Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
255 detections
Filters
Last updated
All Time
Detection languages
84
82
27
24
11
Contributors
61
56
49
22
20
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
247
9
5
3
2
Products / Services
122
67
19
10
7
MITRE Techniques
110
94
73
65
40
CVEs
3
2
2
1
1
IDS Classtypes
3
2
1
IDS Protocols
6
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
This rule detects the creation of named pipes or mutexes with GUID-like naming patterns by non-system processes. Threat actors frequently use uniquely generated GUIDs for IPC mechanisms like named pipes and mutexes to coordinate between processes or to check for existing infection, often to avoid detection by using non-obvious names.
This rule detects the creation of named pipes or mutexes with GUID-like naming patterns by non-system processes. Threat actors frequently use uniquely generated GUIDs for IPC mechanisms like named pipes and mutexes to coordinate between processes or to check for existing infection, often to avoid detection by using non-obvious names.
Detects potential local privilege escalation (LPE) attempts targeting the AnyDesk adprinterpipe named pipe. The rule monitors for the execution of known malicious indicators, unauthorized access to the adprinterpipe, AnyDesk spawning unexpected processes as SYSTEM, and the creation of services by AnyDesk child processes.
Detects CastleLoader generating campaign-specific Named Mutexes to prevent multiple instances from running concurrently on the compromised host. The rule specifically looks for mutex creation events initiated by Python processes where the mutex name contains keywords associated with CastleLoader campaigns like 'Castle', 'Background', 'ClickFix', or 'TrapPhone'.
Identifies the creation of named pipes matching standard Cobalt Strike malleable C2 profiles (\pipe\msagent, \pipe\postex, \pipe\status, \pipe\spoolss) that are associated with network activity, indicating advanced C2 deployment.
Detects the creation of named pipes with names frequently associated with common post-exploitation tools, such as Cobalt Strike. The rule filters out common browser processes and critical Windows system processes to reduce noise.
Detects the creation of named pipes with names commonly utilized by offensive C2 frameworks such as Cobalt Strike, Metasploit, and Covenant. By monitoring for specific pipe naming patterns created by non-system processes, this rule aims to identify potential post-exploitation activity, C2 beacons, or lateral movement tools.
This rule detects the creation of named pipes associated with known command-and-control (C2) frameworks, post-exploitation toolkits, and suspicious system activity. By filtering out common legitimate system processes and monitoring for specific pipe patterns (e.g., Cobalt Strike, Metasploit, PsExec, and sensitive RPC endpoints), the rule identifies potential lateral movement, remote execution, and post-exploitation communication channels.
This rule detects potential rootkit activity by monitoring for specific DeviceIoControl requests (code 2248E0), the presence of a suspicious file (402.sys) in the ProgramData directory, and specific NamedPipe events (NSecKrnl). These indicators are often associated with kernel-level malicious implants or rootkits attempting to hide their presence or interact with the system at a low level.
Detects suspicious named pipe server creation by Medium/Low integrity processes followed by a SYSTEM-level process spawned from the same initiating process within a short correlation window. This behavior is indicative of an attacker attempting to escalate privileges using named pipe impersonation.
Detects evidence of AnyDesk exploiting an COM impersonation vulnerability via the adprinterpipe named pipe. The rule monitors for AnyDesk spawning SYSTEM-level child processes, interaction with the adprinterpipe, or modification of critical print-related registry keys.
Detects potential process impersonation by monitoring for suspicious named pipe creation followed by system-level process spawning.
Detects the creation of a mutex with a persistent suffix '!&fse?%AS!'. This string has been observed across multiple versions and campaigns of OysterLoader (also known as Broomstick/CleanUp).
IoT botnet malware family used for DDoS and proxy infrastructure
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Loader used in click-hijacking traffic distribution scheme
Photo-themed ZIP phishing campaign dropping a Node.js implant
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
AI-powered phishing-as-a-service abusing device-code authentication
Page 6 of 13