Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,443 detections
Filters
Last updated
All Time
Detection languages
8,114
7,134
1,351
1,156
1,060
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
18,059
3,028
1,502
123
104
Products / Services
5,718
4,280
3,709
1,168
958
MITRE Techniques
9,461
7,567
3,446
2,846
2,691
CVEs
36
28
25
20
20
IDS Classtypes
1
Detects execution of macOS.Gaslight malware by identifying specific function calls within process command lines, specifically 'SecTrustSetAnchorCertificatesOnly' for certificate pinning, 'SCDynamicStoreCopyProxies' for proxy awareness, and 'CCRandomGenerateBytes' for cryptographical operations. These behaviors are typical of the implant's efforts to maintain encrypted C2 communication while frustrating network inspection tools.
Detects a multi-stage in-memory .NET DLL loader chain where an executable from AppData\Roaming mimics legitimate software (TuglaInsaatci) to load malicious DLLs ('Optimax.dll' and 'System Optimizer Ultimate.dll') entirely in memory. This behavior is indicative of the FortiBleed steganographic loader campaign, which aims to evade disk-based security controls.
Detects instances where the DonutLoader utility performs in-memory .NET payload execution. It identifies suspicious behavior by tracking the loading of clr.dll into a process that is not a recognized .NET host, concurrent with evidence of process hollowing techniques such as memory unmapping and process writing (NtUnmapViewOfSection, WriteProcessMemory, ResumeThread).
Detects anomalous activity where multiple distinct Living-off-the-Land (LotL) binaries (e.g., powershell.exe, cmd.exe, wmic.exe, tasklist.exe, systeminfo.exe) are executed on the same device within a single hour. This threshold of 4 unique administrative or discovery tools being used in a short timeframe is often indicative of reconnaissance, lateral movement, or post-exploitation environment assessment by an adversary.
Detects potential DLL hijacking persistence by identifying modifications to registry values containing executable or library files that point to locations outside standard Windows system directories (System32 or SysWow64), subsequently joined with the execution of legitimate binary proxies known to be abused for side-loading like rundll32.exe or regsvcs.exe.
Detects the use of command-line arguments associated with Windows token impersonation techniques (e.g., 'SeImpersonate', 'ImpersonateLoggedOnUser') initiated by common command-line interpreters (powershell.exe, cmd.exe, wmic.exe). This activity is often indicative of an adversary attempting to elevate privileges by stealing or manipulating access tokens.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
This rule detects the use of wmic.exe to execute commands or manage remote systems, specifically flagging indicators of lateral movement, credential usage, or command execution like 'node', 'user', 'password', and 'call create'.
Detects the use of the Program Compatibility Assistant (pcalua.exe) to proxy the execution of mshta.exe. This LOLBIN evasion technique is actively used by ClickFix loaders to execute remote HTA payloads while evading process-based detections.
This rule detects the usage of standard Windows system administration utilities (infinstall.exe, devcon.exe, pnputil.exe, sc.exe) when the command line arguments include keywords commonly associated with driver loading or kernel-level operations, which may indicate the installation of a rootkit or malicious driver.
Detects the execution of psql.exe with arguments pointing to a VeeamBackup database, or suspicious database queries containing 'credentials' or 'SELECT' statements. The rule specifically alerts when this behavior is initiated by PowerShell or WMI processes, which are common indicators of automated post-exploitation activities intended to extract sensitive information from the backup infrastructure.
Detects anomalous activity involving the Windows consent.exe process, which handles User Account Control (UAC) elevation prompts. Specifically, this rule monitors for instances where consent.exe is spawned from the Temp folder, spawned by msiexec.exe from the Temp folder, or loads a suspicious version of msimg32.dll from a non-System32 directory. These behaviors are often indicative of UAC bypass attempts or DLL hijacking related to privilege escalation.
This rule detects suspicious activities involving the Microsoft Edge browser (msedge.exe). It monitors for the spawning of known command-line utilities (e.g., cmd.exe, powershell.exe) by the browser process and the loading of DLLs that do not originate from expected Windows or Microsoft Edge installation directories. Additionally, it correlates these events with recent Microsoft Edge application crashes on the same host, which may indicate exploitation attempts.
Detects the use of the native Windows Backup utility (wbadmin.exe) to initiate a backup that specifically includes the Active Directory database file (ntds.dit). This behavior is characteristic of an attempt to perform offline Active Directory credential dumping by creating a backup of the database to an accessible location.
Detects execution of psql.exe with command line arguments containing 'VeeamBackup' and 'credentials', which may indicate an attempt to access or extract credentials from a PostgreSQL database associated with Veeam Backup software.
Detects the execution of known Windows utilities (vssadmin, wmic, wbadmin) used to delete Volume Shadow Copies or the backup catalog, a common technique employed by ransomware to prevent system recovery. It also detects processes named locker.exe, commonly associated with ransomware binaries.
Detects the execution of 'HFY.exe' correlated with the presence of specific DLLs (e.g., data.dll, EPPlus.dll) characteristic of a trojanized Chinese telecom management utility. This behavior is indicative of the BeepRAT infection chain, where malicious binaries are executed from archives containing secondary dependencies.
Detects the execution of Ghostscript (gswin64c.exe, gswin32c.exe, or gs) spawned by ImageMagick binaries (magick.exe, convert.exe, or identify.exe) where the Ghostscript binary is located outside of standard program installation directories. This behavior is indicative of potential delegate hijacking or exploitation attempts where an adversary provides a malicious Ghostscript binary to ImageMagick.
This rule detects suspicious activity involving Docker containers, specifically focusing on path traversal attempts via the 'docker cp' command, execution of potential proof-of-concept scripts, or the creation of specific marker files indicating attempts to interact with or escape from the containerized environment to the underlying host.
This rule detects activities associated with a specific malicious browser extension, including the presence of its files on disk, execution of browsers with the extension ID in the command line, and network connections to known malicious or typosquatted domains (perplexity-ai.online, extension.tilda.ws) used for C2 or exfiltration.
Page 468 of 974