Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,439
11,829
5,873
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
This rule detects various activities associated with the NotDoor malware, including the copying of malicious files to Outlook macro folders, C2 beaconing attempts using nslookup or curl to suspicious domains, registry modifications to disable Outlook macro security or enable macro loading on boot, and the creation of staging files in temporary directories for potential exfiltration. These behaviors are indicative of NotDoor installation, persistence, defense evasion, and data staging.
Detects a sequence of events indicative of Process Doppelgänging, a technique used by APT37. This rule identifies a process creating a legitimate Windows utility and then immediately injecting code into it, which is characteristic of creating a process in a suspended state for injection.
KQL Query
This analytic detects system binaries that are commonly abused in process injection techniques but are observed without any command-line arguments. It leverages Cisco Network Visibility Module (NVM) flow data and process arguments to identify outbound connections initiated by these processes. Binaries such as `rundll32.exe`, `regsvr32.exe`, `dllhost.exe`, `svchost.exe`, and others are legitimate Windows processes that are often injected into by malware or post-exploitation frameworks (e.g., Cobalt Strike) to hide execution. When these processes are seen initiating a network connection with an empty or missing command line, it can indicate potential injection and communication with a command and control server.
This analytic detects network connections initiated by binaries that are not typically associated with network communication, such as 'notepad.exe', 'calc.exe' or 'write.exe'. It leverages Cisco Network Visibility Module logs to correlate network flow activity with process context, including command-line arguments, process path, and parent process information. These applications are normally used for locally and do not require outbound network access. When they do initiate such connections, it may indicate process hollowing, code injection, or proxy execution, where adversaries abuse a trusted process to mask malicious activity.
Detects a high frequency of UAC consent prompts (consent.exe) originating from a single parent process, followed by the launch of a common Living Off The Land Binary (LOLBAS). This pattern is indicative of 'UAC Prompt Bombing' used to coerce a user into granting elevated privileges, as seen with the NightshadeC2 loader.
Detects the execution of a browser process with the remote debugging port argument enabled. This technique is used by infostealers like Stealerium and Phantom Stealer to bypass browser security and steal credentials and cookies.
Detects processes accessing sensitive browser files which may indicate credential theft from web browsers.
This rule detects indicators of compromise (IOCs) associated with the 'ManualFinder/PDF Editor' malware campaign. It identifies malicious activity across multiple data sources, including file hashes, process hashes, suspicious certificate signers, suspicious company names in version info, suspicious file descriptions, malicious command execution, and network connections to known command and control (C2) or malicious PDF-related domains. The rule leverages external data sources for IOCs such as file hashes, C2 domains, PDF-related domains, suspicious signers, and malicious commands. It also includes static IOCs like specific file descriptions and company names. The detection logic is designed to identify various stages of the malware's activity, from initial execution to network communication.
This detection identifies the presence of PromptLock ransomware by looking for known malicious file hashes (SHA1 and SHA256). PromptLock is reported to be the first AI-powered ransomware, written in Go, and uses a local AI model to generate malicious Lua scripts. The rule searches across both file and process creation events for wider coverage.
Detects potential token theft, impersonation, or privilege escalation activity in Windows environments by monitoring ProcessPrimaryTokenModified events. This query highlights suspicious changes in SIDs, token sources, integrity levels, or privilege flags, including attempts to impersonate SYSTEM or add high-risk privileges (SeDebugPrivilege, SeImpersonatePrivilege). Such behavior is strongly associated with lateral movement and privilege escalation techniques used by APTs, ransomware operators, and red team tooling like Mimikatz and Cobalt Strike.
This rule detects suspicious activities related to Remote Monitoring and Management (RMM) tools by querying various data sources. It identifies processes, file signatures, network connections, and firewall logs associated with known RMM tools and domains, helping to uncover potential security threats. The rule leverages an external IOC list for RMM tool names, file signatures, and associated domains.
This rule detects communication with known malicious domains and IP addresses, as well as the presence or execution of files with known malicious MD5 or SHA256 hashes. It correlates threat intelligence with network and endpoint telemetry to identify compromised devices or accounts.
Hunts for abuse of Microsoft 365’s Direct Send feature where attackers send spoofed emails appearing internal, bypassing filters. Includes detection of suspicious DNS queries, outbound network connections, and PowerShell abuse for insider misuse.
This rule detects process events where `svchost.exe` or `schtasks.exe` are the initiating processes on specific devices. This is designed to identify unexpected or suspicious scheduled tasks, whether system-initiated or user-triggered, on monitored devices. It can be used for hunting or to investigate alerts from other security tools regarding suspicious scheduled tasks.
Detects suspicious activities related to CVE-2025-8088 WinRAR exploitation, including malicious file creation, COM hijacking, C2 communication, and anti-analysis techniques. Enhanced with ADS detection, command-line analysis, and refined false positive handling. This threat is now attributed to RomCom.
Detects various Indicators of Compromise (IOCs) associated with UAT-7237 activity, including file hashes, IP addresses, domains, and URLs. This rule identifies suspicious process executions based on known malicious file hashes and network connections to malicious IP addresses or URLs.
This rule detects activities associated with the Charon ransomware, including DLL side-loading, process creation patterns, file modifications related to ransom notes and payload artifacts, shadow copy deletion attempts, and service creation for persistence. It also includes SHA1 hashes for known Charon ransomware executables.
This rule detects the presence and activity of PAM-based backdoors on Linux systems by looking for specific SHA256 hashes and filenames associated with known PAM backdoors. It monitors process events, general device events, file events, and image load events on Linux devices.
This KQL query hunts for suspicious activities in Microsoft Defender for Endpoint that may indicate attempts to disable or manipulate Windows Event Logging, such as clearing logs, stopping the Event Log service, or modifying audit policies. It targets processes and commands associated with MITRE ATT&CK technique T1562.002 to identify potential defense evasion tactics.
The following analytic detects the creation or connection of anonymous pipes for inter-process communication (IPC) within a Windows environment. Anonymous pipes are commonly used by legitimate system processes, services, and applications to transfer data between related processes. However, adversaries frequently abuse anonymous pipes to facilitate stealthy process injection, command-and-control (C2) communication, credential theft, or privilege escalation. This detection monitors for unusual anonymous pipe activity, particularly involving non-system processes, unsigned executables, or unexpected parent-child process relationships. While legitimate use cases exist—such as Windows services, software installers, or security tools—unusual or high-frequency anonymous pipe activity should be investigated for potential malware, persistence mechanisms, or lateral movement techniques.
Page 76 of 84