Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,864 detections
Filters
Last updated
All Time
Detection languages
1,755
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
3,710
737
611
405
100
Products / Services
1,457
648
498
272
235
MITRE Techniques
1,330
1,212
888
785
771
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects a specific command line argument sequence used by the SNAKE malware during its installation phase, as detailed in a CISA report. The rule looks for a process creation event where the command line contains two specific arguments: the first is a 64-character hexadecimal string (assumed to be a SHA-256 hash), and the second is at least a 16-character hexadecimal string (assumed to be part of an AES initialization vector).
Detects the use of the '--cpu-priority' command-line parameter, which is commonly associated with cryptocurrency miners, particularly XMRig, to prioritize CPU usage for mining operations. This can indicate the presence of coin mining malware on a system.
Detects a specific process tree pattern associated with Trickbot malware, where 'rundll32.exe' acts as the parent process for 'wermgr.exe', and the parent command line contains 'DllRegisterServer'. This pattern indicates the execution of a DLL via rundll32.exe, which then launches wermgr.exe, a known behavior of Trickbot.
Detects the creation of a file named "WerFault.exe" in the WinSxS directory by a non-system process. This activity is indicative of potential SNAKE malware persistence, as documented by the NSA and CISA. The rule specifically looks for file creations where the target filename starts with 'C:\Windows\WinSxS\' and ends with '\WerFault.exe', while excluding processes originating from standard Windows system directories to reduce false positives.
Detects the creation of specific executable files, 'jpsetup.exe' or 'jpinst.exe', which have been identified by CISA as indicators of SNAKE malware installation. The rule specifically looks for these filenames in the 'Image' field (process executable path) and excludes cases where the 'CommandLine' is empty or null, or explicitly matches the executable name, to reduce false positives.
Detects potential QakBot activity by identifying specific process execution patterns previously associated with the malware. This includes scenarios where WinRAR executes wscript.exe, command lines containing 'ping.exe -n 6 127.0.0.1 & type', or regsvr32.exe executing from 'C:\ProgramData' with a '.tmp' file.
This rule detects sign-in attempts originating from IP addresses that have been identified as infected with malware. These malware-infected IP addresses are known to actively communicate with bot servers, indicating a high risk of compromise or malicious activity associated with the sign-in.
This rule detects the execution of ZxShell malware by monitoring process creation events. Specifically, it looks for 'rundll32.exe' being executed with command-line arguments containing either 'zxFunction' or 'RemoteDiskXXXXX'. These strings are known indicators of ZxShell's operational behavior when launched via rundll32.
Detects specific command-line arguments used by the Conti ransomware during its execution phase. The rule looks for a combination of arguments including '-m ', '-net ', '-size ', '-nomutex ', and '-p \\', which are characteristic of Conti's encryption process. This pattern indicates the ransomware is likely attempting to encrypt files on the system or network shares.
This rule detects specific filenames, 'jpsetup.exe' and 'jpinst.exe', when they appear as the target filename in file events. These filenames have been associated with the SNAKE malware, as detailed in a CISA report. The rule aims to identify potential installations or presence of this malware on Windows systems.
Detects when Windows Defender's Antimalware Scan Interface (AMSI) triggers an alert, indicating that it has detected malware or other potentially unwanted software. This rule specifically looks for Event ID 1116 with the SourceName 'AMSI' from the Windows Defender log source.
Detects the creation of specific files associated with the Goofy Guineapig malware, which attempts to impersonate Google Update components. The rule looks for 'config.dat', 'GoogleUpdate.exe', 'tmp.bat', and 'goopdate.dll' within the 'C:\ProgramData\GoogleUpdate\' directory.
This rule detects process creation events indicative of the Griffon malware. Specifically, it looks for command-line arguments that contain all of the following strings: '\local\temp\', '//b /e:jscript', and '.txt'. This pattern suggests the execution of a JScript file from a temporary directory, which is a known behavior of Griffon malware as reported by Kaspersky.
Detects actions taken by Windows Defender malware detection engines, indicating that malware or potentially unwanted software has been found, suspicious behavior has been detected, or an action has been performed to protect the system.
Detects process access to 'verclsid.exe' that involves injecting shellcode, originating from a Microsoft Office application or VBA macro. This behavior is indicative of malicious activity, potentially leveraging 'verclsid.exe' for defense evasion and privilege escalation.
This rule detects the execution of 'rundll32.exe' with specific command-line arguments and parent processes that are characteristic of Qakbot malware activity. It looks for 'rundll32.exe' being launched by common scripting or command-line interpreters (cmd.exe, cscript.exe, curl.exe, mshta.exe, powershell.exe, pwsh.exe, wscript.exe) and attempting to load DLLs from suspicious paths (ProgramData, Users\Public, AppData\Local\Temp, AppData\Roaming). Additionally, it specifically targets known export functions used by Qakbot, such as 'aslr', 'bind', 'DrawThemeIcon', 'GG10', 'GL70', 'jhbvygftr', 'kjhbhkjvydrt', 'LS88', 'Motd', 'N115', 'next', 'Nikn', 'print', 'qqqb', 'qqqq', 'RS32', 'Test', 'Time', 'Updt', 'vips', 'Wind', 'WW50', 'X555', 'XL55', 'xlAutoOpen', and 'XS88'. This combination of indicators aims to reduce false positives by focusing on behaviors uniquely associated with Qakbot.
Detects activity that could be related to Baby Shark malware, specifically looking for command-line patterns indicative of its execution and discovery techniques. This includes the use of mshta.exe to execute HTA files via PowerShell, querying the registry for Terminal Server Client information, and using PowerShell to upload files.
Detects LockerGoga ransomware activity by identifying a specific command-line argument pattern used by the malware. The rule looks for the string '-i SM-tgytutrc -s' within process command lines, which is a known indicator of LockerGoga execution.
Detects Rorschach ransomware execution activity by looking for specific system utilities being executed with a distinct command-line string ('11111111'). The utilities include bcdedit.exe, net.exe, net1.exe, netsh.exe, wevtutil.exe, and vssadmin.exe, which are commonly abused by ransomware for defense evasion, system modification, and data destruction.
Detects the 3CXDesktopApp updater downloading a known compromised version of the 3CXDesktopApp software. This rule specifically looks for the 'update.exe' process within the 3CXDesktopApp directory being executed with command-line arguments indicating an update operation for version '18.12' via HTTP, which was associated with the supply chain compromise.
Detects modifications to the 'LegalNoticeCaption' or 'LegalNoticeText' registry values that include keywords commonly found in ransomware ransom messages. This activity is often associated with ransomware operations attempting to display a ransom note to users upon login.
Page 205 of 232