Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
692 detections
Filters
Last updated
All Time
Detection languages
264
188
49
46
40
Contributors
172
97
71
63
41
Categories
372
145
94
90
86
Platforms
591
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects suspicious PE files that masquerade as Mozilla Firefox by using Firefox-related product names and metadata, but lack valid Mozilla Corporation code-signing signatures and are located within the ProgramData directory.
This rule detects the creation of files in directory paths that look similar to the legitimate 'C:\Windows\SysWOW64' folder but contain a hidden trailing space (e.g., 'C:\Windows \SysWOW64'). Attackers use this directory spoofing technique to hide malicious files or executables from users and some security tools that might not normalize the path correctly.
Detects the MovieReaper Stage-3 module which masquerades as Microsoft Edge (msedge.exe) within the C:\ProgramData\Windows\Telemetry directory. The detection focuses on suspicious process execution from this directory and identifies instances where the process respawns itself, suggesting malicious activity post-UAC bypass.
Detects instances of the Hannibal Stealer module that attempt to masquerade as the legitimate 'CefSharp.BrowsersSubprocess.dll' by spoofing publisher metadata ('LLC Windows'). The detection triggers when this process is identified initiating network connections shortly after execution, which aligns with the malware's known behavior of performing geolocation-based checks before continuing activity.
This rule monitors for network traffic related to known fake GitHub pages and malicious loader sites impersonating LastPass Authenticator. It detects attempts to access specific malicious domains and organization pages on GitHub, as well as the delivery of malicious pages containing spoofed trust badges and branding, commonly used in phishing campaigns.
This rule detects the execution of the legitimate Microsoft Visual Studio CoreCLR Debugger (vsdbg.exe) from an unauthorized file location. This behavior is indicative of masquerading, where the executable is renamed to appear as an installer to sideload a malicious companion vsdbg.dll, a technique observed in the Rapuncel/BoryptGrab campaign.
This rule monitors for processes named 'msedge.exe' executing from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. The rule filters out legitimate Edge update processes and common browser command-line arguments to isolate potentially malicious masquerading attempts by identifying binaries that share the name of a legitimate application but reside in unexpected, often non-standard locations.
Detects the MovieReaper payload behavior where a specific file manager process masquerading as a legitimate system utility (msedge.exe) performs mass file enumeration or access followed by suspicious outbound network connections, indicative of data staging and exfiltration.
Detects instances where a process named msedge.exe is running from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This is a common location used by attackers to hide malicious executables by masquerading them as legitimate browser processes, particularly when the process command line includes arguments like 'preview' or 'thumbnail' which are often used to blend in with background system activity.
Detects instances where a process named msedge.exe is running from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This is a common location used by attackers to hide malicious executables by masquerading them as legitimate browser processes, particularly when the process command line includes arguments like 'preview' or 'thumbnail' which are often used to blend in with background system activity.
Detects the presence or execution of a specific file hash associated with a known malicious campaign (KREMLIN/REF9334) that leverages a signed SentinelOne binary. This indicates potential abuse of trusted code-signing to bypass security controls.
Detects the presence or execution of a specific file hash associated with a known malicious campaign (KREMLIN/REF9334) that leverages a signed SentinelOne binary. This indicates potential abuse of trusted code-signing to bypass security controls.
Detects TLS connections where the certificate subject is 'azure.uzrailwaystax.com' and the issuer is 'TLC DV TLS CA', indicating potential impersonation of the Uzbekistan railway authority infrastructure, likely associated with SilkParasite activity.
Detects instances of an executable named msedge.exe running from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This is a suspicious location for a browser executable, often used by malware to masquerade as legitimate software to evade detection.
Detects the execution of a binary named 'msedge.exe' from within the 'Windows\Telemetry' directory. This behavior is indicative of the MovieReaper malware attempting to masquerade as the legitimate Microsoft Edge browser to evade detection and maintain persistence.
Detects the execution of a binary named 'msedge.exe' from within the 'Windows\Telemetry' directory. This behavior is indicative of the MovieReaper malware attempting to masquerade as the legitimate Microsoft Edge browser to evade detection and maintain persistence.
Detects network communication to known MovieReaper C2 infrastructure (deadhub.org or 193.23.118.155) originating from a masqueraded 'msedge.exe' process located in 'C:\ProgramData\Microsoft\Windows\Telemetry\', indicating potential C2 check-ins or data exfiltration by the file manager module.
Detects the execution of the MovieReaper malware loader, which masquerades as 'msedge.exe' within the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. This technique is used to bypass anti-sandbox checks by respawning as a legitimate-looking process in a persistent location after initial environment analysis is completed.
Detects the execution of known malicious loader files associated with the MovieReaper campaign. The rule identifies processes based on specific MD5 hashes, or by detecting obfuscated naming conventions where an executable file is disguised as a movie file by appending excessive padding or specific descriptors to the filename, often used to bypass user suspicion when distributed via torrent repositories.
Detects instances where the 'msedge.exe' binary is executed from the non-standard path 'C:\ProgramData\Microsoft\Windows\Telemetry\', excluding instances initiated by the legitimate Microsoft Edge Update process. This pattern often indicates masquerading, where an adversary places a malicious file with a legitimate name in an attempt to evade detection.
This rule monitors for processes named 'msedge.exe' executing from the 'C:\ProgramData\Microsoft\Windows\Telemetry\' directory. The rule filters out legitimate Edge update processes and common browser command-line arguments to isolate potentially malicious masquerading attempts by identifying binaries that share the name of a legitimate application but reside in unexpected, often non-standard locations.
Page 5 of 33