Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects a malicious persistence mechanism where a suspicious process ('chost.exe') is registered in the HKCU\Software\Microsoft\Windows\CurrentVersion\Run registry key to execute at startup. The rule specifically monitors for registry keys pointing to temporary directories or unconventional path structures often associated with this RAT, while correlating this with the execution of the process from a non-system directory (i.e., outside System32/SysWOW64).
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Detects MSI loading the malicious autorun.dll from temporary download paths, which is indicative of cryptojacking activity often associated with campaigns abusing ScreenConnect and .NET utilities.
This rule detects unusual parent-child process relationships for 'svchost.exe' and 'explorer.exe'. Specifically, it flags instances where 'svchost.exe' is spawned by a process other than 'services.exe', 'msiexec.exe', or another 'svchost.exe' instance. It also flags 'explorer.exe' being spawned by a process other than 'userinit.exe' or another 'explorer.exe' instance. These relationships can indicate process injection, masquerading, or other forms of malicious activity.
Detects when 'SystemSettings.exe' is copied from its legitimate location to common staging directories like ProgramData, AppData, Temp, or Public. This activity is often observed in campaigns like StrikeShark as an early indicator before sideloading, providing an opportunity for earlier detection.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. This activity is associated with UNC6692 ("Snow Flurries") impersonating IT helpdesk over Teams, luring victims to a fake "Mailbox Repair Utility" page, and delivering a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects the PostCSS typosquatting campaign VBScript bootstrapper (update.vbs) using cmd.exe to extract dll.zip via tar, then launching the renamed Python executable chost.exe with loader.py to initialize the Windows RAT payload.
Detects unsigned Go-compiled executables (lacking product/company info and certificate) executing from user-writable paths like %TEMP%, %APPDATA%, %PUBLIC%, or %PROGRAMDATA%\<user>\Temp. This behavior is associated with the Backdoor.Turn malware, which is compiled in Go.
Detects the uploading of a plugin matching known disguised slugs ('content-delivery-helper' or 'database-optimizer') used by attackers to install backdoors after establishing a rogue admin account in WordPress environments. This rule specifically targets POST requests to the WordPress plugin update endpoint with these malicious plugin names in the query string.
This rule detects instances where common command and scripting interpreters (powershell.exe, cmd.exe, cscript.exe) are launched by unusual parent processes. The rule specifically looks for these interpreters being spawned by processes other than explorer.exe, notepad.exe, mspaint.exe, or svchost.exe, and triggers if this occurs at least twice within an hour on the same computer by the same user.
Detects the creation of generic executable files (e.g., me.exe, update.exe, monitor.exe, service.exe) within the Hola browser installation path. This rule aims to identify potentially malicious executables delivered by a compromised updater or supply chain attack targeting Hola browser users. The rule also captures the principal process responsible for the file creation for correlation.
Targets an executable copied or launched beneath AppData Local Programs by a temporary-stage process. The UDM rule retains principal and target context for correlation.
Udm Notepadplusplus Dll
YARA-L
This rule detects the creation of a file named 'notepadplusplus.dll' within the Microsoft Windows roaming profile path (specifically, 'appdata\roaming\microsoft\windows'). This activity is suspicious as it indicates an attempt to masquerade a malicious DLL as a legitimate one, potentially for DLL hijacking or persistence, by placing it in a location that might be searched by legitimate applications.
Identifies instances where update.exe enforces an svchost.exe parent to evade sandboxes, specifically looking for 'UpdateChecker.dll' being loaded by a process named 'update.exe' whose parent is 'svchost.exe'. This behavior is associated with the Screening Serpens APT group.
Detects the core payload components dropped by the malicious easy-day-js npm package, which is an infostealer affecting developers and CI/CD environments. The rule specifically looks for the creation or modification of 'protocal.cjs' and 'config.json' within a hidden 'NodePackages' directory located in 'C:\ProgramData\', a technique used to masquerade as legitimate Node.js tooling.
Correlates the dropping of the decrypted XWorm payload into %LOCALAPPDATA% with a name mimicking a Windows Kernel service.
Detects execution of a SimpleRunPE-style loader from Downloads, Temp, AppData, or Public paths.
This rule detects the creation or modification of files within the Windows Fonts directory that use specific naming conventions (starting with 'x1', 'kx1', or 'kw1') and have no file extension or a generic one. This pattern is often associated with malware attempting to hide encrypted data containers or malicious payloads by masquerading them as legitimate system files.
Detects the Komari agent executing from anomalous staging directories (e.g., Public, ProgramData, Temp) and immediately initiating high-frequency external network connections. This rule correlates process creation events with network connection events to identify suspicious behavior indicative of Komari C2 activity.
Identifies the deceptive, deeply nested directory structure used to hide the persistent payload, specifically looking for folder creations matching the pattern `AppData\LocalLow\LocalLow\sWindows\Program\sRules\Program\sRules\sNVIDEO`.
Detects instances of common, sensitive Windows system binaries (svchost.exe, lsass.exe, sms.exe, csrss.exe) being executed by parent processes other than the legitimate system processes (services.exe, smss.exe, csrss.exe, winlogon.exe), indicating potential process masquerading or path spoofing.
Page 23 of 33