Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,456
11,839
5,876
5,155
4,865
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule monitors for processes that are digitally signed by 'Discord Inc.' or 'Lenovo' but executing from file paths that are not associated with legitimate installations of their software. This behavior is indicative of threat actors using stolen or compromised code-signing certificates to bypass security controls like SmartScreen or endpoint antivirus solutions.
Detects the execution of rundll32.exe with a command line referencing a DLL file stored in the C:\ProgramData directory. This pattern is commonly used by adversaries to execute malicious code while masquerading as legitimate system activity, particularly when initiated by command shell or browser processes.
Detects a sequence of suspicious process executions related to the 'RemoteAgent' application, specifically monitoring for MSI-based installations, NSSM service management, and API checks across a device. The rule aggregates distinct process events per device and flags if two or more distinct indicators are identified within a 14-day window.
This rule detects potential smishing or malvertising attacks by monitoring network activity for the download of .apk files from non-reputable domains. It correlates these download attempts with previous browsing behavior on URLs containing specific 'fake app-store' lure patterns (e.g., promotional text like 'Nexus One' or 'Download Now' outside of official marketplaces like Google Play, APKMirror, or APKPure).
Detects the execution of known malicious MSI files associated with the LegionLoader malware family by monitoring process creation events involving msiexec.exe. The rule matches on specific file hashes and filenames identified in technical analysis of LegionLoader variants.
This rule detects the creation of executable files (.exe or .dll) within the 'C:\Windows\SysWOW64\' directory by processes other than trusted Windows OS installation or servicing components. This activity is indicative of potential malware staging, side-loading, or persistence mechanisms where an adversary drops malicious payloads into a trusted system directory to evade detection.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
This rule performs a retrospective hunt for indicators of compromise (IOCs) associated with the ClosedQuorum malware. It identifies suspicious activity by matching against known file hashes, specific filenames, and network traffic directed towards services (such as DeepSeek, OpenRouter, Mistral, and Discord) which the malware uses for C2 or data exfiltration. The detection logic aggregates results from file system, process, and network telemetry.
Detects the execution of Regsvcs.exe or Regasm.exe, which are trusted Windows .NET binaries, from non-standard or user-writable directories (such as Temp, AppData, Downloads, or User profiles). Adversaries often abuse these binaries to proxy the execution of arbitrary malicious code (DLLs) by bypassing application control policies.
This rule detects the presence and execution of known suspicious files (hashes provided) or specific malicious artifacts, such as 'hmn_hook.dll' being loaded, or the execution of binaries named 'auto.exe' and '78324.exe' associated with specific command-line arguments. It monitors file events, image loads, and process creation to identify potential malware activity.
Detects a potential ClickFix social engineering attack pattern where a user manually launches a script interpreter (e.g., PowerShell, cmd, mshta) from Windows Explorer followed within 30 minutes by the execution of 'rnpkeys.exe', a known indicator in installer side-load chains.
Detects a potential ClickFix social engineering attack pattern where a user manually launches a script interpreter (e.g., PowerShell, cmd, mshta) from Windows Explorer followed within 30 minutes by the execution of 'rnpkeys.exe', a known indicator in installer side-load chains.
Detects the PIVOTPIPE .NET loader, which identifies and extracts a 'core.pak' file containing the RAT payload. The loader performs XOR-decoding and GZIP-decompression to reflectively load the malicious payload into memory using .NET reflection methods, bypassing traditional file-based execution.
Detects file, process, and network activity associated with the TraderTraitor/KelpDAO malware campaign based on known hashes, filenames, paths, and C2 infrastructure.
KQL Query from file: JivaChat Installer - Full Chain
KQL Query from file: JivaChat Installer - Full Chain
Detects a .NET-hosting PE module (e.g. I++u.dll) that references both the NuGet-package-concealed Build.dat loader stage and the subsequent execute_engine_disconnect.raw decrypted container, matching the V2 ClickFix loader chain
Detects a .NET-hosting PE module (e.g. I++u.dll) that references both the NuGet-package-concealed Build.dat loader stage and the subsequent execute_engine_disconnect.raw decrypted container, matching the V2 ClickFix loader chain
Detects a .NET-hosting PE module (e.g. I++u.dll) that references both the NuGet-package-concealed Build.dat loader stage and the subsequent execute_engine_disconnect.raw decrypted container, matching the V2 ClickFix loader chain
Detects a .NET-hosting PE module (e.g. I++u.dll) that references both the NuGet-package-concealed Build.dat loader stage and the subsequent execute_engine_disconnect.raw decrypted container, matching the V2 ClickFix loader chain
This rule detects network connections to known cryptomining pool IP addresses and domain names, as well as file or process executions matching specific hashes associated with known miner samples. It monitors for communication to command-and-control (C2) servers potentially used for cryptomining operations.
Page 20 of 80