Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9 detections
Filters
Last updated
All Time
Detection languages
5
2
1
1
Contributors
3
2
2
1
1
Categories
4
1
1
1
1
Platforms
7
2
Products / Services
3
3
2
1
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
2
IDS Protocols
2
Detects processes attempting to enumerate or interact with specific Windows window classes (e.g., 'SysListView32', 'SHELLDLL_DefView', 'Progman') often used by malware like NoEscape ransomware to identify active desktop, taskbar, or explorer UI elements, likely to facilitate data theft or interface manipulation.
This rule monitors for patterns associated with the Grandoreiro banking trojan, specifically looking for malicious lure behaviors originating from Adobe Reader processes, VBScript-based droppers, payload drops, file creation of known update names, potential banking browser-kiosk overlays, and specific DLL sideloading techniques.
Detects execution patterns associated with the Grandoreiro banking trojan, specifically its overlay attack technique. The rule monitors for browsers launched in kiosk mode by unauthorized parent processes, the presence of Grandoreiro-specific banking identifier strings in process command lines, execution of unsigned binaries from AppData/Local that spawn browsers in kiosk mode, and the execution of specific known loader binaries spawned by script interpreters.
This rule detects potential data exfiltration of screen window lists via HTTP POST requests. It specifically looks for HTTP POST requests where the URI contains the case-insensitive string "windows" and the data size is greater than 200 bytes. This combination suggests an attempt to send information about open windows on a system to a remote server.
This rule detects attempts to enumerate application windows using specific API calls (EnumWindows and GetWindowText) over HTTP. This behavior is often associated with remote access tools or malware trying to gather information about the user's active applications.
Detects attempts to query system information directly from the Windows Registry.
Detects non-system users failing to get a handle of the SCM database.
This rule detects attempts by non-system users to obtain a handle to the Service Control Manager (SCM) database, specifically targeting the 'ServicesActive' object with a broad access mask (0xf003f). This activity can indicate an adversary attempting to enumerate or manipulate services on a Windows system.
Detects non-system users failing to get a handle of the SCM database.