Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
This rule monitors for suspicious activity involving wermgr.exe and Windows Defender quarantine directory. It detects wermgr.exe being written to or executed from non-standard temporary paths (often associated with potential junction-redirected payload execution), non-MsMpEng processes writing to the Windows Defender quarantine folder, and the creation of NTFS Alternate Data Streams (ADS) named :WDFOO within temporary directories.
This rule identifies processes masquerading as common Windows system binaries (e.g., svchost.exe, lsass.exe) by executing from non-standard, suspicious file paths like temporary directories or user profiles instead of legitimate system directories (e.g., C:\Windows\System32).
Detects the execution of known debugger/disassembler tools (Ghidra, dnSpy, x64dbg) that exhibit suspicious network behavior. The rule specifically looks for these tools initiating network connections to destinations outside of their official update or project domains shortly after execution, and filters out known good hash signatures.
Detects the execution of known debugger/disassembler tools (Ghidra, dnSpy, x64dbg) that exhibit suspicious network behavior. The rule specifically looks for these tools initiating network connections to destinations outside of their official update or project domains shortly after execution, and filters out known good hash signatures.
This rule detects instances where a process named 'systemd-userdbd' is executed from a file path other than the standard locations ('/lib/systemd/systemd-userdbd' or '/usr/lib/systemd/systemd-userdbd'). Such behavior is often indicative of masquerading, where malicious actors rename their executables to match legitimate system services to evade detection. The rule additionally flags when the parent process is a common interpreter or package manager, which increases the likelihood of malicious activity.
Detects execution of DWAgent from download or temporary directories rather than standard installation locations, potentially indicating unauthorized remote management activity.
Detects DLL sideloading behavior by the threat group OceanLotus (APT32), specifically targeting instances where legitimate Autodesk or HP Toolbox executables (Genuine.exe, Updater.exe, AutoCAD242.exe) are executed with the -uiDll command-line flag. This technique is used to load malicious DLLs (referred to as SPECTRALVIPER) from masqueraded, non-standard file paths such as %LOCALAPPDATA%\Autodesk or C:\Windows\appcompat, facilitating persistence and execution.
Detects two distinct suspicious activities on Linux systems: masquerading by processes named 'uptime' making outbound network connections to non-local IP ranges, and the execution of binaries associated with AtlasRAT.
This rule detects instances where a process loads a DLL from suspicious, commonly user-writable directories (such as Temp, AppData, ProgramData, or Public). It filters for DLLs that lack standard file metadata (FileVersion/Description) or contain an OriginalFileName mismatch, which is often indicative of side-loading or malicious library injection. The rule further correlates this event with a network connection initiated by the same process to highlight potential C2 activity associated with the suspicious DLL load.
Detects the execution of GSocket (gs-netcat), a network tool often used for establishing persistent backdoors, interactive shells, or SOCKS proxies. The rule identifies execution with common flags for daemonization, interactive shell access, or SOCKS proxying, as well as instances where the process masquerades as common system binaries (e.g., smbd, sshd) or is initiated from system persistence directories like systemd or init.d.
This rule detects two suspicious behaviors associated with OpenSSH components: the direct modification or replacement of critical OpenSSH binaries (/usr/sbin/sshd, /usr/bin/ssh, /usr/bin/scp), or the use of these processes to write files to suspicious or non-standard locations (such as /tmp/ or unauthorized subdirectories within /var/log/), which may indicate credential harvesting or the presence of a backdoor.
Detects instances of the MYRA RAT process masquerading as the systemd-userdbd daemon. The detection identifies the malicious payload being executed from the /usr/lib/systemd/systemd-userdbd path with command-line arguments typically used by the legitimate system utility, indicating that the Node.js binary has been replaced or copied to evade detection.
Detects the loading of an unsigned DLL by 'quick_share.exe', 'NearbyShare.exe', or 'nearby_sharing.exe' from suspicious directory paths such as User Temp, AppData, or Downloads folders. This behavior is highly indicative of DLL side-loading attempts where an adversary leverages a legitimate, known process to execute malicious code.
Detects the TuglaInsaatci steganographic loader technique where a randomly-named executable is dropped directly into the user's AppData\Roaming directory and subsequently launched within a short timeframe. This behavior is indicative of a self-copying persistence mechanism frequently used in campaigns like FortiBleed.
Identifies the browser process saving a .zip file whose name explicitly spoofs an application update, matching the SocGholish social engineering lure.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
This rule detects potential Remote Access Trojan (RAT) activity by identifying specific indicators associated with Nuitka-compiled binaries, specifically the 'chost.exe' filename or paths containing 'win-driver-xd7d'. Additionally, it monitors for suspicious Python-based loader executions ('loader.py') initiated from temporary directories, which is a common persistence or execution technique for such malware.
Detects the creation or execution of files named 'RuntimeBroker.exe', 'Telemetry.exe', or 'WindowsRunetimeBroker.exe' within the AppData folders. These filenames are commonly abused by adversaries to masquerade as legitimate system processes to evade detection.
This rule monitors for suspicious process execution and module loading events, specifically targeting file paths and configurations associated with potential AppDomain Manager injection or masquerading techniques (e.g., PerfWatson2.exe, VMware tools, or Chrome setup configurations). It correlates Sysmon and Security event logs to detect known malicious patterns or abnormal file behaviors.
Detects the execution of known tunneling binaries or binaries masquerading as common security and management agents (e.g., XDRAgent, vmtools, vmwared) with suspicious command-line arguments indicative of reverse tunnel establishment or C2 activity.
Detects the creation of executable files within the C:\ProgramData\ directory initiated by common command-line interpreters (cmd.exe, powershell.exe, wscript.exe, svchost.exe). This pattern is often indicative of the SystemBC backdoor or similar malware attempting to drop its executable payload in a non-standard, persistent location to evade initial detection.
Page 20 of 33