Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,764 detections
Filters
Last updated
All Time
Detection languages
3,724
2,041
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,231
485
Categories
5,723
3,080
1,138
901
659
Platforms
9,650
659
432
53
30
Products / Services
10,703
9,764
6,706
4,421
3,752
MITRE Techniques
3,828
3,377
1,982
1,618
1,042
CVEs
18
14
12
12
11
Detects the BlueMoon exploit kit's post-exploitation activity, specifically identifying when a Chromium-based browser process (chrome.exe or msedge.exe) initiates command-line tools such as cmd.exe, powershell.exe, or curl.exe to download and execute a secondary payload named 'msgbox.exe' within the user's temporary directory.
Detects a suspicious sequence of Git operations ('fetch' followed by 'checkout') executed within a 5-minute window, where the initiating process is a known AI-assisted development tool (Claude, Codex, Copilot, or Gemini). This behavioral pattern may indicate an attempt to use AI tooling to facilitate the unauthorized access or exfiltration of code repositories.
This rule detects the execution of specific suspicious binary names or processes loading a specific DLL from locations outside of the legitimate Windows System32 or SysWOW64 directories. This behavior is indicative of potentially malicious executables or side-loaded DLLs masquerading as system components or running from non-standard locations to evade detection.
Detects instances of an executable named msedge.exe running from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This is a suspicious location for a browser executable, often used by malware to masquerade as legitimate software to evade detection.
This rule detects processes manually resolving API function addresses by traversing the Process Environment Block (PEB) Ldr structure or parsing module export tables. This technique is often used by malicious code to resolve Windows API functions dynamically without relying on standard LoadLibrary or GetProcAddress calls, effectively evading common API-hooking based monitoring.
Detects the use of PowerShell to download files from Vultr Object Storage, specifically targeting patterns associated with the HEAVYGRAM malware distribution. The rule monitors for PowerShell cradles (WebClient, DownloadFile), archive extraction commands, or the execution of a specific payload name (RuntimeSSH.exe) often linked to the Handala Hack threat activity.
Detects instances where processes other than the legitimate Telegram Desktop application or its updater attempt to access files within the Telegram Desktop 'tdata' directory. This directory contains session information, which can be harvested by malicious actors to hijack user sessions or access sensitive information.
Detects the execution of a binary named 'msedge.exe' from within the 'Windows\Telemetry' directory. This behavior is indicative of the MovieReaper malware attempting to masquerade as the legitimate Microsoft Edge browser to evade detection and maintain persistence.
Detects instances where processes other than the legitimate Telegram Desktop application or its updater attempt to access files within the Telegram Desktop 'tdata' directory. This directory contains session information, which can be harvested by malicious actors to hijack user sessions or access sensitive information.
Detects the execution of a binary named 'msedge.exe' from within the 'Windows\Telemetry' directory. This behavior is indicative of the MovieReaper malware attempting to masquerade as the legitimate Microsoft Edge browser to evade detection and maintain persistence.
Detects the use of the undocumented NTAPI function EtwpCreateEtwThread within a thread creation call trace. This function is often abused by shellcode loaders to execute malicious code within a target process while attempting to evade standard EDR detection mechanisms.
Detects the execution of the MovieReaper malware loader, which masquerades as 'msedge.exe' within the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This technique is used to bypass anti-sandbox checks by respawning as a legitimate-looking process in a persistent location after initial environment analysis is completed.
Detects the execution of known malicious loader files associated with the MovieReaper campaign. The rule identifies processes based on specific MD5 hashes, or by detecting obfuscated naming conventions where an executable file is disguised as a movie file by appending excessive padding or specific descriptors to the filename, often used to bypass user suspicion when distributed via torrent repositories.
Detects a suspicious execution chain where wscript.exe spawns an encoded PowerShell process to download files from Vultr Object Storage. The rule specifically monitors for the download of decoy files (e.g., .pptx, .zip) followed by the execution of a file named RuntimeSSH.exe, which is associated with the HEAVYGRAM malware implant.
Detects the initialization of COFF object files within a process memory context, characteristic of the MovieReaper stage-2 implant. This rule identifies the invocation of a 'module_init' exported function, which serves as a common mechanism for executing Beacon Object Files (BOF) or similar in-memory command loading interfaces.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects unauthorized modification of the registry path 'HKCU\Software\Classes\ms-settings\Shell\Open\command'. This registry key is commonly hijacked by the 'fodhelper.exe' UAC bypass technique, where an attacker writes a malicious command to be executed with elevated privileges when the OS triggers the ms-settings protocol handler.
Detects modifications to the Windows RunMRU registry key that include suspicious strings such as 'powershell', 'curl', or long base64-encoded sequences. This behavior is indicative of the 'ClickFix' technique, where users are socially engineered to paste and execute malicious commands directly into the Windows Run dialog.
Detects attempts by PowerShell processes to modify the memory space of amsi.dll, a common technique used to bypass the Antimalware Scan Interface (AMSI) by patching its functions in-memory.
Detects the use of legitimate Windows administrative utilities (vssadmin.exe, wmic.exe, wbadmin.exe) to delete volume shadow copies or backup catalogs. This behavior is a common tactic employed by ransomware actors to inhibit system recovery and prevent restoration of encrypted data.
Detects the loading of rstrtmgr.dll by processes other than known Windows installers, update services, or explorers. The Restart Manager API is often abused by ransomware to terminate processes holding file locks, facilitating the encryption of files that would otherwise be in use.
Page 90 of 465