Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
678 detections
Filters
Last updated
All Time
Detection languages
285
97
83
66
59
Contributors
280
127
92
28
26
Categories
20,443
11,831
5,875
5,151
4,864
678
Platforms
660
33
6
Products / Services
284
244
53
33
18
MITRE Techniques
513
285
245
224
222
CVEs
6
1
1
1
1
Detects the Kothamine post-installation technique where npm/node spawns PowerShell to reflectively load a .NET assembly stager into memory. This behavior is followed by the PowerShell process spawning anomalous instances of RuntimeBroker.exe or svchost.exe. These spawned processes exhibit suspicious characteristics, such as executing from non-standard file paths, having missing command-line arguments (like the required '-k' for svchost), or having an illegitimate parent process (powershell.exe) instead of standard system parents like services.exe or wininit.exe.
Detects the Kothamine post-installation technique where npm/node spawns PowerShell to reflectively load a .NET assembly stager into memory. This behavior is followed by the PowerShell process spawning anomalous instances of RuntimeBroker.exe or svchost.exe. These spawned processes exhibit suspicious characteristics, such as executing from non-standard file paths, having missing command-line arguments (like the required '-k' for svchost), or having an illegitimate parent process (powershell.exe) instead of standard system parents like services.exe or wininit.exe.
Detects the Kothamine post-installation technique where npm/node spawns PowerShell to reflectively load a .NET assembly stager into memory. This behavior is followed by the PowerShell process spawning anomalous instances of RuntimeBroker.exe or svchost.exe. These spawned processes exhibit suspicious characteristics, such as executing from non-standard file paths, having missing command-line arguments (like the required '-k' for svchost), or having an illegitimate parent process (powershell.exe) instead of standard system parents like services.exe or wininit.exe.
Detects anomalous credential access behavior by identifying instances where a compromised explorer.exe process (injected with the Kothamine payload DLL MicrosoftEdgeUpdateCore.dll) accesses browser cookie stores and gaming credential files in quick succession.
This rule detects the suspicious pattern of a process reading a 'pool.db' file followed immediately by the loading of .NET Common Language Runtime (CLR) modules (clr.dll or mscoreei.dll). This behavior is characteristic of fileless execution chains where a secondary payload is retrieved and executed directly in memory.
Detects OnyxC2 RunPE injection behavior where a process drops or loads a suspicious sideloaded DLL (specifically borlndmm.dll) and immediately initiates a secondary process instance, indicative of process hollowing or memory unpacking of a malicious payload.
Detects the loading of the 'WbElevation.dll' module associated with SectopRAT, followed by suspicious access to browser, email, or cryptocurrency wallet credential stores within a 10-minute window on the same device.
Detects the loading of the 'WbElevation.dll' module associated with SectopRAT, followed by suspicious access to browser, email, or cryptocurrency wallet credential stores within a 10-minute window on the same device.
Detects the loading of a known malicious 136KB browser injection helper DLL (SHA256: 75018b06c7105a1dca391805d17b402aed35ebd515b92d461236eafbd606cb40) into Google Chrome or Microsoft Edge processes. The rule further correlates this activity with command line arguments indicative of abusing the browser's elevation service, which is a technique often used for process injection or local privilege escalation.
Detects evidence of the Rapuncel infostealer attempting to compromise Chrome or Edge browsers. The rule identifies suspicious image loads into browser processes linked to known malicious hashes or the creation of specific browser decryption log files used by the malware to defeat App-Bound encryption.
Detects evidence of the Rapuncel infostealer attempting to compromise Chrome or Edge browsers. The rule identifies suspicious image loads into browser processes linked to known malicious hashes or the creation of specific browser decryption log files used by the malware to defeat App-Bound encryption.
Detects the execution of 'userscreen.exe' (a renamed pythonw.exe used by NarwhalRAT) loading 'user32.dll'. This behavior is associated with the use of ctypes in Python to perform window enumeration via EnumWindows, specifically used by the malware to identify and monitor KakaoTalk application windows.
This rule detects when the MpDlpService.exe process loads the 'mpclient.dll' library from a location other than the legitimate Windows Defender program directories. This behavior is indicative of potential DLL side-loading or hijack execution flow attempts targeting the Microsoft Data Loss Prevention service.
This rule detects the suspicious sequential loading of 'tdwp.dll' and 'rnp.dll' by processes related to key management or encryption (e.g., 'rnpkeys.exe' or processes from a 'keyroll' folder). The detection correlates these events within a 2-minute window and highlights if the 'tdwp.dll' has a known malicious hash.
Detects the execution of rnpkeys.exe from a specific path, followed by the loading of expected DLLs (rnp.dll or tdwp.dll) from the same directory, and a subsequent network connection on port 443. This behavior pattern is consistent with DLL side-loading used to establish a network-based command and control channel.
Detects the NeedyMantis malware component loading configuration and communications modules (specifically dnsapi.dll or ws2_32.dll) from a non-standard system directory. This behavior is indicative of DLL hijacking or side-loading, where a malicious library is substituted for a legitimate Windows system library to facilitate command and control or malicious execution.
Detects NeedyMantis first-stage loader activity where a legitimate application (e.g., Poedit, curl, Vim, TightVNC) is executed to load an update or support DLL from a non-standard staging path (e.g., %ProgramData% subdirectories), followed by the presence of a co-located encrypted second-stage archive.
This rule detects the presence and execution of known suspicious files (hashes provided) or specific malicious artifacts, such as 'hmn_hook.dll' being loaded, or the execution of binaries named 'auto.exe' and '78324.exe' associated with specific command-line arguments. It monitors file events, image loads, and process creation to identify potential malware activity.
Detects the loading of 'tdwp.dll' in a process that has previously loaded 'rnp.dll', which is characteristic of the Sauron loader (also known as Remsec) in-memory decryption chain performed by the 'rnpkeys.exe' executable.
Detects instances where processes typically associated with browser-related tasks (smartscreen.exe, ctfmon.exe) load ntdll.dll while another process on the same device is running with browser-specific command-line arguments (e.g., --user-data-dir, --profile-directory). This pattern is often indicative of process injection or credential harvesting attempts where an adversary attempts to interact with or scrape data from active browser sessions.
Detects instances where processes typically associated with browser-related tasks (smartscreen.exe, ctfmon.exe) load ntdll.dll while another process on the same device is running with browser-specific command-line arguments (e.g., --user-data-dir, --profile-directory). This pattern is often indicative of process injection or credential harvesting attempts where an adversary attempts to interact with or scrape data from active browser sessions.
Page 3 of 33