Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
This rule detects processes on Linux systems that masquerade as kernel worker threads (kworker). Legitimate kworker processes are kernel threads initiated by the kernel with no on-disk file path (or a bracketed path). The rule flags processes that have an actual file system path associated with them and are not spawned by the kernel thread manager (kthreadd), indicating potential malicious masquerading.
Detects an attacker-controlled SOCKS5 proxy masquerading as the Samba daemon (smbd) by renaming the process to 'smbd' and executing it with the '-D' flag from non-standard filesystem locations such as /tmp, /home, /var/tmp, or /dev/shm. This behavior is associated with the Velvet Ant threat group, which uses this technique to maintain persistent command-and-control communication while evading detection by blending in with legitimate system processes.
Detects execution of processes named 'Finder' or 'Software Update' that originate from within the '/Library/Application Support/' directory on macOS. This pattern is indicative of potential masquerading where malicious binaries or persistent payloads are placed in shared application support folders to mimic legitimate system components.
This rule detects command-line execution or activity containing specific strings associated with a fake 'damaged application' dialog box on macOS. This behavior is indicative of the PamStealer malware or similar social engineering campaigns that attempt to deceive users into believing their application is corrupt, thereby tricking them into interacting with malicious artifacts.
Detects Windows executables that write files with suspicious extensions
Detects the spawning of conhost.exe as a child process of wermgr.exe, an anomalous behavior indicative of the RoguePlanet exploit chain (CVE-2026-50656) which uses a Defender quarantine pipeline junction hijack to replace the legitimate Windows Error Reporting manager. Standard operations of the legitimate wermgr.exe process do not involve launching interactive console hosts.
Detects the Yuta .NET WPF dropper (SLaunch.exe) executing and subsequently creating a secondary payload (winupdate.exe) within the AppData\Roaming\.cache directory. This pattern is characteristic of the Yuta/Glove Stealer infection chain where a dropper masquerading as a UI component stages a PyInstaller-compiled stealer binary.
Detects the creation of suspicious scheduled tasks by potentially malicious processes (e.g., winupdate.exe or processes running from AppData/.cache or Temp directories). The rule monitors for schtasks.exe usage that either targets specific persistence locations or creates tasks naming conventions (e.g., 'WindowsDefenderAgent') often associated with the Yuta/Glove Stealer malware family.
Detects potential execution of Remcos Remote Access Trojan (RAT) components or process masquerading activity involving 'explorer.exe'. The rule identifies suspicious file paths (e.g., ProgramData\Remcos\) and instances where processes named 'explorer.exe' execute from non-standard Windows directories, indicating an attempt to hide malicious activity or masquerade as a legitimate Windows system process.
Detects the EKZ Stealer malware (masquerading as 'FortiEndpoint_Patch.exe') attempting to access sensitive web browser files ('Login Data' and 'Local State') used to store credentials, and subsequently writing stolen information to 'C:\ProgramData\log.txt'.
Detects the presence and execution of 'FortiEndpoint_Patch.exe' from non-standard locations (C:\ProgramData) used for masquerading, or the invocation of the ElevationKatz command-line tool (runhlp.exe --v20-decrypt) used to perform credential decryption.
Detects the creation of a Windows Registry Run key that points to an executable named 'ssh-add.exe' located in 'C:\ProgramData\Google Update'. This behavior is associated with the ResiLoader malware, which uses this technique for persistence by masquerading as a legitimate Google update process.
Detects spearphishing activity involving project-related lure archives, subsequent file drops of potentially malicious DLLs and executables (sideloading indicators), and the execution of processes masquerading as the lure documents.
This rule detects activities associated with the OceanLotus (APT32) supply-chain compromise, specifically targeting the SPECTRALVIPER loader chain. It identifies the masqueraded execution of 'IntelAudioService.exe' and specific sideloading carriers (AutoCad242.exe, Genuine.exe, Updater.exe) utilizing the '-uiDll' flag, the loading of the 'DtlCrashCatch.dll' malicious module, and network beaconing to known APT32 C2 infrastructure.
Detects unauthorized executables masquerading as XDR agents (Palo Alto Networks) or VMware tools (XDRAgent.exe, vmtools.exe, vmwared.exe) by executing from suspicious directories such as AppData, Temp, or ProgramData\VMware instead of authorized installation paths. This technique is often used to hide the execution of malicious tools like reverse tunnel clients or VPN utilities.
Detects the execution of wermgr.exe from a non-standard directory, specifically targeting the RoguePlanet junction-hijacking technique where the Windows Error Reporting process is replaced by an attacker-controlled binary under a staging path (e.g., %TEMP%\RP_*).
Detects malicious browser extensions associated with the StegoAd campaign fetching steganographic payloads (WebP/PNG) from known C2 infrastructure. The detection identifies requests originating from a browser extension context (via Referer header) that target specific image files commonly used by the malware for post-compromise staging and execution guardrail fingerprinting.
Detects suspicious browser-downloaded executables using image, screenshot, document, invoice, scan, or receipt-themed filenames that execute from user-writable locations and are followed by suspicious payload creation, Run-key persistence, or outbound network activity. This behavior is commonly associated with malware loaders, fake image/document lures, and user-executed initial access payloads.
Detects the execution of wusvc.exe (Windows Update Service) from suspicious locations such as Downloads or Temp folders with high integrity level, which is characteristic of masquerading techniques used by adversaries to hide malicious activity as a legitimate system process.
This rule detects suspicious process creations where common system processes (svchost.exe, explorer.exe, lsass.exe, winlogon.exe) act as parent processes for scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe) and the child process runs with a low or untrusted integrity level. This pattern can indicate process injection or other forms of malicious execution where an attacker attempts to hide their activity by masquerading as legitimate system processes.
This rule detects instances of specific DLLs (Qt5Core.dll or opera_elf.dll) being loaded by known suspicious executables (WizardDa42.exe or AlphVector.exe) from non-standard, potentially user-writable directories like ProgramData or Temp. The rule further filters to include instances where the module's signature is invalid, unsigned, or untrusted, which is characteristic of malicious process masquerading or side-loading.
Page 16 of 33