Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,264 detections
Filters
Last updated
All Time
Detection languages
664
209
126
82
71
Contributors
423
267
143
83
79
Categories
670
317
260
116
95
Platforms
1,247
10
5
4
4
Products / Services
10,665
9,773
6,704
4,421
3,749
1,264
MITRE Techniques
530
447
414
334
275
CVEs
5
5
4
4
4
IDS Classtypes
1
IDS Protocols
1
Detects a suspicious behavior chain characteristic of information stealers like Vidar. The process first modifies the Windows Registry to disable the Windows Error Reporting (WER) UI (an anti-analysis technique to suppress crash dialogs) and shortly thereafter initiates an outbound network connection to a public IP, likely for C2 communication or data exfiltration.
Detects the creation of a Windows service that points to a .sys file located in common temporary directories (Temp, Windows\Temp). This behavior is characteristic of adversaries attempting to load malicious kernel drivers, often for persistence or privilege escalation, such as in Bring Your Own Vulnerable Driver (BYOVD) attacks.
Detects the installation of a new Windows service where the executable path is located in suspicious or uncommon directories (e.g., Temp, Users, AppData) or uses known living-off-the-land binaries (LotLBin) in the command path. This pattern is commonly used by adversaries for persistence and privilege escalation.
Detects a dual persistence mechanism where an adversary establishes both an identically-named Registry Run key and a Scheduled Task, both masquerading as legitimate Canon or Stardock configuration software. These artifacts are configured to launch side-loaded host binaries (COTFileReadApp.exe or DeElevate64.exe) to maintain persistence on a Windows host.
Detects the execution of 'gitlab-runner.exe' with command-line arguments indicative of runner registration, configuration file interaction, or process execution. This activity may be indicative of legitimate CI/CD pipeline setup or potential persistence mechanism installation if performed by unauthorized accounts.
Detects a sequence of activity characteristic of lateral movement and credential theft: the deployment or execution of PsExec service followed by the use of Windows utilities (vssadmin, ntdsutil, esentutl) to perform Volume Shadow Copy-based extraction of the NTDS.dit database or SYSTEM hive on the same host.
Detects the creation or execution of a scheduled task masquerading as a Microsoft Update process. The task is configured to execute potentially malicious components, specifically identified by filenames such as userscreen.exe, UserInerfacePicture, or config.cat. This behavior is indicative of persistence and execution of malicious payloads, as seen in campaigns involving the NarwhalRAT loader.
Detects evidence of potential adversarial interference with Windows Defender updates and MRT.exe (Malicious Software Removal Tool). The rule correlates high volumes of temporary file creation in user directories with unauthorized access to MRT.exe by third-party processes and repeated Windows Defender update failures, indicating a potential attempt to disrupt endpoint security operations.
Detects the creation of new services consistent with PsExec or PAExec lateral movement. The rule monitors for Windows Event IDs 7045 and 4697 where the service name uses common PsExec/PAExec naming conventions or the image path points to suspicious locations such as admin shares or temporary directories often used by these tools for binary staging.
Detects the loading of known-vulnerable signed drivers typically associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks. These drivers are frequently abused to gain kernel-mode privileges, allowing attackers to disable or terminate EDR, antivirus, and other security processes.
Detects msiexec.exe execution with flags intended for silent or standard installation when the source path points to a remote web resource (HTTP/HTTPS) or a UNC path. This behavior is indicative of using the native Windows Installer to proxy the download and execution of arbitrary, potentially malicious, MSI packages.
Detects instances where FortiClient EMS management daemon processes (FCMDaemon.exe, FortiClient_Server.exe, or FCMWebServer.exe) spawn suspicious child processes often associated with living-off-the-land techniques, such as command shells, scripting interpreters, or system administrative utilities.
This rule detects the loading of a driver named 'eb.sys' (or matching a specific SHA256 hash) paired with the creation of a Windows service for that driver via the 'sc' command. This behavior is indicative of potential rootkit installation or driver-based persistence mechanisms.
This rule detects the creation or registration of scheduled tasks using common scripting engines (PowerShell, WScript, CScript) or specific task name patterns (MicrosoftEdgeUpdateTaskCore, PhotoStudio.js) often associated with malicious persistence or execution. It monitors command lines for flags such as /create, /sc onlogon, or /ru system that suggest non-standard or unauthorized task creation patterns.
Detects the execution of 'ReportDump.exe' from within the 'C:\ProgramData' directory when initiated by system processes associated with scheduled tasks (svchost.exe, taskeng.exe, schtasks.exe) containing 'Schedule' in the command line. This behavior is indicative of potential persistence mechanisms or malicious file execution using legitimate Windows scheduling utilities.
Detects the installation or registration of the legitimate gitlab-runner.exe binary as a persistent Windows service. Adversaries can leverage this technique to establish a command-and-control (C2) channel or persistent backdoor by masquerading as legitimate CI/CD infrastructure.
Detects the creation of a suspicious scheduled task named 'MicrosoftMusicLibrariesPackageTaskMachine' and the execution of 'codeflush.exe' involving 'settingenv.cat'. These activities are associated with persistence and defense evasion techniques often used by malicious actors.
Detects the creation or execution of a scheduled task named 'MicrosoftMusicLibrariesPackageTaskMachine' and the invocation of specific associated file names 'codeflush.exe' or 'settingenv.cat', which are indicators of persistence used by the threat actor APT37.
Detects a sequence of activity characteristic of lateral movement and credential theft: the deployment or execution of PsExec service followed by the use of Windows utilities (vssadmin, ntdsutil, esentutl) to perform Volume Shadow Copy-based extraction of the NTDS.dit database or SYSTEM hive on the same host.
Detects a sequence of activity characteristic of lateral movement and credential theft: the deployment or execution of PsExec service followed by the use of Windows utilities (vssadmin, ntdsutil, esentutl) to perform Volume Shadow Copy-based extraction of the NTDS.dit database or SYSTEM hive on the same host.
Detects the mass termination of security, backup, database, and virtualization services and processes. The rule monitors for the use of 'taskkill', 'sc', and 'net stop' commands, targeting a list of processes and services often associated with pre-encryption cleanup activities by ransomware actors to neutralize security tools and data access controls.
Page 6 of 61