Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
Detects the execution of a process named 'AppLaunch.exe' from a directory other than the standard .NET Framework installation paths. Adversaries may masquerade as this legitimate .NET binary to evade detection, as it is a trusted system utility.
Detects DLL sideloading of the TriBack Loader via three abused signed host binaries - Microsoft ServiceHub (hostfxr.dll), G DATA AVK (avk.dll), and Windows Defender MpCopyAccelerator (MpClient.dll) - each loading a malicious DLL of the same name from an unexpected, non-vendor location instead of the legitimate installation directory.
Detects instances of process hollowing involving specific security product images (Qihoo 360) or identified binaries (MegArray.exe, Crisp.exe) as indicated by process tampering logs. This behavior is associated with advanced threat activity potentially attempting to masquerade malicious execution under trusted or known-path binary contexts.
Detects instances of process hollowing involving specific security product images (Qihoo 360) or identified binaries (MegArray.exe, Crisp.exe) as indicated by process tampering logs. This behavior is associated with advanced threat activity potentially attempting to masquerade malicious execution under trusted or known-path binary contexts.
Detects regsvr32.exe silently registering an OCX file staged in a user-writable temp or local app data directory when spawned from a browser, shell, or Run-dialog parent process.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
This rule identifies instances where files with specific extensions (.dll, .py) or the python executable are created on a system shortly after (or exactly at) the observed creation timestamp of notepad.exe. This logic aims to detect potential masquerading or side-loading techniques where attackers may attempt to hide their activities or establish persistence by mimicking or piggybacking on standard utility usage.
This rule detects 'Push', 'Put', or 'PutManifest' operations on the 'mongo' repository using specific tags ('mongofr', 'latest'), which may indicate an attempt to overwrite or inject a malicious container image into a critical database registry.
This rule detects the creation or presence of a file named 'kbdus1.dll' within the Windows System32 directory. This filename is designed to look like the legitimate Windows keyboard layout DLL 'kbdus.dll' by appending a '1'. Threat actors, specifically associated with the Stupig backdoor, utilize this masquerading technique to blend in with legitimate system files and evade detection by security monitoring tools that rely on filename-based filtering.
Detects the LuaJIT interpreter (luajit.exe) or the AutoIt3 interpreter (AutoIt3.exe) being used to execute a file with a .ttf, .au3, or .a3x extension from %PUBLIC%\Libraries as a script argument. This technique is used in the TTF Trap campaign where a malicious Lua loader is disguised as a TrueType Font file and passed as a parameter to the dropped LuaJIT 2.1.0-beta3 interpreter, or alternatively executed via AutoIt3 as an equivalent execution vehicle, to evade detection.
System File Execution Location Anomaly
Cortex XDR
Detects common Windows system binaries (e.g., svchost.exe, rundll32.exe, powershell.exe) executing from non-standard, suspicious file paths. This behavior is often indicative of adversaries attempting to masquerade malicious executables by renaming them or placing them in paths to mimic legitimate system processes.
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Detects Microsoft 365 Outlook calendar events being updated via Graph API where the subject is changed to a suspicious C2-like string (e.g., 'Boss Report ID:' or 'Boss update ID:'). This behavior is consistent with attackers using Outlook calendar events as a covert communication channel or for command and control signaling.
Detects instances of 'RuntimeBroker.exe' executing from a directory other than the standard Windows System32 location, specifically when the command line includes a known cryptocurrency wallet address string. This behavior is indicative of potential masquerading or malicious activity where a legitimate Windows system binary name is abused to execute unauthorized commands or facilitate cryptocurrency-related tasks.
Detects the use of GDI functions (GetDC, CreateCompatibleBitmap, BitBlt, GetDIBits) combined with suspicious base64 encoding activity by a process masquerading as an NVIDIA binary (nvidia-sysruntime.exe). This behavior is indicative of screen capture and exfiltration attempts typical of the LabubaRAT implant.
Detects the LuaJIT interpreter (luajit.exe) or the AutoIt3 interpreter (AutoIt3.exe) being used to execute a file with a .ttf, .au3, or .a3x extension from %PUBLIC%\Libraries as a script argument. This technique is used in the TTF Trap campaign where a malicious Lua loader is disguised as a TrueType Font file and passed as a parameter to the dropped LuaJIT 2.1.0-beta3 interpreter, or alternatively executed via AutoIt3 as an equivalent execution vehicle, to evade detection.
Suspicious wermgr.exe Creation Outside System Directory
Detects the use of GDI functions (GetDC, CreateCompatibleBitmap, BitBlt, GetDIBits) combined with suspicious base64 encoding activity by a process masquerading as an NVIDIA binary (nvidia-sysruntime.exe). This behavior is indicative of screen capture and exfiltration attempts typical of the LabubaRAT implant.
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Page 14 of 33