Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects unauthorized attempts to modify or patch the AmsiScanBuffer function within amsi.dll in a remote process. This behavior is indicative of an AMSI bypass attempt, a technique often used by malicious loaders and fileless malware to evade security product scanning.
Detects evidence of the PIVOTPIPE .NET loader attempting to disable AMSI scanning. The detection focuses on activity related to patching the 'AmsiScanBuffer' function within 'amsi.dll', specifically identifying the use of the hex signature '80070057' or direct references to the function name, which is an indicator of an AMSI bypass attempt performed to facilitate malicious code execution.
Detects the PIVOTPIPE loader extracting a 'sleepmask.o' Common Object File Format (COFF) file into a temporary directory prefixed with 'nb_'. This behavior is associated with the deployment of post-exploitation sleepmask functionality designed to obfuscate or encrypt beacon memory footprints to evade memory scanners.
Detects the presence of the known vulnerable DCRCVDrv.sys kernel driver, which has been identified as being abused in Bring Your Own Vulnerable Driver (BYOVD) attacks to terminate security processes via unauthorized IOCTL calls to ZwTerminateProcess.
Detects a specific execution pattern associated with the PIVOTPIPE RAT involving two consecutive operator-issued commands. First, a process impersonation action (token theft/impersonation) is detected via PROCESS_OPEN activity, followed by a 'RevertToSelf' call within the same process context. This sequence indicates an attempt to temporarily shift privilege context to impersonate another user before returning to the original security context.
Detects the execution of PowerShell with suspicious command-line arguments (e.g., WebClient, hidden flags, or WebDAV paths) spawned directly from browser processes like chrome.exe or msedge.exe. This pattern is commonly associated with fileless delivery techniques where an attacker attempts to download and execute scripts directly from an internet-facing source.
Detects execution of rundll32.exe with command line arguments containing WebDAV paths (DavWWWRoot), which is a common technique used to execute malicious DLLs from remote locations.
Detects instances of explorer.exe being launched by a parent process other than expected system processes (explorer.exe, userinit.exe, or winlogon.exe). This behavior is highly irregular for Windows desktop environments and may indicate process injection or malicious process masquerading.
Detects the execution of PowerShell commands intended to gather system information, such as OS details, boot time, or video controller configurations. These techniques are often used during the discovery phase to profile a target machine before further malicious actions.
Detects the creation of 'explorer.exe' originating from a source process other than known legitimate parent processes like 'userinit.exe', 'winlogon.exe', or 'services.exe'. This behavioral pattern is indicative of potential process hollowing or unauthorized process injection, which is a common vector for stealers like ZigCryptoStealer to gain a foothold before performing malicious activities such as clipboard manipulation.
Detects the creation or modification of Windows Registry Run/RunOnce keys or files within the Startup folder where the target command path is deemed suspicious (e.g., temp directories, ProgramData), utilizes known LOLBins, or contains common obfuscation flags (e.g., -enc, IEX, -w hidden) frequently associated with persistence mechanisms.
Detects the execution of mshta.exe with suspicious command-line arguments that indicate the loading of remote HTML Applications (HTA) via URLs or inline scripts (javascript/vbscript). This behavior is often indicative of fileless malware execution and living-off-the-land techniques to bypass security controls.
This rule detects potential ransomware activity by correlating the execution of native Windows utilities used to inhibit system recovery (vssadmin, wmic, wbadmin, bcdedit) followed by a high volume of file modification events on the same host within a 15-minute window.
Detects two distinct methods of living-off-the-land proxy execution: first, MSBuild.exe spawning network connections after executing inline tasks defined in XML project files; second, Regsvr32.exe performing 'Squiblydoo' execution by loading COM scriptlets from remote URLs.
Detects command-line execution patterns indicative of Anti-Malware Scan Interface (AMSI) bypass attempts. The rule looks for attempts to manipulate internal .NET AmsiUtils fields, modify AmsiScanBuffer, or utilize VirtualProtect against amsi.dll memory regions, all of which are common techniques employed by malicious loaders to evade script-based detection.
Detects the use of native Windows utilities (vssadmin, wmic, wbadmin, bcdedit) to delete volume shadow copies, backup catalogs, or disable recovery mechanisms. This behavior is commonly associated with ransomware or destructive attacks attempting to inhibit system recovery.
This rule detects the creation of named pipes with names that match default or commonly customized patterns used by Cobalt Strike Beacons for inter-process communication (IPC) and lateral movement. The detection specifically targets common pipe naming conventions such as those starting with 'msagent_', 'MSSE-', 'postex_', 'status_', and 'mypipe-', which are frequently observed in Cobalt Strike configurations.
Detects Microsoft Exchange Control Panel (ECP) worker process (w3wp.exe) spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are commonly associated with the exploitation of CVE-2020-0688. This vulnerability involves unsafe deserialization within the Exchange ECP ViewState handling, which allows an attacker to execute arbitrary code with SYSTEM privileges.
This rule detects potentially malicious child processes (cmd.exe or powershell.exe) spawned by PaperCut application processes (pc-app.exe, PCClient.exe, or java.exe), which may indicate exploitation attempts such as RCE following an authentication bypass.
Detects instances where the PaperCut application server process (pc-app.exe) or its underlying Java processes (javaw.exe or java.exe) spawn command-line interpreters such as cmd.exe or powershell.exe. This behavior is indicative of potential post-exploitation activity, specifically Remote Code Execution (RCE) via vulnerabilities targeting PaperCut servers.
Detects the execution of the AnyDesk remote support tool while Microsoft Teams is currently running. This pattern is often indicative of social engineering or tech support scams where an attacker convinces a victim to run remote access software during a call.
Page 71 of 465