious binaries masquerading as gt_net.exe.
Detects the creation of files with a '.vile' extension within the Google Chrome extensions directory. This directory path is often used by attackers to install unauthorized or malicious browser extensions to maintain persistence, steal credentials, or pivot within the browser session.
Detects the execution of VILE ransomware by identifying specific dropped file artifacts (vile_icon.ico, vile_deadlines.json, vile_user_files.zip) and correlating these file events with outbound network connections made by the same process to remote non-private IP addresses, indicating the likely exfiltration of harvested system metadata.
Detects the execution of 'moladb_hash_crack.py', a script known to be used by the MuddyWater APT group for credential operations, specifically hash cracking. This rule identifies process command lines containing the script's filename.
Identifies execution of 'c2_fixed.py' or 'c2_fixed_v2.py' used in MuddyWater C2 operations. These scripts are associated with the MuddyWater threat group for command and control activities.
Detects 'gp_v6_exec.py', a script automating GodPotato privesc for MuddyWater. This rule specifically looks for the execution of this Python script via its command line.
Detects network activity initiated by the 'PerfWatson2.exe' process, which is associated with the TinyRCT .NET backdoor, communicating with a known malicious C2 IP address (45.32.113.172). The rule monitors for network connections from this specific binary to the identified infrastructure, indicative of beaconing or command and control activity.
Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) spawns a command shell (cmd.exe) or PowerShell (powershell.exe, pwsh.exe). This behavior is highly suspicious as it often indicates a web application compromise or exploit attempt where an adversary has gained remote code execution.
Detects execution of cmd.exe with specific arguments involving 'choice' and 'PerfWatson2.exe', commonly used for stalling or delaying execution, often as a technique to facilitate anti-analysis or to allow time for subsequent malicious actions during a process lifecycle.
Detects the execution of rar.exe with command line arguments indicating the creation of a new archive (-a) and the use of the -k switch. The -k switch in RAR is often used to lock an archive, preventing further modifications, which is a technique sometimes used by adversaries to preserve staged data for exfiltration.
Detects execution of potentially masqueraded processes or the creation of suspicious files, including specific DLLs, configuration files, and activity within VMware folders, often indicative of staging malicious payloads or side-loading attempts.
This rule detects the execution of Node.js or Bun JavaScript runtime processes with command-line arguments often associated with CI/CD automation, dependency updates, or potential obfuscated script execution patterns.
Detects instances where a node.exe process attempts to open sensitive browser files such as 'Login Data' or 'Cookies', which are common targets for credential theft. Additionally, it monitors for network communication (DNS requests or HTTP connections) to the domain 'stitch-production.org', which may be a command and control (C2) endpoint.
Detects the execution of specific binaries (vmtools.exe, vmwared.exe, XDRAgent.exe) from the C:\ProgramData\VMware directory. This path is often used by adversaries to masquerade malicious files or execute tools from a directory that might be excluded from security scanning.
Detects common credential dumping techniques targeting the LSASS process memory, including the execution of Mimikatz, use of 'sekurlsa::logonpasswords', and memory dumps using comsvcs.dll or procdump.
Detects the presence of Windows Media Player or Mixed Reality process executions in conjunction with the creation of a specifically named DLL (nvdaHelperRemote.dll) within the Windows Media Player directory, which is a common indicator of DLL side-loading or hijacking techniques targeting these applications.
Detects specific suspicious executables that load the Antimalware Scan Interface (AMSI) library (amsi.dll). This pattern is often indicative of attempts to disable or bypass AMSI scanning, commonly seen in malicious loaders or tools aimed at evading security monitoring.
Detects endpoint activity associated with the Operation DragonReturn phishing campaign, including DNS resolution of known malicious domains, download of specific malicious ZIP archives, execution of extracted dropper files, and network communication with identified command-and-control infrastructure.
Page 59 of 100