Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects instances of process hollowing involving specific security product images (Qihoo 360) or identified binaries (MegArray.exe, Crisp.exe) as indicated by process tampering logs. This behavior is associated with advanced threat activity potentially attempting to masquerade malicious execution under trusted or known-path binary contexts.
Detects instances where a process named 'symantec.exe' is executed from a path other than the standard Symantec installation directories. This behavior is indicative of an attempt to disguise a malicious executable as a legitimate Symantec software component.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. UNC6692 ("Snow Flurries") impersonates IT helpdesk over Teams, lures victims to a fake "Mailbox Repair Utility" page, and delivers a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects instances where a process named 'svchost.exe' is executed from common temporary file paths, which is characteristic of malware attempting to masquerade as the legitimate Windows Service Host process.
Detects the execution of the legitimate AnyDesk remote access tool when it is launched from a non-standard file path containing '\music\', which may indicate an attempt to hide the executable in a less suspicious directory.
Detects a malicious binary masquerading as a Symantec executable (symantec.exe) staged in the user's Music directory. The rule triggers on a known file hash or the combination of the specific filename and file path, indicative of a dropper attempting to install the PoisonX kernel driver.
Detects the use of GDI functions (GetDC, CreateCompatibleBitmap, BitBlt, GetDIBits) combined with suspicious base64 encoding activity by a process masquerading as an NVIDIA binary (nvidia-sysruntime.exe). This behavior is indicative of screen capture and exfiltration attempts typical of the LabubaRAT implant.
Detects the execution of application bundles that mimic legitimate macOS system applications (Finder or Software Update) but originate from non-standard system paths. This behavior is indicative of masquerading techniques used by malware, such as the PamStealer, to execute hidden or unauthorized processes while appearing legitimate.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
Detects file write, creation, or modification of C:\Windows\System32\TieringEngineService.exe
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
by any process other than legitimate Windows servicing components. The RedSun exploit
(CVE-2026-33825) overwrites this binary via a Defender cloud-file-rollback redirection
abuse, enabling SYSTEM-level code execution when the Tier Management Engine COM object
is subsequently invoked. Legitimate modification of this file is almost exclusively
performed by TrustedInstaller during Windows servicing operations.
Detects creation of the NVIDIA-themed single-instance mutex 'Local\NVIDIAContainerMonitor_SingleInstance' used by LabubaRAT to prevent multiple concurrent implant executions.
Detects the Snowlight dropper (UNC5221) installing a new Windows service named 'Windows Update Service' that utilizes a non-standard executable file named 'wusvc.exe' to achieve persistence and masquerade as the legitimate Windows Update service (wuauserv).
Detects the creation or presence of a file named 'svehost.exe' (a common typo-squat for 'svchost.exe') within the 'C:\Users\Public\AppData\Windows' directory. This behavior is indicative of an adversary attempting to masquerade a malicious executable by mimicking a legitimate Windows service process name and placing it in a non-standard, often-abused location.
Detects DNS queries for known typosquatted domains associated with Command and Control (C2) activity. The rule monitors for queries targeting lookalike domains impersonating well-known brands such as Microsoft, Google, Facebook, and various VPN services.
Detects the execution of a malicious MSI installer masquerading as a legitimate Microsoft FIXMAPI utility. The rule flags suspicious MSI command lines or the presence of the AICustAct.dll component (associated with Advanced Installer) within paths containing the misspelled publisher 'Microsoft Coporation' or the 'Microsoft FIXMAPI' utility string.
Detects credential harvesting behavior by non-browser processes attempting to access browser credential storage (Login Data/Local State files) and identifies execution of the masquerading binary 'FortiEndpoint_Patch.exe' and the creation of the 'log.txt' artifact in C:\ProgramData used by the EKZ Stealer.
Detects the creation of a Windows Registry Run key containing a misspelling of 'Microsoft Corporation' (as 'Microsoft Coporation') which is configured to launch 'fixmapi.exe'. This pattern is indicative of a persistence mechanism masquerading as a legitimate Microsoft process.
Detects the execution of unsigned binaries located in directories typically excluded from EDR/AV scanning, such as Windows Defender folders, security vendor installation directories, and quarantine locations. Attackers utilize these paths to bypass file-system monitoring and on-execute detection by taking advantage of pre-configured security exclusions.
Detects the abuse of the Windows Error Reporting (WER) service mechanism, specifically targeting the 'QueueReporting' scheduled task. Attackers may employ junction-based path redirection to execute a malicious wermgr.exe binary located outside of the standard system directory. The rule identifies instances where wermgr.exe is running from non-standard locations, or running at SYSTEM integrity level spawned by standard task-related parent processes, which indicates a potential privilege escalation or persistence attempt (linked to CVE-2026-50656).
Detects potential Millenium RAT activity where a process masquerading as a legitimate system file (e.g., svchost.exe or MsEdgeUpdate.exe) is executed from a non-standard directory and subsequently initiates network communication with the Telegram Bot API within a one-hour window. This behavior is indicative of malware beaconing and exfiltrating victim profiling data.
Detects suspected RomulusLoader activity by identifying the sideloading of 'vulkan-1.dll' from non-standard directories, the creation of encrypted 'vulkan-1.bin' payload files, and the loading of unsigned DLLs from user-writable directories (Temp/AppData) by otherwise signed processes.
Page 15 of 33