Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
This rule detects screen capture activities associated with DcRAT, Millenium RAT, and Operation DragonReturn. It identifies the creation of specific staging files (e.g., debug.txt, background.jpg) at sensitive paths and monitors for non-standard or masquerading processes (such as svchost.exe running outside System32) that create image files in user-writable or temporary directories. The rule uses tiered logic, assigning a higher risk score to known IOC patterns and periodic capture behavior.
RMM: ScreenConnect
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Theme: DocuSign
URL: hxxps://vy.ijnggpi[.]com/ftx/
MSI Download URL: hxxps://web-g63lkz.screenconnect[.]com/Bin/ScreenConnect.ClientSetup.msi
SHA256: a30a9779079dc897a15fed27f27f614fab77a20e953368808ba99ac6c6a3375b
Detects the Grixba infostealer (associated with Play ransomware operations) by identifying the loading of the XOR-encrypted payload 'inf_g.dll' from commonly abused directories like Temp, AppData, ProgramData, or the Public folder, particularly when the file is unsigned.
Detects instances of the 'systemd-userdbd' process that are either spawned from an unexpected parent process or exhibit path-based anomalies (such as running from 'node' or 'node_modules' directories), which may indicate masquerading or malicious activity.
Detects a Perl-based SOCKS proxy used by the threat actor Velvet Ant that masquerades as the legitimate smbd process by running with 'smbd -D' command line arguments while listening on non-standard port 5000.
This rule detects modifications (such as write, rename, create, or delete events) to critical Linux system files including SSH binaries (sshd, ssh, scp) and PAM authentication modules (pam_unix.so). These files are common targets for adversaries seeking to establish persistence, bypass authentication mechanisms, or gain unauthorized access to credentials.
Detects the creation of executable files with suspicious naming patterns within the C:\ProgramData directory. The rule filters for files with specific file extensions or high-entropy name patterns that do not match common Windows executable file types, potentially indicating staging of malicious payloads.
Detects the DRAYN malware which masquerades as a VSCode or Microsoft installer. The rule looks for a silent 7ZipSfx installation that drops a temporary file (agent.tmp), performs C2 communication over WebSockets to a specific IP address (34.244.31.76), and establishes persistence via a RunOnce registry key using a modified vcredist_x86.exe execution.
Detects macOS.Gaslight DPRK-aligned implant registering a LaunchAgent plist using the com.apple.system.services.activity label to masquerade within Apple's com.apple.* namespace for persistence. Key behavioral indicators include file writes to ~/Library/LaunchAgents with the spoofed label and use of __NSGetExecutablePath for binary path resolution.
Detects Millenium RAT payloads that masquerade as legitimate Windows processes (such as MsEdgeUpdate or svchost.exe) by running from temporary directories (AppData or Temp). The rule also monitors for associated persistence mechanisms via HKCU Run registry keys.
Detects the use of the Windows Service Control Manager (sc.exe) to create, delete, or start a service named 'MixedSvc', or attempts to execute a process masquerading as 'Mixed Reality.exe' from a suspicious directory (Windows Media Player folder). These activities are often associated with persistence or masquerading techniques used by threat actors.
Detects multi-stage cryptojacking campaign: autorun.dll sideload, silent msiexec install, and post-exploitation .NET binary process hollowing
Detects the loading or execution of the Grixba infostealer payload 'inf_g.dll' or processes executing from the known Grixba RDP drop path located at 'C:\Users\Public\Music\'. Grixba malware, associated with the Play ransomware group, often disguises its components to appear like legitimate software (e.g., SentinelOne). The rule filters out legitimate module loads occurring from authorized SentinelOne installation paths to reduce noise.
Detects the creation of scheduled tasks using the schtasks utility that masquerade as legitimate update services (MicrosoftEdgeUpdate or GoogleUpdaterTaskSystem). These tasks are configured to run at logon with highest privileges, specifically aiming to persist the TinyRCT backdoor (associated with files such as vmwared.exe or vmtools.exe) in ProgramData directories.
Detects HTTP GET requests to known malicious infrastructure used in SEO poisoning campaigns to distribute the Bumblebee malware loader. The rule monitors for specific URL paths and hostnames associated with lookalike domains delivering trojanized MSI files.
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Detects wermgr.exe masquerading outside legitimate system directories, associated with the Nightmare Eclipse exploit chain.
Detects instances of the svchost.exe process running from an unexpected parent process or with unusual command-line arguments. Legitimate svchost.exe instances are typically spawned by services.exe or wininit.exe and utilize specific command-line flags. This rule identifies potential masquerading attempts where malicious actors name a process svchost.exe to evade detection.
Nightmare Eclipse (also known as Chaotic Eclipse) publicly released MiniPlasma, a zero-day local privilege escalation exploit granting SYSTEM-level access, exploiting a previously believed-patched flaw rooted in the Cloud Filter driver's HsmOsBlockPlaceholderAccess routine. As part of post-exploitation activity, the technique involves launching a process named wermgr.exe (Windows Error Reporting Manager) from a directory other than its legitimate system paths — a masquerading technique (T1036.005) used to blend in with normal Windows telemetry while evading naive name-based allowlisting. This detection identifies that specific anomaly: process creation events where the image name is wermgr.exe but the launch path falls outside System32, SysWOW64, WinSxS, servicing, or Windows Update staging directories. This rule should be paired with the registry IoC (symbolic-link creation under CloudFiles\BlockedApps) and scheduled-task abuse (QueueReporting) for full chain coverage, since the process-creation anomaly alone is a downstream artifact rather than the initial exploitation step.
Detects the download, staging, and execution of SoftEther VPN components associated with CL-STA-1062. The rule monitors for the creation of specific SoftEther files, network downloads from known actor staging infrastructure, and the execution of SoftEther binaries masquerading as VMware tools (vmtools.exe).
Detects execution of SoftEther VPN binaries (vpnclient, vpnserver, vpncmd, vpnbridge) from non-standard directories such as ProgramData, Temp, or AppData. It also identifies masquerading attempts where these binaries are renamed to vmtools.exe or vmwared.exe, and detects execution with specific VPN client/server command line flags outside of the expected installation directory. This rule is designed to identify covert tunneling activities and potential persistence mechanisms used by threat actors.
Page 17 of 33