Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
203 detections
Filters
Last updated
All Time
Detection languages
76
72
13
12
8
Contributors
34
27
25
20
18
Categories
89
65
45
23
22
Platforms
173
30
21
6
3
Products / Services
42
40
26
7
5
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
CVEs
5
1
1
1
IDS Classtypes
4
3
IDS Protocols
4
2
1
This rule detects the creation of specific mutex names ('loasd6asdg6') that are known to be associated with the DFKRAT backdoor. The detection logic specifically looks for these mutex names within process creation events on Windows systems. The presence of these mutexes indicates potential DFKRAT backdoor activity, which is often related to persistence mechanisms.
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
This rule detects the installation path of the Evasive Panda loader/MgBot malware. It specifically looks for file events where the target filename contains '\Microsoft\MF' within the 'ProgramData' directory. To reduce false positives, it excludes file creations by trusted system installers like 'TrustedInstaller.exe' and 'msiexec.exe' when run from 'System32'. The rule also implies that the initiating process should originate from user-space directories or the same '\Microsoft\MF' path, though this is not explicitly enforced in the final condition.
Detects storage of a PowerShell-based persistent payload in the Windows registry under a non-standard GUID-based key using the Corel value. This technique is used by the final stage of the eScan supply-chain attack to establish stealthy persistence after environment validation.
This rule detects suspicious batch (.bat) file creation events by monitoring for several indicators. It flags batch files created by processes using command lines indicative of downloads (e.g., 'http:', 'https:', 'iwr', 'iex', 'invoke'), batch files created by suspicious executables ('curl.exe', 'mshta.exe'), batch files placed in high-risk directories ('\Users\Public\', '\Start Menu\Programs\Startup\'), or batch files exceeding a size threshold of 5MB. The rule explicitly excludes processes named 'java.exe' or 'javaw.exe' from triggering alerts.
This rule detects the creation or modification of files within specific macOS directories associated with LoginWindow hooks and Authorization Plugins. These locations are commonly abused by adversaries to establish persistence or elevate privileges by injecting malicious code that executes during the login process. The rule specifically looks for file events in '/Library/Security/SecurityAgentPlugins/', '/System/Library/CoreServices/SecurityAgentPlugins/', '/Library/Security/SecurityAgentPlugins.bundle', or any file activity within a 'loginwindow' path. It excludes activities initiated by legitimate installers and software updaters to reduce false positives. Additionally, it filters for files with low global prevalence, indicating potentially suspicious or custom binaries.
This rule detects the presence of the 'Unregister-ScheduledTask' PowerShell cmdlet within the HTTP response body. This could indicate an attacker attempting to remove persistence mechanisms, specifically scheduled tasks, from a compromised system after initial compromise or during cleanup phases. The detection is case-insensitive and looks for the command along with optional parameters like '-taskname' or '-taskpath'.
Detects when a possible suspicious driver is being installed via pnputil.exe lolbin
Detects potential malicious modification of run keys by winekey or team9 backdoor
This rule detects the presence of the PowerShell cmdlet 'Set-ScheduledTask' within the HTTP response body. This could indicate an attacker using a web-based mechanism to deliver or execute commands related to scheduled task creation or modification on a compromised system, potentially for persistence.
This rule detects the presence of the PowerShell cmdlet 'Start-ScheduledTask' within the HTTP response body. This could indicate an attacker attempting to establish persistence on a compromised system by creating scheduled tasks, potentially delivered via a web-based command and control channel or during an exploit.
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects. This can be used by adversaries for persistence, privilege escalation, or defense evasion.
Detects modifications to specific registry keys under 'Software\Policies\Microsoft\Windows\System\Scripts' related to system startup, shutdown, logon, and logoff scripts. These modifications can be used to establish persistence or escalate privileges by executing malicious code at various system events.
Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
Detects the creation or modification of registry keys associated with Windows Assistive Technology applications, specifically focusing on changes to the 'ATs' and 'Configuration' keys under 'Software\Microsoft\Windows NT\CurrentVersion\Accessibility'. This activity can be indicative of persistence or privilege escalation attempts by adversaries abusing accessibility features like 'atbroker.exe'. The rule includes filters to reduce false positives from legitimate 'atbroker.exe' activity or MSI installers.
Detects modifications to specific registry keys under `SYSTEM\CurrentControlSet\Control` that are commonly used for autostart extensibility points (ASEPs). These modifications can indicate persistence mechanisms being established by adversaries.
Detects potential malicious modification of the 'Run' registry key by malware identified as 'winekey' or 'team9' (Bazar/KEGTAP) to establish persistence. Specifically, it looks for modifications to the 'Software\Microsoft\Windows\CurrentVersion\Run\Backup Mgr' registry value.
This rule detects the use of 'pnputil.exe' to install or add drivers on a Windows system. Adversaries may use this utility to install malicious or vulnerable drivers for privilege escalation, persistence, or to bypass security controls. The detection specifically looks for command-line arguments indicative of driver installation, such as '-i', '/install', '-a', '/add-driver', and the presence of '.inf' in the command line.
Detects the suspicious execution of 'grpconv.exe' with the '-o' flag, which can be used to convert Windows 3.x .grp files or for persistence purposes by malicious software or actors. This command-line usage is uncommon in legitimate environments and may indicate an attempt to establish persistence or escalate privileges.
Detects attempts to establish persistence by modifying registry keys associated with the Recycle Bin. This technique leverages the Recycle Bin's CLSID to execute arbitrary commands, often for privilege escalation or maintaining access.
Detects modifications to common autostart extensibility points (ASEP) in the Windows Registry. These registry keys are frequently used by legitimate software and adversaries to establish persistence by ensuring programs execute automatically upon system boot or user logon. The rule specifically targets a wide range of registry paths associated with autorun functionality, including those for Command Processor, Active Setup, Internet Explorer, and various system services. It includes filters to reduce false positives from known legitimate Microsoft Office, Chrome, Edge, and Internet Explorer activities.
Page 8 of 10