Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,085 detections
Filters
Last updated
All Time
Detection languages
937
669
245
95
67
Contributors
798
791
99
59
31
Categories
1,168
1,065
225
208
171
Platforms
1,854
491
298
26
12
Products / Services
10,670
9,758
6,693
4,421
3,749
2,085
MITRE Techniques
760
704
336
308
238
CVEs
8
7
6
6
6
IDS Protocols
1
This rule detects the execution of 'ADNotificationManager.exe' or a process with 'ADNotificationManager.exe' as its original filename. It specifically excludes processes where the image filename contains 'acrobat' or 'reader'. This pattern is often associated with DLL side-loading techniques, where a legitimate application (like ADNotificationManager.exe) is used to load a malicious DLL.
This rule detects when 'offreg.dll' is loaded by an application that is not located in common, legitimate Windows or program files directories. 'offreg.dll' is a legitimate Windows DLL related to offline registry manipulation. Its loading by unusual applications outside of expected system paths could indicate an attempt at DLL hijacking, persistence, or other malicious activity, as adversaries might use it to load their own malicious code or manipulate the registry. The rule explicitly excludes known legitimate paths to reduce false positives.
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
This rule detects PowerShell commands that are used to enumerate locale-related system information. Specifically, it looks for PowerShell or pwsh.exe processes executing commands containing keywords like 'InstalledUICulture', 'Get-UICulture', 'CurrentUICulture', 'CurrentThread.CurrentUICulture', 'DefaultThreadCurrentUICulture', 'OSLanguage', or 'MUILanguages'. This activity can be indicative of an adversary attempting to gather system configuration details, potentially for environmental awareness or to tailor subsequent actions.
This rule detects the execution of processes related to 'Netbird', a peer-to-peer VPN solution that can also be used for remote access and management. It specifically looks for 'netbird' in the image file name, original file name, or parent base file name of a process on Windows platforms. Detection of this activity could indicate the legitimate use of Netbird for remote access or, in a malicious context, the deployment of a remote monitoring and management (RMM) tool by an adversary.
Detects PowerShell queries against the root/SecurityCenter2 namespace to discover installed Antivirus products. This technique is often used by malware, such as EtherRAT's SYS_INFO module, to map defensive tooling and understand the security posture of a compromised system.
This rule detects the creation of a PowerShell or Pwsh process with its window style set to minimized. Adversaries often use this technique to hide their activities from the user, making it a potential indicator of malicious PowerShell execution.
This rule detects DNS requests to the domain 'cloud.es.io'. This domain is associated with Elastic Cloud, and unusual traffic to it could indicate potential data exfiltration, command and control activity, or unauthorized access to Elastic Cloud resources. The rule specifically looks for the 'DnsRequest' event type in raw Falcon data and filters for the specified domain name, then outputs relevant host and network information.
This rule detects instances where 'dllhost.exe' is spawned by an unusual parent process. Typically, 'dllhost.exe' is spawned by 'svchost.exe' or 'services.exe'. The rule specifically looks for 'dllhost.exe' processes whose parent is neither 'svchost.exe' nor 'services.exe', indicating a potentially malicious or unexpected execution chain.
This rule detects the execution of 'lockapphost.exe' when its parent process is not 'svchost.exe'. 'lockapphost.exe' is a legitimate Windows process responsible for displaying the lock screen and login UI. If it is spawned by an unusual parent process, it could indicate an attempt to bypass the lock screen or manipulate user interface components for malicious purposes, potentially related to persistence or defense evasion.
This rule detects the execution of IOBitUnlocker.exe with the '/delete' command-line argument. IOBitUnlocker is a legitimate tool that can be used to unlock and delete files that are otherwise in use or locked by the operating system. Adversaries may weaponize such legitimate tools to delete files, potentially for data destruction, indicator removal, or to hinder forensic analysis.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This rule detects suspicious activity involving the writing of both DLL and EXE files to the same path, followed by process masquerading (where the file name differs from the original file name) and subsequent DLL side-loading. It also attempts to identify the source URL if the Mark-of-the-Web (MOTW) is present, indicating a downloaded file. The detection chain tracks the process that writes the files, the parent process that initiates the file write, the process that performs the DLL side-load, and finally the loaded DLLs themselves, including various module load telemetry classifications.
This rule detects the creation or modification of services, registry keys, or driver loads that exhibit characteristics associated with the ValleyRAT malware. Specifically, it looks for services or registry entries pointing to executables in common temporary directories (Users, ProgramData, Windows AppData\Local\Temp, or \Temp\) and driver loads from similar temporary paths. It also includes a specific check for drivers signed by 'Shandong Anzai Information Technology' and known SHA256 hashes associated with ValleyRAT. The rule excludes legitimate Symantec AV components and a Lenovo signed driver to reduce false positives.
This rule detects various indicators associated with the 'Fake Clawdbot VS Code Extension' malware, which is known to install the ScreenConnect Remote Access Trojan (RAT). Detection logic includes suspicious domain names, specific file names downloaded from those domains or Dropbox, known malicious IP addresses, specific SHA256 hashes of malicious files, outbound network connections on port 8041 (excluding common private/reserved IP ranges), ScreenConnect service installations/starts, and suspicious file writes or process executions from temporary directories related to ScreenConnect or 'Code.exe'.
This rule detects impossible travel scenarios for Azure logins by calculating the speed required to travel between two consecutive login locations for the same user. It flags logins where the calculated speed exceeds the maximum speed of a commercial passenger aircraft (900 km/h) and the logins originate from different countries. Mobile device logins are excluded to reduce false positives related to VPN usage.
This Logic detects the presence of the malicious Chrome extension FreeVPN[.]One by identifying its unique extension ID across installed browsers. The logic further correlates this presence with network communications initiated by the extension to suspicious or untrusted domains. By combining extension enumeration with traffic analysis, the detection ensures high fidelity with minimal false positives. This layered approach strengthens visibility into malicious browser add-ons masquerading as VPN tools.
Threat Hunt: RoKRAT Malware – Injection & Steganography 🛠 High‑Level TTPs Initial Access: Malicious .lnk files within compressed archives. Execution & Persistence: PowerShell/BAT‑driven staged loaders with XOR decryption. Defense Evasion: Process injection into trusted Windows binaries & payload concealment via steganography. Command & Control: Abuse of pCloud, Yandex Disk, and Dropbox APIs with embedded tokens to blend with legitimate traffic.
This rule detects suspicious activity involving the writing of both DLL and EXE files to the same path, followed by process masquerading (where the file name differs from the original file name) and subsequent DLL side-loading. It also attempts to identify the source URL if the Mark-of-the-Web (MOTW) is present, indicating a downloaded file. The detection chain tracks the process that writes the files, the parent process that initiates the file write, the process that performs the DLL side-load, and finally the loaded DLLs themselves, including various module load telemetry classifications.
This rule detects various stages of the Charon ransomware deployment and activity, including the writing of ransomware-related files to disk, malicious DLL side-loading, the deployment trigger, and the creation of ransom notes or service associated with Charon.
This rule detects various activities associated with the Kimsuky JavaScript dropper, including DNS requests to known malicious domains, creation of specific files (Themes.js, L298306.tmp), execution of certutil.exe or script.exe for decoding/encoding, suspicious command-line arguments for system information or task listing, and persistence mechanisms via scheduled tasks or registry modifications related to 'Themes.js' or 'Windows Theme Manager'.
Page 65 of 100