Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,697
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects Microsoft Exchange Control Panel (ECP) worker process (w3wp.exe) spawning suspicious child processes (e.g., cmd.exe, powershell.exe, mshta.exe) that are commonly associated with the exploitation of CVE-2020-0688. This vulnerability involves unsafe deserialization within the Exchange ECP ViewState handling, which allows an attacker to execute arbitrary code with SYSTEM privileges.
Detects the loading of the Restart Manager DLL (rstrtmgr.dll) by suspicious processes, such as those running from writable user paths (e.g., Temp, AppData) or masquerading as numeric-only named executables. Adversaries may abuse this library for process termination or interaction to facilitate malicious operations, such as clearing file locks during deployment.
Detects the execution of PowerShell with hidden window style and long Base64 or encoded command strings, which is a common technique used by attackers to execute obfuscated malicious scripts while minimizing visibility on the endpoint.
Detects modifications to registry keys associated with the 'ms-settings' COM object, specifically targeting the shell open command or DelegateExecute value. This technique, commonly referred to as 'ms-settings' hijacking, is used by adversaries to achieve persistence or elevated execution by redirecting legitimate COM object references to malicious payloads.
Detects the initialization of known-malicious Terraform providers (dockerd) followed within one hour by the execution of a 'go run' process from the .terraform directory. This pattern is indicative of a supply chain compromise where an adversary leverages a typosquatted or malicious Terraform provider to facilitate the execution of a secondary payload.
Detects the initialization of known-malicious Terraform providers (dockerd) followed within one hour by the execution of a 'go run' process from the .terraform directory. This pattern is indicative of a supply chain compromise where an adversary leverages a typosquatted or malicious Terraform provider to facilitate the execution of a secondary payload.
Detects anomalous network traffic patterns from the legitimate 'rnpkeys.exe' process when side-loaded from the 'ProgramData\keyroll' directory. The rule specifically looks for a sequence of connections matching initial C2 registration (TLV 0x01) followed by consistent, periodic beaconing (TLV 0x02) at an interval indicating automated task polling, rather than single-connection legitimate activity.
This rule detects the creation of Windows Scheduled Tasks by monitoring for Event ID 4698 (Windows Security Log) or Sysmon Event ID 1 (Process Creation) that involves task name parameters. Adversaries frequently use the Windows Task Scheduler to establish persistence, execute malicious code, or run tasks at system startup.
This rule monitors the rnpkeys.exe process for suspicious environmental reconnaissance activity, specifically targeting locale/keyboard-layout registry queries or domain enumeration via command-line tools. These activities are identified as occurring in a strict temporal sequence (pre-registration check) shortly before an initial outbound network connection, consistent with the behavior of the Sauron loader malware.
Detects a specific staging and execution pattern where a payload file with a 6-16 character random filename is written to a temporary directory and subsequently executed by a common Windows handler process (such as rundll32, regsvr32, or powershell) within a 60-second window. This behavior is indicative of the Sauron Loader task-execution workflow.
Detects a specific staging and execution pattern where a payload file with a 6-16 character random filename is written to a temporary directory and subsequently executed by a common Windows handler process (such as rundll32, regsvr32, or powershell) within a 60-second window. This behavior is indicative of the Sauron Loader task-execution workflow.
Detects the execution of rnpkeys.exe from the path C:\ProgramData\keyroll\, which performs DLL side-loading by loading rnp.dll followed by tdwp.dll. This sequence is indicative of the Sauron Loader malware attempting to perform in-memory payload decryption.
Detects the Sauron Loader malware pattern where a payload is downloaded or retrieved and written to a randomly named file within a temporary directory, followed by the immediate execution of that staged file. This behavior is indicative of C2 tasking involving payload staging.
Detects the execution of staged scripts (.cmd, .ps1, .vbs, .js) from user temporary directories using cmd.exe, powershell.exe, or wscript.exe. This behavior is consistent with the Sauron Loader malware family, which utilizes these interpreters to execute secondary C2-tasked payloads.
Detects instances of process injection targeting the 'attrib.exe' process. This behavior is associated with the Sauron Loader, which performs in-memory shellcode execution by allocating memory and creating a remote thread within a legitimate process, such as 'attrib.exe', to avoid writing payloads to disk.
Detects the execution of staged payloads from the Windows %TEMP% directory. This rule monitors for suspicious activity often associated with loader-style C2 execution, including direct execution of randomly named files, proxy execution via rundll32 or regsvr32, silent MSI installations, and the execution of payloads extracted from archives in temporary locations.
Detects the execution of staged payloads from the Windows %TEMP% directory. This rule monitors for suspicious activity often associated with loader-style C2 execution, including direct execution of randomly named files, proxy execution via rundll32 or regsvr32, silent MSI installations, and the execution of payloads extracted from archives in temporary locations.
Detects activity associated with the Sauron Loader malware, specifically monitoring for the execution of rnpkeys.exe or loading of tdwp.dll, followed by a high volume of HTTPS POST requests to the same destination host, which is characteristic of chunked screenshot exfiltration.
Detects the loading of .NET Common Language Runtime (clr.dll) and System.Management.Automation.dll into a process that is not a recognized PowerShell binary (e.g., powershell.exe, pwsh.exe). This behavior is associated with the 'PSInline' technique used by SloppyRAT, where PowerShell capabilities are invoked directly via COM objects to execute commands in memory. The rule further correlates this activity with the creation of files with a .png extension in temporary directories, which is consistent with the exfiltration staging behavior of the malware.
Detects the suspicious execution of ServiceModelReg.exe or command lines containing the 'Elevation:Administrator!new:' string, which is associated with bypasses of Windows User Account Control (UAC). The rule excludes trusted system processes like msiexec, TrustedInstaller, and svchost to reduce noise.
Page 74 of 465