Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
311 detections
Filters
Last updated
All Time
Detection languages
184
28
21
21
21
Contributors
88
85
46
21
17
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
259
40
20
6
3
Products / Services
113
76
51
37
35
MITRE Techniques
122
89
87
64
63
CVEs
6
5
3
1
1
Detects instances where a RedTail malware variant enumerates processes via the /proc filesystem to identify and terminate previous instances of itself using a kill signal.
Detects instances where a RedTail malware variant enumerates processes via the /proc filesystem to identify and terminate previous instances of itself using a kill signal.
Detects instances where a RedTail malware variant enumerates processes via the /proc filesystem to identify and terminate previous instances of itself using a kill signal.
Detects instances where a RedTail malware variant enumerates processes via the /proc filesystem to identify and terminate previous instances of itself using a kill signal.
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
Detects attempts to crash or terminate the Kaspersky Antivirus process (avp.exe), as well as associated events indicating the service has been stopped or is encountering abnormal fault conditions. This behavior is indicative of an adversary attempting to disable security software.
This rule detects potentially malicious activity involving the manipulation of Windows services using 'sc.exe' to stop or delete services, combined with the forceful termination of 'svchost.exe' processes via 'wmic.exe'. This pattern is often associated with adversaries attempting to disable security tools, logging agents, or other defensive mechanisms on an endpoint.
This rule detects the termination of specific security-related processes (e.g., antivirus services) shortly after a specific driver, 'ardrv.sys', is loaded on a Windows system. This sequence is characteristic of a 'Bring Your Own Vulnerable Driver' (BYOVD) attack, where an adversary loads a signed but vulnerable kernel driver to gain elevated privileges, which they then use to disable or terminate security monitoring processes.
This rule detects the termination of critical security software processes (e.g., antivirus agents) by a process that has recently acquired SeDebugPrivilege. This behavior is indicative of a malicious actor attempting to disable endpoint security controls to evade detection.
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
This rule detects potential cryptocurrency mining activity where known miner executables (specifically XMRig) or malicious scripts/processes are masquerading as or being spawned by 'LockAppHost.exe' or 'LockAppHost14a02b.exe'. It also monitors for subsequent attempts by these processes to terminate security-related tasks or establish persistence via registry run keys.
This rule detects the termination of critical security software processes (e.g., antivirus agents) by a process that has recently acquired SeDebugPrivilege. This behavior is indicative of a malicious actor attempting to disable endpoint security controls to evade detection.
This rule detects the termination of specific security-related processes (e.g., antivirus services) shortly after a specific driver, 'ardrv.sys', is loaded on a Windows system. This sequence is characteristic of a 'Bring Your Own Vulnerable Driver' (BYOVD) attack, where an adversary loads a signed but vulnerable kernel driver to gain elevated privileges, which they then use to disable or terminate security monitoring processes.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) terminates shortly after loading the Data Protection API service (dpapisvc.dll). This pattern may indicate an attempt to interact with or disrupt DPAPI services, potentially to facilitate credential dumping or sensitive data access.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) terminates shortly after loading the Data Protection API service (dpapisvc.dll). This pattern may indicate an attempt to interact with or disrupt DPAPI services, potentially to facilitate credential dumping or sensitive data access.
This rule monitors for suspicious activity involving the OneDrive directory, specifically the file 'wtsapi32.dll'. It triggers when this DLL file is created, modified, or renamed within the OneDrive folder, followed by the termination of the OneDrive process, and subsequent loading of the same DLL file by that process. This pattern is indicative of a DLL side-loading attack where a legitimate application (OneDrive) is used to load a malicious DLL.
Detects instances where the ESET Remote Administrator Agent (ERAAgent.exe) terminates shortly after loading the Data Protection API service (dpapisvc.dll). This pattern may indicate an attempt to interact with or disrupt DPAPI services, potentially to facilitate credential dumping or sensitive data access.
This rule detects potential adversary activity aimed at disabling security tools, critical infrastructure services, or cloud synchronization agents. It monitors for a high volume (6 or more) of process termination commands (e.g., taskkill, net stop) or registry-based service disabling (Start value 4) targeting a predefined list of security and critical system services within a 3-minute window, which is indicative of an attempt to blind security monitoring or disrupt system availability.
Detects process self-deletion (executable, scheduled task, or install directory) correlated within 60 minutes to a matching prior creation event, indicating post-execution cleanup behavior consistent with loader/RAT install-then-delete patterns such as those used by DOUBLECUP-delivered payloads.
This rule detects potential malware sandbox/virtualization evasion behavior on macOS. It identifies processes that execute 'system_profiler' with hardware-identifying keywords (e.g., QEMU, VMware, KVM) and correlates this with either immediate process self-termination within 5 seconds or the presence of a 'cis_blocked' signal, which is indicative of a kill-switch mechanism often used by malicious actors to avoid analysis.
This rule detects potential adversary activity aimed at disabling security tools, critical infrastructure services, or cloud synchronization agents. It monitors for a high volume (6 or more) of process termination commands (e.g., taskkill, net stop) or registry-based service disabling (Start value 4) targeting a predefined list of security and critical system services within a 3-minute window, which is indicative of an attempt to blind security monitoring or disrupt system availability.
Page 8 of 15