Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
462 detections
Filters
Last updated
All Time
Detection languages
298
91
19
18
17
Contributors
217
125
23
14
13
Categories
198
167
67
55
51
Platforms
363
165
83
10
7
Products / Services
10,665
9,773
6,705
4,421
3,749
462
MITRE Techniques
201
124
113
80
47
CVEs
4
3
3
2
1
This rule detects pre-payload beaconing activity associated with the Meow RAT malware. It covers both network-based detection (outbound HTTP POST to known C2 domains and paths) and endpoint-based detection. Endpoint detection includes 'curl' processes communicating with known C2 infrastructure, 'osascript' processes spawned in the context of 'curl' C2 communication, and 'curl' commands using specific flags ('-k', '-s') along with a known build hash. This activity typically occurs before the main destructive payload is delivered.
Detects processes invoking common Windows API functions typically used to detect the presence of debuggers (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess, GetTickCount) when these processes are executed from suspicious locations (such as specific AppData subdirectories) or masquerading as system binaries (SystemSettings.exe). These behaviors are commonly used by malware to detect analysis environments or debuggers and alter execution flow to evade detection.
This rule detects potential attempts to bypass the Antimalware Scan Interface (AMSI) by monitoring memory protection changes (VirtualProtect) targeting the AmsiScanBuffer function within the amsi.dll module. Attackers often modify this function's memory permissions to PAGE_EXECUTE_READWRITE to inject code or patch the function, effectively disabling AMSI scanning capabilities.
Modular remote access trojan associated with long-term espionage intrusions
Detects a MobaXterm credential decryption utility reading session configuration or registry data before SSH or RDP activity, indicating potential credential access for lateral movement.
Detects a sequence of events where a Protected Process Light (PPL) security process attempts to load a DLL from a non-standard path and then terminates shortly after. This pattern is a strong indicator of the EDRStartupHinder technique, where a critical system DLL is redirected to an invalid copy, causing the PPL process to fail its integrity check and self-terminate.
Detects VirtualProtect API calls that change the memory protection of ntdll.dll to PAGE_READWRITE. This behavior is commonly associated with EDR unhooking techniques where malware removes hooks placed by security products to monitor system API calls.
Detects process start events where the command line contains the specific string 'ShitSetupOn26126k'. This appears to be a specific indicator of compromise (IOC) related to a custom script or malware installation routine.
This rule detects network connections to common IP geolocation services such as ip-api.com, ipinfo.io, ipgeolocation.io, and bgpview.io. Adversaries may use these services to gather information about the victim's network, including IP addresses, geographical location, and network topology, which can aid in further targeting or reconnaissance efforts.
Detects a sequence of sensitive Windows API calls (AllocateAndInitializeSid, CheckTokenMembership, or ShellExecuteW with runas) occurring within the same process on a host. This behavior is indicative of privilege escalation attempts or unauthorized token manipulation, often observed in malicious processes attempting to elevate privileges or verify token permissions.
This rule detects the execution of command-line scripts (specifically .bat files) located within the user's AppData\Roaming directory. It specifically flags execution attempts associated with 'xupdate.bat' or files containing 'Traiolx Custom Utils'. This activity is characteristic of malicious persistence or background utility execution often seen in various malware strains that attempt to camouflage their operation within user profile directories.
This rule detects potentially malicious activity where msiexec.exe is used to drop payloads or cmd.exe is used to execute batch scripts located within the user's AppData Roaming directory. This pattern is commonly associated with malware staging and execution, including specific indicators linked to LegionLoader.
This rule detects potential BeepRat malware activity by monitoring for specific file names associated with the threat, combined with reconnaissance behaviors. The rule identifies processes performing system information discovery, specifically machine identification (GetHWID), hardware metrics (ProcessorCount, DriveInfo), and cryptographic operations (MD5CryptoServiceProvider) which are commonly used in the initial stages of malware execution to profile target systems.
Detects instances where image processing utilities (ImageMagick's magick.exe or convert.exe) launch Ghostscript binaries (gs, gswin64c.exe) from non-standard directories (such as temp, user profile, or appdata folders) or utilize suspicious command-line arguments that attempt to bypass security policies. This activity is often associated with exploitation of image processing vulnerabilities where attacker-supplied files trigger arbitrary command execution.
Detects the execution of commands used to parse /etc/hosts for PeopleSoft-related node names (WEB, APP, csprd) for lateral movement targeting. Threat actors (e.g., ShinyHunters) use this to discover internal application and web servers.
Detects the creation of specific file names ('oBKhrQLe1CKmO3RhHO', 'logs.txt', 'ExitCode.txt', 'Key10.txt') within the user AppData Local Temp directory, which is indicative of staging or logging activity by potential malware.
Detects unauthorized access to web browser sensitive files, including credential stores, cookies, and local state files, by processes other than standard browsers or their update mechanisms. This rule also flags access to specific staging directories or archive files associated with known malicious activity.
Detects execution of the EDRUnChoker remediation tool, useful for situational awareness. This rule specifically looks for the command line containing 'Install-EdrChokerWmiDefense.ps1', indicating the execution of a PowerShell script related to EDR evasion or manipulation.
This rule detects potentially malicious behavior where a PDF reader or command-line utility (executing a PDF) spawns msiexec.exe shortly after, when the parent process is running from a suspicious directory (e.g., AppData, ProgramData, or other temp locations). This pattern is commonly associated with dropper activity where a malicious PDF is opened and subsequently triggers an MSI installer to deploy malware.
Detects common system binaries and command-line tools spawned by or from a parent context containing 'autogenstudio'. This behavior may indicate an attacker leveraging the AutoGenStudio framework for post-exploitation, reconnaissance, or command execution.
Detects the execution of wusvc.exe (Windows Update Service) from suspicious file paths or when associated with user, host, or directory names containing keywords like 'sandbox', 'malware', 'virus', or 'sample'. This behavior is indicative of potential masquerading or the analysis of malicious samples.
Page 7 of 22