Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the creation of scheduled tasks using the 'schtasks.exe' utility with either system-level privileges ('/ru SYSTEM') or persistent triggers ('/sc onlogon' or '/sc onstart'). The rule filters out commonly trusted parent processes, highlighting potential persistence mechanisms established by unauthorized or unusual processes.
Detects the abuse of native Windows binaries Regsvr32.exe and Rundll32.exe to execute code from remote sources. Regsvr32 is monitored for 'Squiblydoo'-style execution where scrobj.dll is used to execute remote scriptlets via a URL. Rundll32 is monitored for loading DLLs from remote UNC/WebDAV paths or HTTP URLs, which is a common pattern for proxying malicious code execution to bypass local security controls.
This rule detects potentially malicious behavior in package manager post-install scripts (npm, pip). It monitors for child processes like shells, network utilities (curl, wget), or command-line arguments indicative of credential harvesting (e.g., accessing .ssh, .aws/credentials, environment variables) initiated by package management processes.
Detects the clearing of Windows Event Logs via wevtutil, PowerShell, or registry modification, occurring within one hour of a remote interactive or network logon event on the same host. This pattern is indicative of anti-forensic activity often performed following lateral movement or prior to destructive actions like ransomware deployment.
Detects suspicious PowerShell command execution patterns commonly associated with malicious activities, including base64-encoded commands, download cradles used to fetch external content, and various obfuscation techniques like character concatenation or backtick escaping to hide malicious intent.
Detects the creation of a remote service (Event ID 7045 or 4697) on a Windows host shortly after a remote SMB logon. The detection specifically looks for service binary paths associated with well-known lateral movement tools like PsExec (PSEXESVC), the ADMIN$ network share, or randomized executable names within the Windows Temp directory, which are common artifacts left by tools such as Impacket psexec.py and CrackMapExec.
Detects unauthorized modifications to Windows Registry Run/RunOnce keys or the Startup folder. The rule specifically targets persistence attempts where the associated process resides in suspicious directories (Temp, AppData) or uses command-line arguments indicative of script execution (powershell, wscript, mshta, encoded commands, or script extensions). It excludes known legitimate installer behavior involving msiexec or setup processes.
Detects anomalous Kerberos service ticket (TGS) requests or successful logons where the corresponding Ticket Granting Ticket (TGT) request (Event ID 4768) is absent within the monitored window. This pattern is a primary indicator of offline-forged Kerberos tickets, such as those generated by Mimikatz, which bypass legitimate KDC interaction for ticket issuance.
This rule detects the suspicious execution of rundll32.exe or regsvr32.exe, which are commonly abused as Living-off-the-Land Binaries (LOLBins). It identifies potential malicious activity by analyzing command-line arguments for patterns like remote URL requests, usage of scrobj.dll, JavaScript protocols, or specific Squiblydoo attack patterns. Additionally, it monitors for these binaries being executed by parents other than explorer.exe, which is indicative of potential process injection or proxy execution.
This rule detects potential RDP brute force and password spraying attacks by correlating Windows Event ID 4625 (failed logins) and 4624 (successful logins) via RDP (Logon Type 10). It monitors for high volumes of failed attempts across multiple accounts or high volume of failed attempts from a single source, followed by successful authentication from the same source.
This rule detects potential lateral movement indicative of PsExec or similar administrative tools. It identifies the combination of remote service installation (often using ADMIN$ or Temp paths), access to administrative shares (ADMIN$ or C$), and the execution of a process spawned by services.exe, which is characteristic of the remote service control manager performing remote service starts.
Detects anomalous lateral movement behavior characterized by an account performing multiple NTLM authentication events (Logon Type 3) across distinct hosts within a short time window, specifically where Kerberos pre-authentication is absent. This pattern is frequently observed in Pass-the-Hash (PtH) attacks where attackers utilize stolen NTLM hashes to move laterally.
Detects the execution of known, signed legitimate binaries (COTFileReadApp.exe or DeElevate64.exe) from user-writable directories, such as %LOCALAPPDATA%\Programs\. This behavior is a common indicator of DLL sideloading, where adversaries utilize a trusted, signed application to execute malicious code by placing a malicious DLL in the same directory as the executable.
Detects the creation of a Windows scheduled task named 'psychedelicloveUtils' using schtasks.exe, which is indicative of persistence mechanisms employed by the Psychedelic Stealer malware following installation.
Detects the execution of rundll32.exe or regsvr32.exe where the command line arguments reference a DLL that was recently written to the disk on the same host. This behavior is indicative of a RAT or malware dropping a secondary payload (DLL) and immediately executing it using built-in Windows binary proxies to bypass security controls.
Detects sophisticated in-memory loader activity characterized by a sequence of events: process module loads involving AMSI patching (amsi.dll), fresh ntdll.dll remapping to bypass EDR hooks, and the enumeration of hypervisor-related drivers or services, often associated with advanced payload execution chains like ClickFix.
Detects Microsoft Installer (MSI) files associated with the psychedelic stealer malware family. The rule identifies MSI components that contain embedded paths to the psychedeliclove.exe payload, specific command and control IP/port combinations, and decoy file names (e.g., MsMpEng.exe or explorer.exe) used to disguise the malware installation or execution process.
Detects the execution of PowerShell commands that reflectively load .NET assemblies into memory, followed immediately by a process injection event targeting Chromium-based browsers (e.g., chrome.exe) or Firefox. This behavior is highly characteristic of credential harvesting tools like BoundSiphon, which injects code into browser processes to decrypt and extract App-Bound encryption keys.
Detects a credential-theft pattern associated with Psychedelic Stealer where a process accesses the 'Login Data' file of common Chromium-based browsers, followed shortly by a network connection to a known stealer exfiltration API endpoint.
This rule detects the creation of a new Windows service using common administrative tools like sc.exe or PowerShell's New-Service cmdlet that masquerades as the legitimate Windows Time service (w32time). The rule specifically flags service creation commands that use relevant service names but point to non-standard, suspicious executable paths or configurations, potentially indicating persistence or malicious activity by RemotePanel.
Detects a behavioral pattern associated with the NeedyMantis first-stage loader, which involves the loading of specific suspicious DLLs (masquerading as common software components) followed by the extraction or creation of an 'encryptbase64.ps1' second-stage loader within a short timeframe (10 minutes) on the same host.
Page 94 of 1908