Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Stealthy backdoor MLTBackdoor linked to KongTuke ClickFix and ModeloRAT campaigns
This rule detects the execution of 'wermgr.exe' from a path other than the expected 'C:\Windows\System32'. This behavior is indicative of the 'RoguePlanet' exploit, where an adversary replaces a Windows Defender quarantine artifact with a malicious payload and triggers it via the 'QueueReporting' scheduled task, running with NT AUTHORITY\SYSTEM privileges.
Detects the RoguePlanet exploit chain where an attacker-planted binary masquerading as wermgr.exe is executed by the QueueReporting scheduled task under SYSTEM integrity and spawns an interactive shell process (conhost.exe, cmd.exe, powershell.exe). Legitimate wermgr.exe instances related to error reporting do not spawn interactive console processes.
This rule detects suspicious activities commonly associated with the Yuta/Glove information stealer, including the creation of specific file paths in AppData, the execution of binaries from user-writable directories, and potential process hollowing or side-loading behaviors. It monitors process creation (Event ID 1) and file creation (Event ID 11) for indicators like winupdate.exe, PyInstaller-related temporary directories, and known malicious file hashes.
This rule identifies processes masquerading as common Windows system binaries (e.g., svchost.exe, lsass.exe) by executing from non-standard, suspicious file paths like temporary directories or user profiles instead of legitimate system directories (e.g., C:\Windows\System32).
This rule detects command and control (C2) communication associated with the 'easy-day-js' backdoor, which is part of the Mastra npm supply chain attack. It specifically looks for HTTP POST requests to the IP address 23.254.164.123 with a spoofed Internet Explorer 8 User-Agent string.
Detects processes that masquerade as the legitimate 'systemd-userdbd' system service by spoofing their process name. This behavior is commonly associated with malware, such as the MYRA RAT, which uses prctl to alter its process display name to evade detection.
Detects persistence and fileless execution techniques associated with the MYRA Linux RAT. This includes monitoring for the creation of persistence files such as /usr/local/lib/.libcache.so for LD_PRELOAD hijacking and /etc/profile.d/.sh.local for shell-based persistence. It also monitors for suspicious process execution patterns where 'node' spawns a 'systemd-userdbd' masquerading process or invokes syscalls indicative of fileless execution, specifically memfd_create or fexecve.
This rule detects instances where a process named 'systemd-userdbd' is executed from a file path other than the standard locations ('/lib/systemd/systemd-userdbd' or '/usr/lib/systemd/systemd-userdbd'). Such behavior is often indicative of masquerading, where malicious actors rename their executables to match legitimate system services to evade detection. The rule additionally flags when the parent process is a common interpreter or package manager, which increases the likelihood of malicious activity.
This rule detects potentially malicious activity on Linux systems by monitoring for two suspicious patterns: 1) The 'systemd-userdbd' process being spawned by Node.js or npm, which may indicate a supply-chain attack where a package masquerades as a system daemon, and 2) The execution of processes from anonymous file descriptors within '/proc/self/fd/', a common indicator of fileless execution techniques (e.g., fexecve).
Detects the execution of unsigned binaries located in common user-writable or temporary directories (AppData, Public) by elevated accounts (SYSTEM or Administrator). This pattern is often used by adversaries to gain persistence or execute malicious payloads in directories where they can write files without restricted permissions.
Detects the execution of unsigned binaries located in common user-writable or temporary directories (AppData, Public) by elevated accounts (SYSTEM or Administrator). This pattern is often used by adversaries to gain persistence or execute malicious payloads in directories where they can write files without restricted permissions.
Detects SPECTRALVIPER threat activity by monitoring for unauthorized masquerading as legitimate OneDrive sync processes. The rule identifies suspicious process creation, beaconing to C2 infrastructure, DtlCrashCatch.dll sideloading, and unauthorized cross-process injection behaviors associated with this threat actor.
Detects svchost.exe masquerading or abnormal process lineage. Legitimate svchost.exe
runs from System32 or SysWOW64 and is launched by services.exe as the Service Control
Manager host process. Execution from user-writable paths indicates binary masquerading;
execution from script hosts or explorer indicates a rogue or attacker-controlled launch
rather than normal service startup.
runs from System32 or SysWOW64 and is launched by services.exe as the Service Control
Manager host process. Execution from user-writable paths indicates binary masquerading;
execution from script hosts or explorer indicates a rogue or attacker-controlled launch
rather than normal service startup.
Detects the use of 'winget.exe' to initiate a configuration operation where the provided file path does not use the expected '.yaml' or '.yml' extension. This behavior suggests an attempt to bypass security controls or masquerade malicious content (e.g., as a text or image file) that is then processed by the WinGet DSC engine, potentially leading to unauthorized PowerShell execution.
Detects instances where the DllHost.exe process creates or writes files with common executable or script extensions (.exe, .dll, .ps1, .bat, .cmd, .vbs, .hta, .scr, .sh) into suspicious, publicly writable, or temporary directories. This behavior is indicative of potential malicious payload staging, masquerading, or post-exploitation activity.
Detects the use of a masquerading binary named 'uptime' for persistence or malicious activity on Linux systems. This rule monitors for unauthorized 'uptime' process activity such as network connections, spawning of shell/interpreter processes, creation of systemd service unit files, and manipulation via systemctl, as well as execution from non-standard directories.
Detects potential persistence via the creation of suspicious systemd service files. The rule monitors for new service files created by non-package manager processes, correlates these with subsequent 'systemctl enable' or 'start' operations, and identifies the execution of binaries from non-standard directories (e.g., /tmp, /dev/shm) by the systemd process.
Detects suspicious activity related to the OpenSSH server suite, including unauthorized modifications to core SSH binaries by non-package-manager processes, sshd processes writing files to temporary directories (a common indicator of credential harvesting), and sshd execution from non-standard file paths which may indicate a trojanized binary or persistence mechanism.
Detects Linux processes masquerading as common system utilities (e.g., sshd, cron, smbd) by executing from non-standard, often high-risk directories such as /tmp, /var/tmp, /dev/shm, /opt, or various home and dot-directories. This behavior is indicative of Velvet Ant's TTPs used to blend malicious binaries with standard system processes to maintain persistence and evade detection.
Detects execution of fltMC.exe when located in the Temp directory, or execution of processes matching known malicious file hashes associated with this filename.
Page 23 of 40