Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
462 detections
Filters
Last updated
All Time
Detection languages
298
91
19
18
17
Contributors
217
125
23
14
13
Categories
198
167
67
55
51
Platforms
363
165
83
10
7
Products / Services
10,665
9,773
6,705
4,421
3,749
462
MITRE Techniques
201
124
113
80
47
CVEs
4
3
3
2
1
Detects potential Cobalt Strike Beacon behavior where a process originating from AppData or ProgramData injects into a legitimate Windows process (e.g., svchost.exe, explorer.exe, notepad.exe, msiexec.exe). This is followed by the injected host process establishing an outbound HTTPS network connection to an external, non-RFC1918 IP address within 60 seconds.
Detects the execution of wusvc.exe (Windows Update service) from non-standard locations, specifically the user Downloads folder or locations other than the authorized C:\Windows\System32\ directory. This pattern is commonly used to masquerade malicious payloads as legitimate system services.
Detects instances where a process command line includes both 'base64' and '.env', indicating potential encoding of sensitive .env files. Attackers often encode these files before exfiltration to bypass basic Data Loss Prevention (DLP) string matching and obscure the data.
Detects the installation or execution of ScreenConnect originating from the Azure Run Command extension context. This indicates potential unauthorized remote access tool deployment.
Detects execution of native Go binaries associated with the Overlord C&C framework (UNK_DeadDrop). The detection logic specifically looks for process events where the filename starts with 'google-update-support-' and contains either 'amd64' or 'arm64', indicating architecture-specific binaries.
Detects IP geolocation lookups used to gather target network information
This rule detects the registration of a Vectored Exception Handler (VEH) by specific process names (gt_net.exe, grixba) or processes running from suspicious paths (e.g., C:\Users\Public\Music). This behavior is associated with the Grixba component of Play ransomware, which uses VEH for anti-debugging and execution hijacking.
This rule detects indicators of the Grixba v2/v3 ransomware group, specifically identifying the presence and execution of sideloaded XOR-encrypted payloads (inf_g.dll) and the utilization of specific reconnaissance file staging paths within C:\Users\Public\Music\, including the identification of malicious binaries masquerading as gt_net.exe.
Detects the execution of 'moladb_hash_crack.py', a script known to be used by the MuddyWater APT group for credential operations, specifically hash cracking. This rule identifies process command lines containing the script's filename.
Identifies execution of 'c2_fixed.py' or 'c2_fixed_v2.py' used in MuddyWater C2 operations. These scripts are associated with the MuddyWater threat group for command and control activities.
Detects 'gp_v6_exec.py', a script automating GodPotato privesc for MuddyWater. This rule specifically looks for the execution of this Python script via its command line.
Detects common credential dumping techniques targeting the LSASS process memory, including the execution of Mimikatz, use of 'sekurlsa::logonpasswords', and memory dumps using comsvcs.dll or procdump.
Identifies the creation or modification of the 'NvmProtocal' registry value within the CurrentVersion\Run key. This mechanism is used by the cross-platform infostealer associated with the compromised Mastra npm packages to maintain persistence across system reboots.
Detects command-line parameters indicating RPC calls to Ethereum/Polygon for C2 resolution, specifically looking for 'eth_call' and known blockchain service providers like 'drpc.org', 'tenderly', 'flashbots', or 'blastapi'. This activity is indicative of the EtherHiding malware.
Detects a multi-event sequence where shadow copy or backup deletion is rapidly followed by attempts to terminate security software. This behavior is indicative of ransomware, specifically Makop, attempting to hinder recovery and defense mechanisms.
Detects high-volume file modifications or renames performed by a single process over a short window, affecting many unique file paths. This behavioral pattern is highly indicative of ransomware activity attempting to encrypt data for impact.
Detects the consequence of the BYOVD exploit: the sudden termination or crash of protected EDR/AV processes (MsMpEng.exe, Sense.exe, csrss.exe tampering) in conjunction with the loading of the 'EEDbg.sys' driver, which is associated with the EnCase BYOVD technique.
Detects the use of `wget` or `curl` to specifically target a GitHub API endpoint with a suspicious string, indicating an attempt to download initial stage malware or tools from a dead drop. This pattern is associated with supply chain attacks where GitHub is used as a temporary hosting for malicious components.
Detects unauthorized reading of the GitHub CLI hosts.yml file by processes other than standard development tools (gh, gh.exe, code). This activity could indicate an attempt to steal authenticated GitHub sessions, as the hosts.yml file contains sensitive GitHub authentication tokens.
Detects an environment where 'bun' is executing both the primary ('setup.mjs') and secondary ('execution.js' or 'bw_setup.js') payloads within an hour, indicating a potential supply chain attack.
Detects attempts to exfiltrate environment variables by piping the output of 'env' or 'printenv' commands into 'curl'. This technique can be used by adversaries, such as the Miasma malware, to quickly steal sensitive API keys or other credentials stored in environment variables.
Page 8 of 22