Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
This rule detects the loading of specific DLL files (commonly associated with open-source software libraries like mingw or webp) from user-writable directories (Temp, Downloads, AppData, etc.) by specific processes. The rule further correlates these events with recent execution of potential phishing-related commands (WScript, CScript, or download-related activity) on the same host within a 1-hour window.
This rule detects potentially malicious process behavior on Linux systems. It triggers on two conditions: 1) Masquerading of the 'systemd-userdbd' process by detecting processes named 'systemd-userdbd' that do not originate from the legitimate system path. 2) Fileless execution by detecting process image paths that contain 'memfd:', which is commonly associated with loading malicious binaries directly from anonymous memory to evade disk-based detection.
Detects core Windows system processes (svchost.exe, lsass.exe, csrss.exe, winlogon.exe) executing from non-standard locations other than System32 or SysWOW64. This is a common indicator of process masquerading, where malicious actors rename or move their executable to blend in with legitimate system activity.
Detects emails containing attachments that mimic voicemail files (e.g., .mp3.eml) with an HTML content type, often used in phishing campaigns. The rule specifically looks for dual extensions, HTML content type, a specific file size range, and subject line keywords related to financial institutions or unauthorized activity, indicating a potential Scotiabank impersonation or similar financial lure.
Detects the execution of known critical system processes (e.g., svchost.exe, lsass.exe) from directories other than the standard Windows System32 or SysWOW64 paths. This behavior is indicative of masquerading, where an adversary attempts to evade detection by naming malicious files after legitimate system binaries.
Detects critical Windows system processes (svchost.exe, lsass.exe, csrss.exe, wininit.exe, winlogon.exe, spoolsv.exe) that are either spawned by unexpected parent processes or reside in non-standard directories. This behavior is indicative of potential masquerading, process injection, or malicious persistence attempts.
Detects the execution of a process named 'servertool.exe' specifically when it originates from a user's OneDrive Music folder or a generic Music folder within the user profile. This could indicate an attempt to masquerade malicious activity by placing an executable in an unusual, typically benign location.
Detects instances where SystemSettings.exe is spawned from non-standard directories often associated with the SharkLoader malware family, such as AppData roaming subdirectories or KasperskyLab program folders. This behavior is indicative of masquerading and malicious staging.
Detects the execution of suspected StrikeShark-related binaries (SystemSettings.exe and FScan) when they are found running from non-standard directories or masquerading as legitimate system processes. The rule specifically monitors for instances where these binaries are executed from user-writable paths like AppData or Temp, while excluding legitimate Windows paths and processes associated with Windows Update.
Detects executable content served with incorrect MIME type for masquerading
Detects the execution of a process named 'wusvc.exe' located outside of the standard C:\Windows\System32 or C:\Windows\SysWOW64 directories. Attackers often rename malicious binaries to look like legitimate system services (such as Windows Update service) to evade detection and maintain persistence.
This rule detects instances of the SNOWLIGHT dropper (wusvc.exe) initiating or interacting with processes identified as common debugger or system analysis tools. The rule monitors for the simultaneous presence of wusvc.exe and a blacklist of tools like processhacker.exe, ida.exe, and wireshark.exe within a 120-second window on the same device.
Detects the execution of a malicious file named wusvc.exe, known as the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update Service. The rule identifies instances where this file is run from suspicious locations (e.g., Downloads folder) or triggers UAC elevation despite not being associated with recognized Windows update processes.
Detects instances where a process named wusvc.exe is executed from suspicious directories (such as Downloads, AppData, Temp, or Public folders) instead of the legitimate Windows system directories (System32 or SysWOW64). It further restricts the scope to processes spawned by common user applications like web browsers or explorer.exe, indicating potential masquerading or execution of malicious binaries disguised as the Windows Update service.
Detects Pay2Key ransomware attempting DLL search order hijacking against Avast Antivirus components. The rule monitors for two behaviors: Windows system DLLs (e.g., powrprof.dll) being loaded from the Avast installation directory, and Avast-specific component DLLs (e.g., snxhk.dll, ashBase.dll) being loaded from non-standard file paths outside the legitimate Avast software installation directory.
Detects cross-process activity (such as process injection or handle access) initiated by the Windows Update service (wusvc.exe) where the executable is not digitally signed by Microsoft Corporation. This behavior is highly suspicious as the legitimate wusvc.exe should always be signed by Microsoft, and this may indicate process masquerading or a compromised service binary.
Detects process creation of an executable named 'wusvc.exe' that originates from a user Downloads directory and is not digitally signed by Microsoft Corporation. This behavior is indicative of an adversary attempting to masquerade as the legitimate Windows Update service to evade detection.
Detects the suspicious installation and execution of a Python runtime from within a disguised directory (%LOCALAPPDATA%\Programs\Python\Python3127). This behavior is characteristic of an infostealer campaign that leverages Node.js to download archive files (python.zip, python.7z) and archiving tools (7zr.exe) to bootstrap a Python-based malicious payload.
This rule detects unauthorized file creation, deletion, or execution activity occurring within the 'Program Files\Windows Media Player\' directory by processes other than standard Windows Media Player executables. It flags activity such as creating non-media files (executables, scripts) or using system binaries like cmd, powershell, wmic, or fsutil to perform file operations in this directory. This behavior is indicative of potential masquerading or persistence techniques where an attacker places malicious payloads in a seemingly legitimate system location.
Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.
This rule detects common security product executables (MsMpEng.exe, SenseNdr.exe, csfalconservice.exe, CylanceSvc.exe) that are running from file paths inconsistent with their legitimate installation directories. This behavior is indicative of an adversary attempting to masquerade as trusted security software to evade detection or achieve persistence.
Page 22 of 40