Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects the creation or modification of a file named 'dui70.dll' (or variants if renamed) within non-standard, user-writable directories such as AppData or Temp. This behavior is indicative of malware, specifically the OXLOADER payload, preparing for module-stomping by placing a malicious DLL copy outside legitimate Windows System32 or SysWOW64 paths.
This rule detects suspicious file creation/modification events in common temporary or library directories, or suspicious process creation/execution events, that contain specific developer-related strings. These strings, such as 'OOMWorker process killed by OOM killer', 'Token expiration handling', 'Refresh token logic seems flaky', 'Build failed on main', and 'SQL Injection vulnerability', could indicate the presence of development tools, debugging activity, or potentially malicious scripts/binaries attempting to mimic legitimate development processes or exfiltrate sensitive information. The rule also looks for a specific SHA256 hash, which might be associated with known malicious or suspicious files.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
This rule detects scenarios where a legitimately signed process loads a DLL from a user-writable path (e.g., Downloads, Temp, or AppData). It correlates file creation/modification events for DLLs in these suspicious directories with subsequent image load events by signed processes, a common indicator of potential DLL side-loading or hijacking.
This rule detects common security product executables (MsMpEng.exe, SenseNdr.exe, csfalconservice.exe, CylanceSvc.exe) that are running from file paths inconsistent with their legitimate installation directories. This behavior is indicative of an adversary attempting to masquerade as trusted security software to evade detection or achieve persistence.
This rule detects the creation or loading of a .sys file (kernel driver) within the Windows Fonts directory by a non-standard loader. This behavior is suspicious as the Fonts directory is not a typical location for kernel drivers, and the use of common command-line interpreters (cmd, powershell, pwsh, rundll32, regsvr32) or other executables to stage or load such files indicates potential malicious activity, possibly related to defense evasion or persistence.
Detects instances where the process SystemSettings.exe is executed from locations other than its legitimate path (Windows\ImmersiveControlPanel). This often indicates an attacker masquerading as a system utility to evade detection.
Detects various indicators of SharkLoader activity, including the deployment of decoy MSI files, execution of suspicious masqueraded processes, use of double-extension files, and the creation of malicious DLL components in specific AppData subdirectories.
Detects potential persistence attempts by the SNOWLIGHT dropper, which masquerades as the legitimate Windows Update service (wusvc). The rule monitors for unauthorized execution of wusvc.exe, the use of sc.exe to register a wusvc service, and direct modification of registry keys associated with the wusvc service path.
Detects inbound invoice-themed phishing emails where the sender domain authentication (SPF/DKIM) fails, combined with healthcare-related display name impersonation. The rule specifically targets the abuse of aged, high-reputation domains used as a vector to bypass standard reputation-based email filtering while masquerading as healthcare organizations.
Identifies the creation or execution of a scheduled task named 'GoogleErrorReport', which is used by the threat group Dropping Elephant (also known as Patchwork or FIN13) to run their side-loading chain every minute. This rule detects both the command-line invocation of schtasks.exe to create or modify tasks and the Windows Security Event ID 4698 for scheduled task creation, specifically looking for the 'GoogleErrorReport' string.
Detects the MYRA RAT using the prctl system call to rename its process to 'systemd-userdbd'. This masquerading technique aims to evade detection by blending in with legitimate system processes on Linux endpoints. The rule monitors process execution events for instances of 'systemd-userdbd' that do not originate from authorized system directories.
Detects the execution of specific binaries (vmtools.exe, vmwared.exe, XDRAgent.exe) from the C:\ProgramData\VMware directory. This path is often used by adversaries to masquerade malicious files or execute tools from a directory that might be excluded from security scanning.
Detects the creation of scheduled tasks using schtasks.exe that masquerade as common update tasks (Google, Microsoft) or point to suspicious file paths often associated with malware (e.g., C:\ProgramData\VMware\). The rule monitors for tasks created with high privileges or triggers, which are indicative of persistence mechanisms.
Detects execution of the process 'PerfWatson2.exe' (associated with TinyRCT malware) from file paths other than the expected %LOCALAPPDATA% directory.
This rule detects the execution of processes masquerading as legitimate VMware-related utilities or XDR agents when they exhibit behaviors associated with command-and-control (C2) activity. Specifically, it flags processes matching these names or non-standard file paths that include command-line arguments indicative of tunneling (e.g., 'reverse', 'admin-auth-flag') or connect to a specific, hardcoded malicious IP address on port 41256.
Detects execution of the TinyRCT backdoor by monitoring for suspicious instances of 'PerfWatson2.exe' running from non-standard locations (outside of the expected Visual Studio program directories) and specific instances of 'chrome_setup.exe' originating from user download directories matching a known malicious SHA256 hash.
Detects network activity initiated by PerfWatson2.exe communicating with known command-and-control (C2) IP addresses. PerfWatson2.exe is used as a masquerading process to blend in with legitimate Visual Studio telemetry traffic, a technique observed in TinyRCT C2 beaconing.
Detects unsigned or non-Microsoft signed executables running from the Windows Media Player installation directory. This behavior is indicative of masquerading techniques used by attackers, such as the Operation DragonReturn campaign, to hide malicious services or components within trusted system directories.
Detects svchost.exe (hosting InstallService) loading InstallServicePlugin.dll from a UNC path, which is indicative of the UnCanny Local Privilege Escalation (LPE) technique. This behavior is suspicious as legitimate svchost processes typically load DLLs from local system paths, not network shares.
Detects the creation of a scheduled task used by NarwhalRAT for persistence, using a specific task name and execution pattern.
Page 22 of 33