Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects the execution of wermgr.exe from a directory other than the standard System32 or SysWOW64 paths. This behavior is indicative of a dropped payload mapped via windir environment variable manipulation, as observed in the MiniPlasma Local Privilege Escalation (LPE) exploit chain.
Detects execution of DWAgent from download or temporary directories rather than standard installation locations, potentially indicating unauthorized remote management activity.
Detects the execution of 'update.exe' where the parent process is 'svchost.exe'. This specific process chain is indicative of the MiniFast malware, which uses this technique as an anti-analysis check. Legitimate software updates or scheduled tasks might also use svchost.exe to spawn update.exe, requiring careful tuning to reduce false positives.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects execution of DWAgent from download or temporary directories rather than standard installation locations, potentially indicating unauthorized remote management activity.
Detects the execution of an 'update.exe' process spawned by 'svchost.exe'. This specific process chain is validated by the second-stage loader of the MiniFast backdoor (associated with Nimbus Manticore) as an anti-analysis mechanism to ensure the execution originates from its scheduled-task persistence rather than a sandbox or direct execution.
Detects execution of wermgr.exe from a directory outside of the expected C:\Windows path, which indicates the environmental variable redirection technique used by MiniPlasma. This technique is often used for defense evasion and masquerading.
This rule detects HTTP responses containing a Windows executable (identified by the 'MZ' header) where the URI path suggests it's masquerading as a legitimate Windows system binary like svchost.exe, winlogon.exe, lsass.exe, services.exe, or csrss.exe. This is a common technique used by malware to evade detection by appearing as a trusted process.
Detects the execution of known VerdantBamboo payload names (luserput, ovs-dbctl, egnyte_host_monitor_client) or specific malicious deployment paths, indicating potential PLENET, BRICKSTORM, or AGENTPSD malware activity on compromised Linux and edge devices.
Detects the execution of 'active_desktop_launcher.exe' (a legitimate signed KuGou binary) from unusual directories like ProgramData or AppData\Local\Temp. This behavior indicates potential DLL side-loading staging by the BoldTealLayer malware prior to executing its in-memory evasion chain.
This rule detects suspicious DLL side-loading activity. It looks for DLL files being loaded from common user-writable or temporary directories (like `\temp\` or `\users\`) by legitimate Windows processes such as `rundll32.exe`, `explorer.exe`, or `svchost.exe`. The rule specifically flags instances where a DLL is loaded more than 3 times within an hour by these processes, indicating potential malicious activity where an adversary might be attempting to execute their own malicious DLLs by hijacking the loading process of a legitimate application.
Detects the creation of the 'TieringEngineService.exe' bait file within a specific RedSun temporary directory pattern (RS-{GUID}) associated with the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to exploit Windows Defender.
This rule detects suspicious DLL side-loading activity. It looks for DLL files being loaded from common user-writable or temporary directories (like `\temp\` or `\users\`) by legitimate Windows processes such as `rundll32.exe`, `explorer.exe`, or `svchost.exe`. The rule specifically flags instances where a DLL is loaded more than 3 times within an hour by these processes, indicating potential malicious activity where an adversary might be attempting to execute their own malicious DLLs by hijacking the loading process of a legitimate application.
Detects file execution where curl.exe or bitsadmin.exe are copied to a public document folder and renamed to DLL extensions (like winhttp.dll or wininet.dll) to evade detection. This activity is associated with the TAX#TRIDENT campaign.
Detects execution of svchost.exe from the non-standard \Windows\SysWOW64\msres\ folder. This behavior is associated with the ClientSetup/SyncFuture payload used in the TAX#TRIDENT campaign to maintain C2 sessions.
Detects the Vampire Bot malware establishing persistence by copying itself to a suspicious directory and using 'attrib.exe' to set system and hidden file attributes.
Identifies package managers (like npm or yarn) executing suspiciously placed setup binaries from hidden or unconventional folders (e.g., tools/setup, .github/scripts/precheck) indicative of IronWorm preinstall hooks.
Detects the DLL sideloading primitive used by the ValleyRAT (SilverFox APT)
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
campaign documented by K7 Labs: a legitimate signed Windows binary executing
from C:\ProgramData\ (typically C:\ProgramData\client\) that has been weaponized
to sideload an attacker-controlled DLL. The K7 analysis documents GameBox.exe
(Tencent) as the carrier in this campaign, but ValleyRAT operators rotate
sideloading carriers across campaigns - AntiyAVL.exe, DXVZ.exe, DXOPT.exe,
VPNclient.exe, and various Chinese-language application binaries have all been
observed as carriers. The stable detection target is the technique: any
binary executing from ProgramData OR utility.dll being loaded from ProgramData.
Detects the execution of a Java runtime engine masquerading as 'miicrosoft.exe', a known evasive execution technique utilized by MicroStealer to run its payload.
Detects the creation of an unexpected LaunchAgent property list named 'com.google.keystone.agent.plist' paired with the creation or execution of a binary at '~/Library/Application Support/Google/GoogleUpdate.app/Contents/MacOS/GoogleUpdate'. This exact path and plist combination is used by the SHub Reaper malware to establish persistent backdoor access while masquerading as a Google software update.
Detects pythonw.exe executing .pyw scripts from user-writable directories outside canonical Python installation paths. This execution pattern is used by Operation HumanitarianBait (module.pyw from %APPDATA%\WindowsHelper) and similar PyArmor-packed Python infostealer campaigns like PXA Stealer and JarkaStealer. These campaigns drop self-contained Python environments into vendor-mimicking AppData subdirectories. The rule catches the specific HumanitarianBait path/script combination and variants that alter the path or script name while maintaining the windowless-Python-from-AppData primitive.
Page 25 of 33