Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,695
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects a suspicious sequence of Microsoft-signed .NET binaries (regsvcs.exe, installutil.exe, msbuild.exe, aspnet_compiler.exe) spawned by a single parent process in a short timeframe. This behavior is indicative of an attacker cycling through multiple trusted binaries in a fallback strategy to bypass application allowlisting or endpoint protection controls.
Detects the termination of 'wscript.exe' using 'taskkill.exe' or PowerShell 'Stop-Process'. This behavior is commonly used by malicious loaders to stop script-based execution after a payload has been staged or executed to minimize forensic artifacts and potential detection by defenders monitoring long-running processes.
Detects the Windows Script Host (wscript.exe or cscript.exe) executing files with suspicious double extensions, specifically those mimicking PDF documents (e.g., .pdf.js) or utilizing the .jse extension. This pattern is commonly associated with fileless initial execution lures, often seen in ClickFix-style or VEIL#DROP campaigns designed to trick users into executing malicious scripts.
Detects the use of database or archiving command-line utilities to export data related to RADIUS services. The rule filters out known backup service accounts and authorized backup processes, flagging activity that occurs outside of standard business hours or is performed by accounts not explicitly designated for administrative or database maintenance tasks.
Detects file artifacts referencing OtterCandy malware, which combines OtterCookie and RATatouille RAT capabilities, associated with WaterPlum/Contagious Interview campaign
Detects file artifacts referencing OtterCandy malware, which combines OtterCookie and RATatouille RAT capabilities, associated with WaterPlum/Contagious Interview campaign
Detects persistence attempts related to the NetSupport Manager remote access tool by monitoring modifications to Windows Registry keys associated with run keys, Winlogon notification packages, and services.
Detects the creation or modification of a registry value containing 'SnapCart', which is associated with the persistence mechanism of the SparroWocky backdoor.
Detects the creation or modification of a registry value containing 'SnapCart', which is associated with the persistence mechanism of the SparroWocky backdoor.
Detects PE binaries that are either signed with Discord Inc. certificates but do not contain expected Discord metadata, or binaries that are signed with Lenovo certificates but contain indicators (e.g., 'DocSend') that suggest unauthorized use. It also detects any binaries claiming to be signed by these entities that contain invalid or untrusted signatures, identifying attempts to bypass security controls using stolen or spoofed certificates.
Detects the creation or modification of a browser extension 'manifest.json' file that requests both 'declarativeNetRequest' and 'contentScripts' permissions. These permissions are frequently associated with browser-based session hijacking, traffic redirection, and unauthorized data injection, common in malicious extensions.
Detects various persistence methods associated with NetSupport Manager, a legitimate remote management tool often abused by threat actors. The rule monitors for the installation of NetSupport components (specifically client32.exe) in Windows registry run keys, Winlogon configuration, service creation, and keyboard filter drivers.
Detects instances of the Comet AI agent (comet.exe) accessing files on the local filesystem outside of expected directories such as the browser's download directory, application profile, or temporary folder. This behavior is indicative of a compromised or malicious agent attempting to exfiltrate or interact with arbitrary local files.
Detects components associated with the SparroWocky trident loader, specifically targeting side-loaded DLLs (DukeQt.dll or winfsp-x64.dll) and .dat data containers that contain a specific magic value (0x11328712) and RC4 strings, indicating in-memory payload decryption and mapping.
Detects a process re-launching itself with a specific command-line argument format (a single 's' character followed by a numeric session ID). This behavior is characteristic of the SparroWocky malware, which enumerates user sessions and spawns a new backdoor instance under a different session using CreateProcessAsUserW after duplicating the target session's token.
Detects the Chrome process attempting to programmatically modify the Windows CapabilityAccessManager ConsentStore registry keys for microphone or webcam access. This behavior is indicative of unauthorized programmatic access to system audio/video peripherals, often associated with browser-based AI agent hijacking or malicious extensions attempting to bypass user interaction requirements.
Detects high-frequency loading of core Windows GDI libraries (gdi32.dll, gdi32full.dll, user32.dll) by the ProcAuditManager.exe process, which is indicative of screen capture activity associated with the SparroWocky malware's persistence and data exfiltration capabilities.
This rule detects repeated PowerShell executions using 'Start-Process' with the 'RunAs' verb and hidden window styles. The detection specifically looks for high-frequency occurrences of these commands within a tight 18-25 second window on the same host, which is characteristic of certain automated execution or privilege escalation attempts.
Detects instances where a process is created with a session ID that differs from its parent process, which is indicative of token manipulation or impersonation techniques like those observed in SparroWocky. The rule looks for cross-session process creation using the CreateProcessAsUserW API or specific command-line argument patterns.
Detects a multi-stage PowerShell execution pattern often associated with 'ClickFix' or similar social engineering lures, where a base64-encoded or obfuscated command is used to invoke malicious network downloads (IEX, WebClient, DownloadString). The rule further correlates these execution patterns with potential persistence mechanisms, specifically monitoring modifications to Windows startup locations or Run keys.
Detects reflective memory mapping and reflective code loading activities consistent with the SparroWocky payload. The rule identifies suspicious memory configurations, specifically executable and writable (RWX) memory regions that are not backed by a corresponding file on disk, often associated with memory-only execution techniques. It also monitors for execution artifacts related to NtMapViewOfSection or reflective loading keywords.
Page 93 of 465