Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,443
11,831
5,875
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
Parses Python execution strings to detect inline, on-the-fly decompression and execution of the CastleLoader script without touching disk.
This rule detects commands executed within GitHub Actions build jobs that attempt to read memory from the GitHub Actions runner process. This technique is often used in supply-chain attacks to extract secrets that reside in the runner's memory during job execution. The rule specifically looks for command-line arguments containing '/proc' and 'Runner.Worker' along with keywords like 'mem', 'cmdline', 'grep', 'tr -d', or 'isSecret'.
Detects HID keystroke injection attacks from hardware implants
This rule detects potential process injection attempts by monitoring Security Event ID 4688 (A new process has been created) for command-line arguments containing 'CreateRemoteThread' or 'VirtualAllocEx'. These API calls are commonly used in various process injection techniques to allocate memory and create threads in a remote process, allowing an attacker to execute arbitrary code within another process's context.
This rule detects instances where 'wscript.exe' or 'cscript.exe' (VBScript interpreters) initiate processes that attempt to download files from the internet (HTTP, HTTPS, FTP) or from network shares, or execute common system utilities often used for file transfer or execution like 'net.exe', 'certutil.exe', or 'bitsadmin.exe'. This pattern is indicative of multi-stage VBScript loaders often used in phishing campaigns to retrieve and execute further malicious payloads.
This rule detects two types of suspicious process activity. The first part identifies common Windows processes (svchost.exe, explorer.exe, system.exe, services.exe) executing with command lines that suggest driver loading or manipulation (e.g., containing 'driver', '.sys', 'load', 'unsigned', 'disabled UAC'). It flags instances where such activity occurs frequently (5 or more times) within a short timeframe (2 hours) and involves at least one unique driver file. The second part of the rule detects suspicious process termination attempts where specific legitimate Windows processes (MpCmdRun.exe, MsSense.exe, PsExec.exe, rundll32.exe) are observed attempting to terminate critical system processes (svchost.exe, lsass.exe, csrss.exe) multiple times.
Detects attempts to bypass macOS Gatekeeper security controls
This rule identifies processes establishing synchronization objects (mutexes) that start with the hardcoded prefix 'Global\EVOLUTION'. This pattern is indicative of the EVOLUTION stealer malware execution, as it uses this specific mutex naming convention to ensure only one instance of itself is running.
Detects execution of tools known to manipulate Windows access tokens
Detects pulling of potentially malicious container images from registries
Detects in-memory archive creation using .NET compression libraries
Detects execution of tools known to manipulate Windows access tokens
This rule watches a notarised Flutter app wait before calling home and then running shell commands. Delayed contact helps malware evade sandbox checks during install. Behaviour after the delay is the real threat. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
This rule detects a burst of network discovery activity from tools linked to DIY ransomware kits advertised with AI themes. Attackers use these tools to identify machines before encrypting files. Fast, repeated discovery from a single source is a serious warning sign. The rule specifically looks for multiple distinct discovery tools (nltest.exe, net.exe, net1.exe, dsquery.exe, adfind.exe, whoami.exe, ipconfig.exe) executed from common user-writable or temporary directories within a short timeframe.
This rule looks for command-line text associated with Atlas remote-access malware checking in to its controller. That check-in means the machine may already be under outsider control. Isolate the host and begin incident response if confirmed. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects Rust-compiled dropper generating its local staging environment inside WebViewFixUtility. This rule specifically looks for file events within the `\AppData\Local\WebViewFixUtility` folder that are initiated by `BrowserViewUtility.exe`.
Correlates the execution of the dropped Synaptics.exe with active outbound network connections, indicative of DarkKomet malware beaconing.
Identifies cmd.exe executing a batch script named 'vvvv.cmd' which is checking for the presence of the 'u.dat' reinfection guard file in the Public\Documents folder before execution. This behavior is associated with the UnregStealer malware.
Detects references to the misspelled service 'MicrosoftUpdateSerice' during service creation or manipulation within process command lines. This specific misspelling has been associated with the MuddyWater APT group.
Correlates the execution of a JavaScript file with a 24-hex-character name (e.g., 'a1b2c3d4e5f6a7b8c9d0e1f2.js') with an active outbound network connection to the 23.254.164.x subnet. This pattern is indicative of the Mastra NPM supply chain compromise, where malicious JavaScript is executed and attempts to communicate with a command and control server.
This rule detects the execution of 'pythonw.exe' from the AppData\Local folder, which then initiates network connections to known Vidar C2 domains (brokeapt.com, pan.ssffaa19.xyz, pan.rongtv.xyz). This behavior is indicative of the Vidar stealer malware, often distributed via social engineering campaigns leveraging AI brands as bait.
Page 65 of 84