Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,636
12,583
8,393
6,224
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
This rule detects the presence of executables with names commonly associated with legitimate Windows system processes (e.g., system32.exe, winlogon.exe, svchost.exe) but located in non-standard directories outside of 'System32' or 'syswow64'. This behavior is indicative of masquerading, where an attacker attempts to hide malicious executables by naming them after legitimate system processes and placing them in unusual locations to evade detection.
Correlates the malicious executable launching the embedded decoy .docx document to divert user attention during infection.
Detects execution of mmc.exe from unusual file paths, specifically outside of standard Windows System32 or SysWOW64 directories. This behavior can indicate an attempt to impersonate legitimate system processes, potentially by malware like Brute Ratel C4.
Detects the use of the Windows built-in 'tar' utility to extract files into the C:\Users\Public\AccountPictures directory. This behavior has been observed in APT37 NarwhalRAT campaigns during its setup phase, indicating potential ingress tool transfer or staging of malicious files.
Detects files using double extensions to disguise executable payloads
This rule detects executables running from more than four levels deep within the AppData/Local directory, a technique often used by malware to mimic legitimate applications or cache directories like NVIDEO or 2.0 cache.
Detects local development directories where the compromised package matches a fake GitHub user repository URL, specifically looking for 'package.json' file events (creation or modification) within folder paths containing 'maximus-mcmillan'. This is indicative of the Stitch-SDK scope squatting credential harvester technique.
Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for paths matching the pattern AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\ and excludes common browser update processes.
This rule detects files commonly associated with endpoint detection and response (EDR) evasion techniques being staged within 'test' subfolders under a user's 'Documents' directory. The presence of such files (executables, DLLs, PowerShell scripts, or binaries) with names indicating 'loader', 'bypass', 'edr', 'inject', 'payload', 'agent', or 'defender' suggests an attacker is preparing to deploy or test EDR evasion tools on the workstation. This activity could precede a larger attack.
This rule detects the creation of suspicious executable files (.exe, .dll, .sys) in temporary or user-specific directories shortly after a Microsoft Defender component (MsMpEng, NisSrv) or system error reporting (WerFault) or service host (services) process terminates unexpectedly. This behavior can indicate an attempt to drop and execute malicious payloads following a potential exploit or crash of security software.
This rule detects the creation of suspicious executable files (.exe, .dll, .sys) in temporary or user-specific directories shortly after a Microsoft Defender component (MsMpEng, NisSrv) or system error reporting (WerFault) or service host (services) process terminates unexpectedly. This behavior can indicate an attempt to drop and execute malicious payloads following a potential exploit or crash of security software.
Detects the execution of the Windows built-in 'tar' utility to extract files into the specific public 'AccountPictures' directory. This behavior is indicative of the setup phase of APT37's NarwhalRAT.
Detects executions of specific renamed binaries (Genuine.exe, Updater.exe, AutoCAD242.exe) or the original Toolbox.exe utilizing the '-uiDll' flag. This is indicative of DLL side-loading behavior abused by OceanLotus to deploy the SPECTRALVIPER backdoor.
This rule detects the presence of executables with names commonly associated with legitimate Windows system processes (e.g., system32.exe, winlogon.exe, svchost.exe) but located in non-standard directories outside of 'System32' or 'syswow64'. This behavior is indicative of masquerading, where an attacker attempts to hide malicious executables by naming them after legitimate system processes and placing them in unusual locations to evade detection.
This rule detects when two or more files with suspicious names (e.g., 'update.exe', 'temp.exe', 'setup.exe') are created within a short timeframe (1 hour) in common user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. This pattern can indicate the dropping of malicious payloads or staging of files by an adversary.
This rule detects when two or more files with suspicious names (e.g., 'update.exe', 'temp.exe', 'setup.exe') are created within a short timeframe (1 hour) in common user-writable directories such as 'Temp', 'AppData', 'Downloads', or 'Public'. This pattern can indicate the dropping of malicious payloads or staging of files by an adversary.
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
Detects the execution of IntelAudioService.exe (a renamed dtlupdate.exe) using specific command-line arguments to side-load the SPECTRALVIPER backdoor. This activity is associated with OceanLotus (APT32) operations targeting Vietnam.
Detects Node.js or Bun processes making network connections to the GitHub API. This rule is designed to identify potential exfiltration attempts, specifically referencing the Miasma campaign which spoofs a 'python-requests/2.31.0' User-Agent to evade network detection while exfiltrating credentials to api.github.com/repos/.
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
Detects Hero proxyware artifacts being written or modified within the Windows SysWOW64 directory. Presence of these files may indicate installation of unauthorized proxy services or abuse of enterprise endpoints for traffic relaying.
Page 27 of 40