Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,443
11,831
5,875
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects a .NET loader interrogating the process list for a specific cluster of sandbox/analysis tools (apateDNS, tcpvcon, any.run, joeboxserver, Dbgview) using PowerShell before proceeding with its malicious activity. The rule triggers when PowerShell command line arguments contain at least two of the specified tools.
Detects removal of Zone.Identifier ADS to bypass MOTW security prompts
Detects the Python interpreter executing with a command line containing a specific string fingerprint ('lzcdrtfxyqiplpd') associated with the Glassworm obfuscation variant. This indicates potential obfuscated code execution.
Detects the execution of the 'stat' command with specific arguments ('-f', '%Su', '/dev/console') which is indicative of the AMOS Stealer attempting to pivot user context to the active console user. This activity is typically performed by the '~/.agent' script associated with the malware.
This rule detects process execution events on Linux systems where the command line contains references to 'dirtyfrag.conf'. This file is associated with a mitigation for the 'Dirty Frag' Linux vulnerability. Detection indicates that a process is interacting with this specific mitigation configuration, which could be part of a system hardening effort or an attempt to modify/disable the mitigation.
Detects attempts to escalate privileges via sudo
This rule detects potential exploit attempts targeting Microsoft Word or Outlook by monitoring process crashes (AccessViolation) initiated by these applications, specifically when the command line indicates the processing of document or email file types (.docx, .eml, .rtf). This could indicate an attempt to exploit a vulnerability in these applications through a specially crafted file.
Detects pulling of potentially malicious container images from registries
Detects patching of network device system images for persistent backdoors
Detects the use of 'pgrep' to search for the 'Runner.Worker' process. This activity is often a precursor to an attacker attempting to access the process's memory via '/proc/[pid]/mem' for credential dumping or other malicious purposes.
Hunts for the fake VPN creating highly randomized, high-entropy directories in %AppData% to store its persistence binaries. This rule specifically looks for folder creation events in the AppData\Roaming directory with a highly randomized, 12 or more character alphanumeric name, and correlates it with a process event from either GlobalProtect or AnyConnect VPN clients.
Correlates a script connecting to an LLM API and immediately piping the response or executing rapid shell commands (cmd/bash) representing AI-generated reconnaissance or exploit execution.
Detects Python executing OS commands spawned directly from the deserialization of a poisoned Pickle model file. This rule correlates process creation events where 'python.exe' initiates a command interpreter ('cmd.exe', 'sh', 'bash') with file access events to common Pickle file extensions ('.pkl', '.pickle', '.pth', '.bin').
Detects a single process creating several named pipes, which is indicative of the Kazuar malware's communication mechanism between its Kernel, Bridge, and Worker modules. The rule specifically looks for a process creating 3 or more unique named pipes within a 10-minute window.
Detects several related module processes on one host while a single process accounts for all external network connections. This behavior is indicative of the Kazuar malware, which uses a botnet-like structure where one 'leader' process handles C2 communications.
Detects PowerShell attempting to hook keystrokes via user32.dll SetWindowsHookEx. This behavior is often associated with malware like PS1Bot to capture user input.
Identifies the Python loader generating the decryption key using hashlib.sha512 over an embedded parameter.
Hunts for the IAT_PHANTOM_FIX evasion routine where Python generates thousands of SHA-512 hashes to delay execution and fool heuristics. This rule specifically looks for 'python.exe' processes executing command lines that contain a loop iterating a large number of times (at least 1000) and performing SHA-512 hashing, indicative of anti-analysis techniques used by malware like XWorm.
Detects the malware executing system interrogation commands to build its unique Client ID from ProcessorCount, UserName, and OSVersion. This rule specifically looks for a process named 'Win.Kernel_Svc' (case-insensitive) initiating multiple executions of 'cmd.exe', 'wmic.exe', or 'systeminfo.exe' within a short timeframe.
Detects a script or small watchdog process repeatedly launching the same miner on one device within a short period. This behavior is indicative of cryptojacking activity where a persistent mechanism ensures the cryptocurrency miner continues to run even if terminated.
Detects a CPU miner configured with an unusually high thread count or affinity mask after GPU capability checks. This behavior is indicative of cryptojacking activity where an attacker is attempting to maximize CPU resource utilization for cryptocurrency mining.
Page 62 of 84