Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects instances of the MYRA RAT process masquerading as the systemd-userdbd daemon. The detection identifies the malicious payload being executed from the /usr/lib/systemd/systemd-userdbd path with command-line arguments typically used by the legitimate system utility, indicating that the Node.js binary has been replaced or copied to evade detection.
Detects the in-memory execution of the MYRA RAT on Linux systems. The rule identifies suspicious process activity where a process masquerades as the legitimate 'systemd-userdbd' service, while utilizing memfd_create or related file descriptor paths (e.g., /proc/self/fd/ or /memfd:) to load and execute malicious code directly from memory, thereby avoiding traditional file-based detection.
Detects anomalous Azure AD device registration events where device metadata is inconsistent, suggesting impersonation. The rule flags Linux hosts masquerading as Windows, non-Windows devices claiming AzureAD trust type, or the use of zeroed OS versions (0.0.0.0). High-frequency registrations (3+ devices per user in 30 minutes) correlate with known AADInternals-based attacks used by threat actor Storm-2372 to bypass Conditional Access policies.
This rule detects the creation or execution of files that match specific suspicious filenames associated with known malicious activity. It monitors both process creation (Event ID 1) and file creation (Event ID 11) events, targeting filenames such as 'MicrosoftUpdateOneDrive.exe', 'StockMarketView.exe', and various DLL files (e.g., 'ms-lib-math-core.dll'). These files are often masquerading as legitimate system or application components to evade detection.
This rule detects the creation or execution of files that match specific suspicious filenames associated with known malicious activity. It monitors both process creation (Event ID 1) and file creation (Event ID 11) events, targeting filenames such as 'MicrosoftUpdateOneDrive.exe', 'StockMarketView.exe', and various DLL files (e.g., 'ms-lib-math-core.dll'). These files are often masquerading as legitimate system or application components to evade detection.
Detects the creation or modification of specific DLL and data files associated with the SharkLoader malware (e.g., SystemSettings.dll, DscCoreR.mui) within designated hidden directories (%APPDATA%\xwreg or %APPDATA%\xgdf). These paths are indicative of the StrikeShark campaign, which utilizes DLL side-loading to target diplomatic and government entities.
Detects BQTLock ransomware anti-analysis checks, specifically looking for processes named 'start.exe' or 'BQT.exe' that exhibit characteristics of PyInstaller environments (via environment variables) or log anti-debugging failure messages. This rule helps identify the initial stages of BQTLock execution where it attempts to evade analysis.
Detects the execution of 'PerfWatson2.exe' when initiated from the user-writable 'AppData\Local' directory. 'PerfWatson2.exe' is a legitimate Windows process associated with the Windows Error Reporting service; its presence or execution from a user directory is indicative of masquerading or potential malware activity.
Detects instances of PerfWatson2.exe executing from non-standard locations (outside of known Visual Studio directories) or matching known malicious file hashes/versions. This behavior is indicative of masquerading, where a malicious binary attempts to mimic legitimate Microsoft software.
Detects evidence of the TinyRCT backdoor, which masquerades as legitimate VMware utilities and system binaries. The rule monitors for malicious activity including suspicious execution of vmtools.exe/vmwared.exe from ProgramData, unauthorized scheduled task creation, PerfWatson2.exe execution outside of legitimate Visual Studio installation paths, and chrome_setup.exe execution from non-standard directories.
Detects the execution of known tunneling binaries or binaries masquerading as common security and management agents (e.g., XDRAgent, vmtools, vmwared) with suspicious command-line arguments indicative of reverse tunnel establishment or C2 activity.
Detects the execution of 'PerfWatson2.exe' from within the user's AppData directory. This behavior is often associated with potential masquerading attempts, as legitimate instances of this file typically reside in system directories or specific application folders. The rule includes an exclusion for Microsoft Visual Studio related paths to reduce noise.
This rule monitors for suspicious process behaviors and module loads involving 'Mixed Reality.exe' and 'Windows Media Player' components. It detects instances where these files are launched by 'svchost.exe', load suspicious files like 'nvdaHelperRemote.dll', or are executed as a child of 'services.exe'. These behaviors are often associated with masquerading or potential process injection techniques.
Detects the creation of Electron runtime files (electron.exe, app.asar, index.js, package.json) by installers like UtilifySetup or Inno Setup in unusual subfolders within the AppData\Local directory. This behavior is indicative of potential malware, specifically referencing the 'super', 'max', or 'util' patterns in the path, which have been associated with campaigns like ClickFix.
This rule detects the execution of a process named 'systemd-userdbd' that is either spawned from suspicious parent contexts (such as Node.js or npm, or from locations like /tmp/, /var/tmp/, node_modules, or .peer/) or is running from a non-standard file path. This behavior is indicative of malware, specifically the MYRA RAT, which uses this process name as a masquerade to evade detection.
Detects malicious payloads downloaded from a spoofed legitimate domain (e.g., downloading "update.exe" from a hijacked google.com). This rule specifically looks for 'google.com/update.exe' or 'microsoft.com/flash_update.exe' within the RemoteUrl field, indicating a potential attempt to deliver malicious software from a compromised or spoofed legitimate domain.
Detects bulk process enumeration performed by suspicious or masquerading processes using Windows system APIs (CreateToolhelp32Snapshot, NtQuerySystemInformation, ProcessSnapshot). This activity is often associated with post-compromise reconnaissance and information gathering, specifically seen in Millenium RAT variants.
This rule detects potential adversary activity by correlating the execution of known analysis or debugging tools (e.g., Wireshark, ProcessHacker, x64dbg) occurring within a 30-minute window of a process executing from suspicious, user-writable directories (typically AppData/Local or AppData/Roaming). This pattern is often indicative of an adversary staging tools to facilitate further analysis, reverse engineering, or credential harvesting on a compromised host.
Detects instances where image processing utilities (ImageMagick's magick.exe or convert.exe) launch Ghostscript binaries (gs, gswin64c.exe) from non-standard directories (such as temp, user profile, or appdata folders) or utilize suspicious command-line arguments that attempt to bypass security policies. This activity is often associated with exploitation of image processing vulnerabilities where attacker-supplied files trigger arbitrary command execution.
Detects instances of common, sensitive Windows system binaries (svchost.exe, lsass.exe, sms.exe, csrss.exe) being executed by parent processes other than the legitimate system processes (services.exe, smss.exe, csrss.exe, winlogon.exe), indicating potential process masquerading or path spoofing.
This rule detects potential Remote Access Trojan (RAT) activity by identifying specific indicators associated with Nuitka-compiled binaries, specifically the 'chost.exe' filename or paths containing 'win-driver-xd7d'. Additionally, it monitors for suspicious Python-based loader executions ('loader.py') initiated from temporary directories, which is a common persistence or execution technique for such malware.
Page 24 of 40