Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,111 detections
Filters
Last updated
All Time
Detection languages
1,010
659
132
77
68
Contributors
432
407
369
241
166
Categories
20,439
11,829
5,873
5,151
4,864
2,111
Platforms
2,105
5
4
3
1
Products / Services
588
467
342
116
93
MITRE Techniques
1,578
817
813
730
463
CVEs
5
4
3
2
2
IDS Classtypes
4
IDS Protocols
5
This rule detects potential persistence mechanisms associated with the GlobalProtect VPN application where the binary is unsigned. It specifically monitors for unauthorized 'RunOnce' registry entries, the creation of suspicious scheduled tasks, or updates to scheduled tasks involving 'GlobalProtect.exe'. These actions are initiated by either 'msiexec.exe' or 'GlobalProtect.exe', suggesting a possible attempt to masquerade malicious activity as a legitimate VPN update or installation process.
Detects the creation or modification of Windows Registry Run or RunOnce keys where the associated executable path is located in suspicious or non-standard directories (e.g., Temp, AppData, ProgramData). This behavior is characteristic of adversaries, such as APT28, attempting to maintain persistence by ensuring malicious code executes automatically upon user login.
This rule detects suspicious persistence activity involving known tools or names that are often masqueraded. It looks for the creation of registry run keys or scheduled tasks using names associated with common tools ('Canon Configuration Reader', 'Stardock DeElevation Tool') when the initiating process is not located in the expected vendor-authorized directories. The rule specifically alerts on devices exhibiting these behaviors within a short time window.
This rule detects a sequence of suspicious activities involving files placed in 'ProgramData\Firefox'. It identifies the creation or modification of a non-standard executable within this folder, followed by its execution by a trusted process (or itself), and the subsequent creation of a Registry run key for persistence. This pattern is often used by adversaries for persistence mechanism implementation using masqueraded file names.
Detects the creation of persistence mechanisms through both Registry Run keys and Scheduled Tasks within a one-hour window, specifically targeting names indicative of masquerading as legitimate update or helper components.
Detects the installation sequence of the CosmicPulse (YESROBOT) backdoor, characterized by a registry value write under HKCU\Software\Classes\.mollis followed by the execution of a Python 3.8 bootstrapper from a non-standard, suspicious directory such as AppData, ProgramData, or Temp.
Detects the installation sequence of the CosmicPulse (YESROBOT) backdoor, characterized by a registry value write under HKCU\Software\Classes\.mollis followed by the execution of a Python 3.8 bootstrapper from a non-standard, suspicious directory such as AppData, ProgramData, or Temp.
Detects attempts to disable or tamper with Microsoft Windows Defender via registry modifications or malicious PowerShell/reg.exe commands, specifically targeting security settings like DisableAntiSpyware, DisableRealtimeMonitoring, and exclusion paths.
Detects modifications to Windows Registry keys associated with persistence techniques, including LSA authentication package registration, custom credential provider registration, and manipulation of SafeBoot registry keys.
This rule detects a sequence of events characteristic of the x47.c persistence pattern. It monitors for the creation of persistence mechanisms via Windows Registry Run keys or scheduled tasks, followed by the addition of Windows Defender exclusions using PowerShell within a 30-minute window on the same device.
Detects the installation sequence of the CosmicPulse (YESROBOT) backdoor, characterized by a registry value write under HKCU\Software\Classes\.mollis followed by the execution of a Python 3.8 bootstrapper from a non-standard, suspicious directory such as AppData, ProgramData, or Temp.
Detects persistence attempts using common Windows auto-start registry keys or scheduled tasks where the initiating process is unsigned or has an invalid signature. The rule focuses on binaries executing from suspicious, user-writable directories (e.g., Temp, AppData, Downloads) and specifically targets persistence mechanisms involving the 'SecurityHealthService.exe' filename.
Detects the 'ClickFix' technique where a user copies a malicious payload and pastes it into the Windows Run dialog (Win+R). The rule monitors for the creation of registry values under the RunMRU key followed closely by the execution of powershell.exe or cmd.exe initiated directly by explorer.exe, indicating an bypass of standard browser execution chains.
Detects modifications to Windows Registry keys responsible for the legal notice caption and text displayed at logon. Adversaries may abuse Group Policy Objects (GPOs) to set these values to ransom-themed messages, a technique sometimes observed in ransomware campaigns to signal compromise to users.
Detects potential persistence mechanisms on Windows systems by monitoring for the creation or modification of Registry 'Run' or 'RunOnce' keys, as well as the creation of files within the Windows Startup folder. These actions are commonly used by adversaries to ensure malicious code executes automatically upon user login or system startup.
Detects Microsoft Office applications (Winword/Excel) spawning PowerShell or MSHTA with base64-encoded command-line arguments, followed by subsequent persistence mechanisms such as creating scheduled tasks or modifying Registry Run keys. This behavior is indicative of APT38 (BlueNoroff) and similar campaigns delivering banking Trojans via malicious Office macros.
Detects service-creation commands (sc create / New-Service / reg add under a Services key) whose COMMAND LINE itself references a known NeedyMantis binary name or sideload staging folder. Requiring the malicious reference to appear in the command being executed -- rather than merely in the calling process's own folder location -- removes false matches from unrelated legitimate software that happens to be installed under a similarly-named folder.
Detects the installation sequence of the CosmicPulse (YESROBOT) backdoor, characterized by a registry value write under HKCU\Software\Classes\.mollis followed by the execution of a Python 3.8 bootstrapper from a non-standard, suspicious directory such as AppData, ProgramData, or Temp.
Detects the installation sequence of the CosmicPulse (YESROBOT) backdoor, characterized by a registry value write under HKCU\Software\Classes\.mollis followed by the execution of a Python 3.8 bootstrapper from a non-standard, suspicious directory such as AppData, ProgramData, or Temp.
This rule detects the modification of Windows Registry Run keys, specifically targeting a value named 'MicrosoftUpdate' within the 'Run' registry path. This is a common persistence technique used by adversaries to ensure malicious programs or scripts automatically execute upon user logon by mimicking a legitimate system update process.
Detects malicious activity associated with the ClickFix/Vidar campaign, where adversaries create persistence using the Windows Run registry key while masquerading as the legitimate 'VoidTools Everything.exe' utility. The rule correlates registry modifications with the creation or execution of a file path mimicking the legitimate software in suspicious locations.
Page 4 of 101