Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
112 detections
Filters
Last updated
All Time
Detection languages
59
33
9
3
3
Contributors
27
20
16
7
7
Categories
78
42
20
9
9
Platforms
100
9
5
2
1
Products / Services
34
28
15
4
4
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
1
Detects command-line activity indicative of timestomping, specifically when 'cmd.exe' is used with file copy/move commands ('copy', 'xcopy', 'robocopy', 'move') and the target path is not within 'Program Files' or 'Windows' directories. This behavior is often associated with ransomware like Prinz Eugen attempting to hide its activities.
This rule detects processes that attempt to set the 'BlockNonMicrosoftBinaries' mitigation policy using 'SetProcessMitigationPolicy'. This policy is typically used to prevent the loading of non-Microsoft signed DLLs into a process, which can be an evasion technique used by adversaries to hinder analysis or prevent injection by security products.
Detects the use of 'pgrep' to search for the 'Runner.Worker' process. This activity is often a precursor to an attacker attempting to access the process's memory via '/proc/[pid]/mem' for credential dumping or other malicious purposes.
This rule detects potential process hollowing or process blanketing attempts by monitoring Windows Security Event ID 4688 (A new process has been created) and checking if the command line contains the strings 'ProcessHollowing' or 'ProcessBlanketing'. These strings in the command line of a newly created process could indicate an attempt to inject malicious code into a legitimate process to evade detection.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects the creation of processes where the command line contains keywords such as 'cve' or 'vulnerability'. This could indicate attempts to exploit known vulnerabilities, perform vulnerability research, or execute tools related to vulnerability assessment.
Detects parent process ID spoofing used to hide malicious process relationships
Detects malware using mutexes to prevent multiple instances running simultaneously
Detects process execution events containing command-line arguments unique to Chaos ransomware execution, such as 'ignorar_arquivos_grandes' or 'work_mode'. It also includes a more generic detection for 'lkey' and 'path' arguments used together to reduce false positives.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
Detects the creation or execution of the SSH propagation payload script (.sshu-setup.js), used by the Hades stealer to propagate via SSH from compromised workstations. This rule identifies file creation/modification/renaming events for the specific script name, or process creation events where the command line references the script.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
This rule detects suspicious activity related to 'wermgr.exe' or the named pipe 'MiniPlasmaWERPipe'. 'wermgr.exe' is the Windows Error Reporting process, and its execution from non-standard paths can indicate compromise or abuse. The 'MiniPlasmaWERPipe' named pipe has been associated with malware for inter-process communication. Detection is based on Windows Security Event Log (EventCode 4688 for process creation) or Sysmon Operational logs (EventCode 1 for process creation, 17 for pipe creation, 18 for pipe connection).
Detects the use of wmic.exe to create a new process. This can be indicative of an adversary using WMI for execution.
Detects the execution of processes from common user-writable directories such as Desktop, Downloads, AppData, Documents, and the Public folder. Adversaries often place and execute malicious payloads in these locations to evade detection and leverage user permissions. This rule helps identify potentially unauthorized or malicious software execution.
This rule detects suspicious activity related to a specific IP address (142.11.206.73) in network connections, or a specific domain (sfrclak.com) in DNS requests or process command lines. This could indicate communication with known malicious infrastructure or the execution of malware.
This rule detects file creation, modification, or renaming events related to 'TieringEngineService.exe' in the 'C:\Windows\system32\' directory, or process execution of 'TieringEngineService.exe' running as the 'SYSTEM' account. This activity could indicate suspicious system-level operations or potential abuse of a legitimate Windows component.
This rule analyzes historical logon, process, and network activity for a specified device over a configurable lookback period. It aims to validate whether a device, potentially flagged as decommissioned or stale, exhibits a pattern of sporadic, legitimate use (e.g., executive laptops, break-glass machines) rather than continuous or unauthorized activity. The output provides a daily timeline of activity, helping to differentiate between truly dormant assets and those with intermittent, legitimate usage.
This rule detects when the 'oskmenu.xml' file, located in 'C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions', is accessed or modified by any process not running under the SYSTEM account. This file is associated with the On-Screen Keyboard and its modification by non-system accounts could indicate an attempt to alter its behavior, potentially for persistence or privilege escalation.
Detects a Windows program being run from a shared folder instead of its normal location, with an unusual command added. This can be a sign that a clean program was copied and used to run a harmful file.
Detects file creation or process execution events involving the SHA256 hashes of malicious DLLs from the NCryptYo, DOMOAuth2_, IRAOAuth2.0, and SimpleWriter_ NuGet packages. This rule identifies the presence or execution of known malicious components associated with a supply chain compromise targeting ASP.NET developers.
Page 2 of 6