Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
692 detections
Filters
Last updated
All Time
Detection languages
264
188
49
46
40
Contributors
172
97
71
63
41
Categories
372
145
94
90
86
Platforms
591
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects Linux processes masquerading as 'php-fpm' or 'postgres' that match known SHA-256 hashes associated with the RedTail malware family. The rule identifies processes attempting to hide their identity using techniques similar to prctl(PR_SET_NAME) to rename themselves while running malicious code.
Detects Linux processes masquerading as 'php-fpm' or 'postgres' that match known SHA-256 hashes associated with the RedTail malware family. The rule identifies processes attempting to hide their identity using techniques similar to prctl(PR_SET_NAME) to rename themselves while running malicious code.
Detects post-exploitation persistence artifacts on Windows endpoints consistent with abuse of CVE-2026-18577.
Detects the execution of known Windows update-related binaries (UpdateAssistant.exe or AppUpdateHelper.exe) from non-standard, suspicious locations within AppData directories. This behavior is indicative of masquerading, where an adversary attempts to blend in by using a legitimate process name from an unexpected path.
Detects Linux processes masquerading as 'php-fpm' or 'postgres' that match known SHA-256 hashes associated with the RedTail malware family. The rule identifies processes attempting to hide their identity using techniques similar to prctl(PR_SET_NAME) to rename themselves while running malicious code.
Detects PE binaries masquerading as Microsoft's Windows Update Assistant via forged VersionInfo metadata combined with an unsigned or invalid/unverified digital signature, associated with HVNC backdoor delivery
Detects the execution of known Windows update-related binaries (UpdateAssistant.exe or AppUpdateHelper.exe) from non-standard, suspicious locations within AppData directories. This behavior is indicative of masquerading, where an adversary attempts to blend in by using a legitimate process name from an unexpected path.
Rileva l'esecuzione di un binario denominato acpid da un percorso diverso da /usr/sbin/acpid, tecnica di masquerading osservata in toolkit di persistenza Linux.
Detects the Warden.dll companion DLL shipped as part of the ShieldCrash (CVE-2026-69414) exploit chain, tightened to require an unsigned/unknown publisher or a suspicious install path alongside the generic filename
Detects files referencing malicious implant install paths under C:\Windows\Fonts\web used to blend with legitimate system files
Detects PyInstaller-built UltraVNC installer renamed to svchost.exe and staged for deployment to the non-standard C:\Windows\Fonts\web directory
Detects PyInstaller-built UltraVNC installer renamed to svchost.exe and staged for deployment to the non-standard C:\Windows\Fonts\web directory
Detects the creation of a large file (exceeding 4MB) named 'WindowsUpdate.log' on the system. This behavior is indicative of a masquerading attempt where a malicious PE DLL is disguised with the extension of a known legitimate log file, a technique observed in the CRPx0 ClickFix lure to evade security inspection.
Detects the creation of new executable files (DLL or EXE) that contain a certificate subject string referencing 'Microsoft' but are located outside of the standard 'C:\Windows\' directory. This behavior is indicative of an attacker attempting to bypass trust validation mechanisms by creating binaries with self-signed, fake Microsoft certificates, a technique observed in the CRPx0 builder toolset to evade EDR and AV inspection.
Detects post-exploitation persistence artifacts on Windows endpoints consistent with abuse of CVE-2026-18577.
Detects SoftEther VPN bridge dropper/installer disguised as svchost.exe with masquerading MixedRealityOpen service, based on install script and dropped files (a.Bat, hamcore.se2, vpn_server.config)
Detects the creation of a scheduled task named 'Windows Update ALPHV' using the schtasks.exe utility. This task is associated with the OpnKey ransomware, which uses this name to masquerade as a legitimate Windows Update task while running with SYSTEM privileges to maintain persistence.
Detects PE binaries masquerading as Microsoft's Windows Update Assistant via forged VersionInfo metadata combined with an unsigned or invalid/unverified digital signature, associated with HVNC backdoor delivery
Detects the execution of known Windows update-related binaries (UpdateAssistant.exe or AppUpdateHelper.exe) from non-standard, suspicious locations within AppData directories. This behavior is indicative of masquerading, where an adversary attempts to blend in by using a legitimate process name from an unexpected path.
Detects the Warden.dll companion DLL shipped as part of the ShieldCrash (CVE-2026-69414) exploit chain, tightened to require an unsigned/unknown publisher or a suspicious install path alongside the generic filename
Detects Linux processes masquerading as 'php-fpm' or 'postgres' that match known SHA-256 hashes associated with the RedTail malware family. The rule identifies processes attempting to hide their identity using techniques similar to prctl(PR_SET_NAME) to rename themselves while running malicious code.
Page 9 of 33