Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
311 detections
Filters
Last updated
All Time
Detection languages
184
28
21
21
21
Contributors
88
85
46
21
17
Categories
20,443
11,831
5,875
5,151
4,864
Platforms
259
40
20
6
3
Products / Services
113
76
51
37
35
MITRE Techniques
122
89
87
64
63
CVEs
6
5
3
1
1
Detects NightLedger backdoor command dispatcher invoking known command IDs for process execution (3), DLL loading (43), process termination (56), and thread termination (69) as parsed from its C2 channel. When the dispatching process is AppVShNotify.exe, these actions are common to legitimate App-V activity, so the rule only fires for that image when there is additional evidence it is the compromised implant host - either recorded process lineage (ParentImage) or image-load context showing a module already loaded into the process (ImageLoaded). Events for AppVShNotify.exe lacking both signals are suppressed as likely benign generic process control.
Detects NightLedger backdoor command dispatcher invoking known command IDs for process execution (3), DLL loading (43), process termination (56), and thread termination (69) as parsed from its C2 channel. When the dispatching process is AppVShNotify.exe, these actions are common to legitimate App-V activity, so the rule only fires for that image when there is additional evidence it is the compromised implant host - either recorded process lineage (ParentImage) or image-load context showing a module already loaded into the process (ImageLoaded). Events for AppVShNotify.exe lacking both signals are suppressed as likely benign generic process control.
Detects post-exploitation persistence and anti-forensic activity associated with the RufRoot/CVE-2026-59726 vulnerability. The rule identifies the creation of unauthorized .js files within application directories, the modification of 'index.js' followed by a SIGKILL to process ID 1 to force a container restart, and attempts to clear bash command history to hide malicious footprints.
Detects HollowMare variants (OneZip/CrystalPDF/PowerDoc) that terminate a running Chrome or Firefox process immediately before overwriting a browser profile configuration file (Preferences, Secure Preferences, prefs.js) with a C2-supplied version to hijack the default search engine.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the CylindricalCanine/GoldenEyeDog credential-theft pattern where the malware first kills a running browser or chat client (Chrome.exe, firefox.exe, skype.exe, 360se.exe, 360chrome.exe, QQBrowser.exe) and then, within a short window, reads/creates the associated credential/profile files (Login Data, avBackup.dat, FormData3.dat, historyUrl3.db, history3.db) on the same device.
Detects the use of the GigaWiper malware's internal GRATProcessManagerMain module to perform process manipulation operations, such as creating, suspending, resuming, or killing processes, via command-line arguments.
Detects the use of the GigaWiper malware's internal GRATProcessManagerMain module to perform process manipulation operations, such as creating, suspending, resuming, or killing processes, via command-line arguments.
Detects the use of the GigaWiper malware's internal GRATProcessManagerMain module to perform process manipulation operations, such as creating, suspending, resuming, or killing processes, via command-line arguments.
Detects the Starland RAT's self-deletion routine, which invokes os.remove(script_path) followed by sys.exit() when the C2 responds with an HTTP 403 kill-switch. The deleted file path matches the executing Python interpreter's own script/image path, indicating classic self-delete behavior.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects the Starland RAT's self-deletion routine, which invokes os.remove(script_path) followed by sys.exit() when the C2 responds with an HTTP 403 kill-switch. The deleted file path matches the executing Python interpreter's own script/image path, indicating classic self-delete behavior.
Detects termination of security services or tampering with real-time protection configurations shortly after the loading of the PoisonX (g11.sys) kernel driver. This activity is indicative of a Bring Your Own Vulnerable Driver (BYOVD) attack aimed at disabling endpoint defenses prior to the deployment of ransomware or other malicious payloads.
This rule detects a sequence of suspicious activities characteristic of rootkit deployment and defense evasion. It monitors for the creation of a specific driver file (kvckiller.sys) in the system drivers directory, the modification of registry keys related to services (wsftprm), the execution of service management commands (sc.exe or net.exe) referencing those registry keys, and the subsequent termination of security-related processes like MsMpEng.exe or SecurityHealthSystray.exe.
Detects the Starland RAT's self-deletion routine, which invokes os.remove(script_path) followed by sys.exit() when the C2 responds with an HTTP 403 kill-switch. The deleted file path matches the executing Python interpreter's own script/image path, indicating classic self-delete behavior.
Detects the execution chain associated with the CrySome RAT, which terminates common web browsers (Chrome, Edge, Brave), drops a malicious DLL ('abe_decrypt.dll') into a temporary directory, and subsequently restarts the browser to facilitate credential theft.
Detects when multiple security agent processes are terminated on a single host. Monitoring for the simultaneous or rapid termination of security products like Windows Defender, Cylance, SentinelOne, or Falcon suggests an attempt to disable endpoint protections before further malicious activity.
This rule monitors for suspicious activity aimed at disabling or tampering with security software, including antivirus processes and services. It identifies execution of tools named 'AVKiller.exe', the usage of commands like 'taskkill', 'net stop', or 'sc stop' against known security-related processes, and the modification of Windows Defender scheduled tasks to disable security scans.
Detects a specific sequence of commands involving the termination of the AnyDesk process using taskkill, a short delay via the timeout command, and an immediate system reboot. This sequence is often associated with persistence setup or system preparation by threat actors.
Detects the dropping of a suspicious DLL file ('abe_decrypt.dll') in a temporary directory, followed by the termination and relaunch of a browser process (Chrome, Edge, or Brave), and the subsequent loading of the same DLL into the browser process, which is highly indicative of browser process injection and DLL hijacking activity.
Page 9 of 15