Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
This rule detects an unusually high number of file rename events (20 or more within a 1-hour window) initiated by a single process account. This behavior can be indicative of malicious activities such as data staging prior to exfiltration, ransomware encryption, or attempts to evade detection by renaming malicious files or legitimate system utilities.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
This rule detects HTTP requests where the User-Agent header appears to be faked or malformed. Specifically, it looks for a User-Agent string that starts with 'Mozilla/5.0' followed by an opening parenthesis, and then contains at least 200 characters before a closing parenthesis. This pattern is often used by malicious actors to evade detection by making their User-Agent string unusually long and potentially obfuscated, while still mimicking a common browser prefix.
This detection identifies suspicious execution of update.exe processes launched by svchost.exe from user-writable directories such as AppData, Temp, Downloads, and Public folders.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This query is a security detection rule: it flags when image file operations occur in tandem with executable file operations, which is often a sign of potential malware or intrusion activity.
his detection identifies suspicious execution of update.exe processes launched by svchost.exe from user-writable directories such as AppData, Temp, Downloads, and Public folders.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
Detects suspicious scheduled task creation using schtasks.exe with XML task imports from user-writable directories such as AppData\Local. This behavior is associated with malware families like JustAskJacky, which establish persistence by creating GUID-named scheduled tasks that execute malicious payloads such as node.exe and obfuscated JavaScript files.
ASP.NET ViewState Verification Failure
Cortex XDR
This rule detects ASP.NET ViewState verification failures, specifically looking for Event ID 1316 and event message containing 'Event code: 4009'. This can indicate an attempt to tamper with the ViewState, potentially leading to deserialization vulnerabilities or other web application attacks.
Detects the execution of 'active_desktop_launcher.exe' (a legitimate signed KuGou binary) from unusual directories like ProgramData or AppData\Local\Temp. This behavior indicates potential DLL side-loading staging by the BoldTealLayer malware prior to executing its in-memory evasion chain.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
This rule detects the use of specific command-line flags in Google Chrome processes that are associated with the FlutterShell backdoor. These flags, '--hide-crash-restore-bubble' and '--disable-session-crashed-bubble', are used by FlutterShell to suppress crash warnings after forcing a restart, indicating an attempt to evade detection or maintain persistence.
This rule detects a high volume of process creation events (EventID 4688) where the command line contains keywords indicative of patching or updating activity (e.g., 'patch', 'update', 'KB', 'hotfix'). Specifically, it triggers if 3 or more such events occur on a single computer within an hour. This could indicate legitimate system updates, but also potentially malicious activity masquerading as updates to evade detection or perform unauthorized actions.
This rule detects the loading of modules (DLLs or executables) from user-specific AppData folders that are not commonly observed across the environment. It specifically excludes common legitimate paths within AppData like 'Local\Programs' and 'Local\Temp' to reduce false positives. The rule identifies modules loaded by processes that also originate from an AppData folder, indicating potentially suspicious activity such as malware or custom tools operating from user-writable locations.
Detects Hero proxyware artifacts being written or modified within the Windows SysWOW64 directory. Presence of these files may indicate installation of unauthorized proxy services or abuse of enterprise endpoints for traffic relaying.
Identifies ScreenConnect client service execution initiated by trusted system processes (dfsvc.exe, services.exe) while referencing suspicious top-level domains (.top, .info, .site, .tk, .xyz, .pw, .ml, .club, .cf, ws) in the command line. This activity may indicate unauthorized remote access deployment or abuse of legitimate remote access tools.
This rule detects the loading of modules (DLLs or executables) from user-specific AppData folders that are not commonly observed across the environment. It specifically excludes common legitimate paths within AppData like 'Local\Programs' and 'Local\Temp' to reduce false positives. The rule identifies modules loaded by processes that also originate from an AppData folder, indicating potentially suspicious activity such as malware or custom tools operating from user-writable locations.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Detects git commits authored by claude@users.noreply.github.com that may indicate
repository poisoning by the Mini Shai-Hulud worm.
repository poisoning by the Mini Shai-Hulud worm.
Detects git commits authored by claude@users.noreply.github.com that may indicate repository poisoning by the Mini Shai-Hulud worm.
Detects the execution of binaries hidden in the C:\ProgramData directory with a .log extension matching a specific random pattern used by threat actors. This technique is often used for defense evasion and masquerading.
Detects the creation of an executable file named 'sysd' in the '/usr/local/bin/' directory on Linux systems. The Nexcorium Mirai variant copies itself to this location to masquerade as a legitimate system process for persistence. This specific file name is not a standard Linux system daemon.
Page 28 of 40