Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
This rule identifies instances where files with specific extensions (.dll, .py) or the python executable are created on a system shortly after (or exactly at) the observed creation timestamp of notepad.exe. This logic aims to detect potential masquerading or side-loading techniques where attackers may attempt to hide their activities or establish persistence by mimicking or piggybacking on standard utility usage.
YARA signature for the MSI installer's spoofed property data impersonating a legitimate Windows update package, requiring both the spoofed filename and an MSI-internal structural artifact
Detects the execution of python.exe or pythonw.exe from the LogiOptionsPlus temporary directory within AppData. This behavior is atypical for standard Logitech software operation and may indicate the execution of arbitrary scripts or malicious payloads masquerading under a legitimate software path.
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
This query detects non-browser processes making network connections to .shop or .xyz domains which could possibly pertain to phishing, malware delivery, tracking, ad fraud, or command-and-control.
System File Execution Location Anomaly
Cortex XDR
Detects common Windows system binaries (e.g., svchost.exe, rundll32.exe, powershell.exe) executing from non-standard, suspicious file paths. This behavior is often indicative of adversaries attempting to masquerade malicious executables by renaming them or placing them in paths to mimic legitimate system processes.
Detects the execution of bindutil.exe with arguments typically used to establish links or silo configurations, excluding known legitimate parent processes associated with container and virtualization services.
Detects instances of 'RuntimeBroker.exe' executing from a directory other than the standard Windows System32 location, specifically when the command line includes a known cryptocurrency wallet address string. This behavior is indicative of potential masquerading or malicious activity where a legitimate Windows system binary name is abused to execute unauthorized commands or facilitate cryptocurrency-related tasks.
Detects the loading of a DLL named 'SolidPDFCreator.dll' where the initiating process claims to be 'Solid PDF Creator', but the loaded DLL is not digitally signed. This behavior is indicative of potential DLL hijacking or masquerading where an unsigned malicious file is substituted for a legitimate application component.
Detects a native PE or ELF binary masquerading as JavaScript source (e.g. intro.js) dropped in node_modules
Suspicious wermgr.exe Creation Outside System Directory
Detects instances where the command shell 'cmd.exe' is launched as a child process of 'nvidia-sysruntime.exe'. This behavior is anomalous as 'nvidia-sysruntime.exe' typically does not spawn command interpreters, suggesting potential masquerading or process hollowing where an attacker is using a disguised malicious binary to execute shell commands.
Detects the execution of an executable named 'nvidia-sysruntime.exe', which is used by the LabubaRAT malware family to masquerade as a legitimate NVIDIA component to maintain persistence and evade detection.
Detects the execution of an executable named 'nvidia-sysruntime.exe', which is used by the LabubaRAT malware family to masquerade as a legitimate NVIDIA component to maintain persistence and evade detection.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects instances where a process named 'symantec.exe' is executed from a path other than the standard Symantec installation directories. This behavior is indicative of an attempt to disguise a malicious executable as a legitimate Symantec software component.
Detects instances where the command shell 'cmd.exe' is launched as a child process of 'nvidia-sysruntime.exe'. This behavior is anomalous as 'nvidia-sysruntime.exe' typically does not spawn command interpreters, suggesting potential masquerading or process hollowing where an attacker is using a disguised malicious binary to execute shell commands.
Detects instances where a process named 'svchost.exe' is executed from common temporary file paths, which is characteristic of malware attempting to masquerade as the legitimate Windows Service Host process.
Detects the execution of an executable named 'nvidia-sysruntime.exe', which is used by the LabubaRAT malware family to masquerade as a legitimate NVIDIA component to maintain persistence and evade detection.
Page 16 of 40