Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects the creation of executable files within the C:\ProgramData\ directory initiated by common command-line interpreters (cmd.exe, powershell.exe, wscript.exe, svchost.exe). This pattern is often indicative of the SystemBC backdoor or similar malware attempting to drop its executable payload in a non-standard, persistent location to evade initial detection.
Detects fileless execution of the MYRA Linux RAT, which utilizes memfd_create and fexecve to load an ELF binary directly into memory. The detection identifies malicious payloads masquerading as the systemd-userdbd process when spawned by non-standard parent processes such as shell interpreters, node, or npm, as well as abnormal command-line arguments.
Detects execution of a SimpleRunPE-style loader from common user-writable directories such as Downloads, Temp, AppData, or Public paths. This behavior is often associated with malware attempting to evade detection by executing from non-standard locations.
Detects modification or replacement of a trusted-looking executable or DLL located in a directory writable by standard users. This rule specifically looks for file write events (NewExecutableWritten, FileWritten, FileCreateInfo, FileDeleteInfo) where the target file is an executable (.exe) or dynamic link library (.dll) and is located in common world-writable directories such as \Users\Public\, \ProgramData\, \AppData\, or \Temp\. Additionally, it filters for processes whose command line or base file name suggests a loader, updater, or common command-line utilities (cmd.exe, powershell.exe) initiating these writes, indicating potential masquerading or DLL hijacking.
Detects the 'node' process creating hidden JavaScript or native loader files (e.g., .js, .node, .so, .dylib, .bin) in user profile or temporary directories. This activity is indicative of the OpenClaw malware's staging phase, where it drops its components for persistence or further execution.
Detects the creation of specific files ('Mixed Reality.exe' or 'nvdaHelperRemote.dll') within the 'C:\Program Files\Windows Media Player\' directory. This activity is a known technique used by the threat actor group associated with Operation DragonReturn (Silver Fox) to stage DLL sideloading, facilitating the persistence of malware such as DcRAT or XenoRAT.
Detects bulk process enumeration performed by suspicious or masquerading processes using Windows system APIs (CreateToolhelp32Snapshot, NtQuerySystemInformation, ProcessSnapshot). This activity is often associated with post-compromise reconnaissance and information gathering, specifically seen in Millenium RAT variants.
Detects inbound emails from external domains that leverage generic automated sender display names (e.g., 'DocuSign', 'No-Reply') and deliver PDF attachments with lure filenames commonly associated with document-based phishing campaigns (e.g., 'Agreement', 'Settlement'). The rule specifically monitors for these indicators when the subject line also contains executive-level keywords, indicating a targeted phishing attempt against C-Suite personnel.
Detects rapid staging of multiple files (3+ within 1 minute) with varying executable and script extensions (.dll, .bat, .dat, .exe, .pyd) in a non-standard subdirectory under AppData\Roaming. This behavior is characteristic of LegionLoader and Traiolx Custom Utils payload staging activities. The rule excludes common system processes to minimize noise.
Detects instances of common, sensitive Windows system binaries (svchost.exe, lsass.exe, sms.exe, csrss.exe) being executed by parent processes other than the legitimate system processes (services.exe, smss.exe, csrss.exe, winlogon.exe), indicating potential process masquerading or path spoofing.
Detects indicators of execution related to a known NPM Remote Access Trojan (RAT), including masquerading via chost.exe, execution from specific temporary directories used by the malware, and Python scripts executing a loader.py file from temporary locations.
Detects the Bumblebee loader technique where a trojanized installer drops the legitimate Windows binary consent.exe and a malicious msimg32.dll into a temporary directory. The rule flags instances where consent.exe loads msimg32.dll from an AppData subfolder, indicating a DLL search order hijacking attempt rather than loading the trusted system library.
Detects indicators of Grandoreiro banking trojan infection, including the loading of associated malicious DLLs from user-writable AppData directories, the execution of the specific binary 'ROt4I@m$etqv1Ns.exe' via script interpreters, and the spawning of unsigned executables from AppData by wscript.exe or cscript.exe.
Detects the creation or loading of specific DLL files identified as part of the Turla STOCKSTAY malware framework. The rule monitors both file system operations (creation, modification, renaming) and process image loads to identify indicators of this specific campaign.
Detects network communication behavior consistent with the TinyRCT backdoor. The rule identifies instances where a process named 'PerfWatson2.exe' attempts to establish HTTP GET or POST connections to a known malicious IP address (45.32.113.172), signaling potential C2 beaconing activity using an encrypted channel.
Detects core Windows system processes (svchost.exe, lsass.exe, csrss.exe, winlogon.exe) executing from non-standard locations other than System32 or SysWOW64. This is a common indicator of process masquerading, where malicious actors rename or move their executable to blend in with legitimate system activity.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
Detects instances where a signed process loads a DLL or module that is either unsigned or located in a suspicious, typically user-writable or temporary directory. This behavior is indicative of DLL hijacking or side-loading attempts where an attacker attempts to execute arbitrary code within the context of a trusted application.
This rule detects common security product executables (MsMpEng.exe, SenseNdr.exe, csfalconservice.exe, CylanceSvc.exe) that are running from file paths inconsistent with their legitimate installation directories. This behavior is indicative of an adversary attempting to masquerade as trusted security software to evade detection or achieve persistence.
Detects instances of the svchost.exe process running from an unexpected parent process or with unusual command-line arguments. Legitimate svchost.exe instances are typically spawned by services.exe or wininit.exe and utilize specific command-line flags. This rule identifies potential masquerading attempts where malicious actors name a process svchost.exe to evade detection.
Detects the execution of known critical system processes (e.g., svchost.exe, lsass.exe) from directories other than the standard Windows System32 or SysWOW64 paths. This behavior is indicative of masquerading, where an adversary attempts to evade detection by naming malicious files after legitimate system binaries.
Page 21 of 33