Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects network connection activity originating from the Windows Update service process (wusvc.exe) to a known C2 IP address (38.60.253.35) on port 8084. This pattern is indicative of VSHELL RAT communication, potentially using masquerading to hide its network activity.
Detects Hannibal Stealer-related process injection patterns involving the use of legitimate Windows binaries (sppextcomobj.exe, slui.exe) spawned by rundll32.exe, or specific child-process relationships, correlated with directory paths associated with CefSharp.BrowsersSubprocess or SCef.WindowsAdapter, which are indicative of malware staging.
This rule detects suspicious process execution patterns on Linux systems, specifically looking for processes running from anonymous memory mappings (memfd), execution via /proc/self/fd (fexecve pattern), and processes masquerading as 'systemd-userdbd' from unexpected file paths. These techniques are often used by adversaries for evasion and persistence.
Detects the execution of executable files with suspicious command line arguments related to AI or Machine Learning frameworks (e.g., tensorflow, pytorch, neural) where the file size is relatively small (between 50KB and 500KB), which may indicate potentially malicious payloads masquerading as legitimate AI utilities.
Detects the mounting of an ISO image via PowerShell using the Mount-DiskImage cmdlet. This behavior has been observed as a required preparation step for the RoguePlanet Windows Defender Local Privilege Escalation (LPE) proof-of-concept, which abuses Windows Defender behavior to elevate privileges from a standard user context to SYSTEM on fully patched Windows 10 and Windows 11 systems.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
The detection identifies an early stage of the attack chain rather than exploitation itself. Because ISO mounting is a legitimate Windows feature, organizations should correlate this activity with subsequent execution from the mounted image, Windows Defender-related events, or unexpected SYSTEM-level process creation to increase confidence and reduce false positives.
Detects execution of the TinyRCT backdoor by monitoring for suspicious instances of 'PerfWatson2.exe' running from non-standard locations (outside of the expected Visual Studio program directories) and specific instances of 'chrome_setup.exe' originating from user download directories matching a known malicious SHA256 hash.
Identifies the first-stage script downloading the Mach-O binary payload directly into /tmp/helper or /tmp/update using 'curl'.
Detects the creation of a LaunchAgent property list file in the user's Library directory that masquerades as an Apple-related process (com.apple.*). This behavior is associated with the macOS.Gaslight malware family, which uses such files for persistence, often with specific arguments like --type=renderer.
Gamaredon hides directories and replaces them with LNK files on removable media.
Detects the SilverFox loader performing sandbox and virtual machine evasion checks, including process enumeration (CreateToolhelp32Snapshot), heap pressure via VirtualAllocExNuma, and timing checks (QueryPerformanceCounter, NtAllocateVirtualMemoryApiCall). The detection focuses on specific process names and file paths associated with trojanized Panasonic/Philips OEM process contexts.
This rule detects the creation of Electron application files (electron.exe, app.asar, index.js, package.json) in unusual AppData\Local subdirectories by processes identified as UtilifySetup or Inno Setup. It leverages causality information to link the file creation to the installer process, aiming to identify potentially malicious Electron-based applications installed by suspicious installers.
Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.
Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for paths matching the regex `(?i)\AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\"` and excludes common browser executables like chrome.exe, msedge.exe, and update.exe to reduce false positives.
Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for processes executing from paths matching the regex `AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\` and excludes common browser executables like chrome.exe, msedge.exe, and update.exe to reduce false positives.
Detects potentially malicious drivers masquerading as Palo Alto components, specifically looking for drivers loaded from the 'drivers' folder that claim to be from 'Palo Alto' but have no signer or an invalid signature. This behavior has been associated with the ABYSSWORKER threat.
Detects the execution of a spoofed Adobe.application ClickOnce deployment manifest, often initiated by web browsers or the explorer process, indicating a potential phishing attempt.
Correlates the installation of TiFlux originating from a highly suspicious parent process (like an Office macro, wscript, or an unsigned executable).
Detects instances of common, sensitive Windows system binaries (svchost.exe, lsass.exe, sms.exe, csrss.exe) being executed by parent processes other than the legitimate system processes (services.exe, smss.exe, csrss.exe, winlogon.exe), indicating potential process masquerading or path spoofing.
Detects the execution of executable files with suspicious command line arguments related to AI or Machine Learning frameworks (e.g., tensorflow, pytorch, neural) where the file size is relatively small (between 50KB and 500KB), which may indicate potentially malicious payloads masquerading as legitimate AI utilities.
Detects the simultaneous launching of a clean decoy PDF and a malicious script (specifically PowerShell) within the same second, often used by malware like AsyncRAT for distraction during execution.
This rule detects the staging of 'NotepadPlusPlus.dll' within the '%APPDATA%\Microsoft\Windows' directory, potentially indicating a Clickfix attack. The presence of 'Start-Process' in conjunction with these strings further strengthens the detection.
Page 26 of 40