Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects DLL sideloading behavior where a legitimate, signed executable (e.g., in System32 or Program Files) loads a DLL from a non-standard, user-writable directory (e.g., Temp, AppData, Downloads). This pattern is consistent with the delivery of Obsidian Sandstorm (Storm-2571) payloads such as ThrottleDrift, RiverGorilla, and SilverGorilla, where malicious DLLs are staged and loaded alongside trusted binaries.
Detects persistence attempts via Windows Registry Run keys, specifically targeting indicators associated with UNC1549. The rule monitors Sysmon Event ID 13 for modifications to 'CurrentVersion\Run' keys, flagging entries containing specific filenames like 'FileCoAuth.exe' or 'secur32.dll', as well as generic write operations to AppData or Temp directories.
This rule detects the creation of new executable files in suspicious locations, specifically targeting potential masquerading or evasion attempts in Windows Error Reporting (WER) paths (using randomly named folders) and generic Windows Temp directories by non-system accounts (excluding Microsoft Defender's engine process).
Detects the execution or loading of executables (.exe) or dynamic link libraries (.dll) located in user-specific temporary or roaming directories (AppData). These directories are common locations for attackers to drop payloads, execute malicious code, or achieve persistence, as they are writable by standard users without elevated privileges. The rule includes filters for known legitimate processes that may perform operations in these directories to reduce noise.
Detects DLL sideloading activity where legitimate, signed binaries such as ADNotificationManager.exe or QEMU-related executables (qemu-system-x86_64.exe, qemu-system-i386.exe, qemu-img.exe) load malicious DLLs (e.g., vcruntime140_1.dll) from user-writable directories (e.g., AppData, Temp, ProgramData). This behavior is associated with the GOLD ENCOUNTER and STAC campaigns for delivering payloads like Havoc C2.
This rule detects qemu-system processes acting as parents for known tunneling or network utility tools, or qemu-system instances explicitly configured with suspicious command-line parameters (e.g., tap, socket connect, virtio-net) indicative of covert command and control (C2) communication. This behavior is associated with threat actors using Alpine Linux virtual machines within QEMU to bypass host EDR visibility.
Detects the creation of scheduled tasks named 'MicrosoftEdgeUpdate' or 'MicrosoftEdge' that execute files located in non-standard directories such as ProgramData or Temp. This is a common technique used by threat actors to achieve persistence while masquerading as legitimate update services.
Detects potential execution of Remcos Remote Access Trojan (RAT) components or process masquerading activity involving 'explorer.exe'. The rule identifies suspicious file paths (e.g., ProgramData\Remcos\) and instances where processes named 'explorer.exe' execute from non-standard Windows directories, indicating an attempt to hide malicious activity or masquerade as a legitimate Windows system process.
Detects execution of Mimikatz or usage of common tools like Procdump to dump LSASS memory. The rule monitors for characteristic command-line arguments, renamed binary names associated with Mimikatz, and the extraction of sensitive credentials to output files.
Detects instances of the systemd-userdbd process executing from non-standard file paths or general systemd-related processes launching from world-writable or temporary directories (e.g., /tmp, /dev/shm, /var/tmp, /home). This behavior is often indicative of process masquerading or a persistence mechanism where an adversary attempts to execute a malicious binary by mimicking system service naming conventions.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
Detects unauthorized executables masquerading as XDR agents (Palo Alto Networks) or VMware tools (XDRAgent.exe, vmtools.exe, vmwared.exe) by executing from suspicious directories such as AppData, Temp, or ProgramData\VMware instead of authorized installation paths. This technique is often used to hide the execution of malicious tools like reverse tunnel clients or VPN utilities.
Detects the execution of known system binary names (e.g., svchost.exe, MsEdgeUpdate.exe) from suspicious locations within the user AppData directory rather than the standard Windows System32 directory. This behavior is a common indicator of malware persistence, masquerading, or defensive evasion.
This rule detects suspicious activity associated with potential threat actor staging patterns, specifically monitoring for the usage of temporary directories like 'wdtest_temp', file path manipulation involving 'RP_*' (often related to shadow copy or system restore point paths), and the execution of 'wermgr.exe' from non-standard locations. It also identifies non-SYSTEM processes attempting to enumerate Volume Shadow Copy Service (VSS) devices using commands like 'NtQueryDirectoryObject' or referencing 'HarddiskVolumeShadowCopy'.
Detects the loading of unsigned .dll or .ocx modules from non-standard, potentially user-writable directories such as AppData, Temp, or ProgramData. This behavior is frequently associated with persistence mechanisms or side-loading techniques.
Detects the execution of remote monitoring and management (RMM) binaries AnyDesk or SyncFuture when launched by suspicious parent processes commonly associated with phishing delivery chains (e.g., mshta, wscript, cmd, powershell), or when executed from user-writable directories like Temp or AppData, which is a common pattern for persistent remote access abuse.
Detects the creation of scheduled tasks that involve QEMU virtualization binaries or virtual disk images. This activity is associated with the GOLD ENCOUNTER threat group and campaigns STAC4713/STAC3725, which utilize QEMU to facilitate persistence and infrastructure defense evasion by maintaining virtualized environments across system reboots.
Detects Linux processes masquerading as common daemons (smbd, httpd, sshd, crond) that are executing from non-standard file paths and establishing network connections on non-canonical ports to private (RFC1918) IP addresses. This behavior is indicative of a SOCKS5 proxy or C2 infrastructure masquerading as system services to blend in with legitimate traffic, as observed in Velvet Ant operations.
Detects file creation or write operations within protected macOS System 'Application Support' directories that mimic legitimate Finder or system component filenames. This behavior is indicative of an attacker attempting to masquerade malicious files or persistence mechanisms as core macOS system utilities.
Detects a process masquerading as 'Finder' (i.e., having a different file path than the legitimate macOS Finder) that attempts to open System Settings, System Preferences, or the 'open' command to interact with Apple System Preferences related to Full Disk Access or Security settings. This behavior is indicative of an adversary attempting to modify privacy permissions or bypass system security controls.
Detects process execution attempts where the binary is located in the /private/tmp directory, specifically targeting a file named 'System Settings'. Executing binaries from temporary directories is a common technique used by attackers to stage and run malicious payloads while attempting to blend in with legitimate-looking filenames.
Page 18 of 40