Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Once a FileFix chain succeeds, StealC and related loaders commonly establish Run/RunOnce persistence to survive reboot shortly after or before exfiltration.
Detects mshta.exe spawning suspicious child processes (cmd.exe, powershell.exe, or reg.exe) that are characteristic of the ReverseRAT backdoor. The rule identifies common discovery commands or persistence attempts via Registry Run keys triggered from mshta.exe.
Detects indicators of RMMCRAT malware installation, which masquerades as JivaChat software. The rule identifies suspicious process execution (e.g., rmm.exe), specific file artifacts created in ProgramData, and persistence mechanisms including Windows service registration, 'Load' registry value abuse, and a unique COM CLSID hijack. The logic enforces corroboration across different signal types (process, file, registry) or triggers on the unique CLSID.
Detects trojanized versions of Zoom installers that bundle legitimate application installers alongside malicious components including a VBScript persistence mechanism (OneDriveUpdateScheduler) and the VelvetCake PowerShell downloader/C2 framework.
The rule detects correlation between the creation of persistence-related Registry keys (specifically Windows Run keys or Browser Native Messaging hosts) and the execution of the schtasks.exe utility to create or manage a task related to 'psychedelicloveUtils'. This pattern suggests an adversary attempting to maintain persistence by linking Registry-based autostart mechanisms with a scheduled task.
Detects service-creation commands (sc create / New-Service / reg add under a Services key) whose COMMAND LINE itself references a known NeedyMantis binary name or sideload staging folder. Requiring the malicious reference to appear in the command being executed -- rather than merely in the calling process's own folder location -- removes false matches from unrelated legitimate software that happens to be installed under a similarly-named folder.
Detects service-creation commands (sc create / New-Service / reg add under a Services key) whose COMMAND LINE itself references a known NeedyMantis binary name or sideload staging folder. Requiring the malicious reference to appear in the command being executed -- rather than merely in the calling process's own folder location -- removes false matches from unrelated legitimate software that happens to be installed under a similarly-named folder.
Detects modifications to Windows Registry Run and RunOnce keys by processes other than standard system binaries and known management tools. Such modifications are a common method for achieving persistence by ensuring malicious code executes upon user logon.
Detects suspicious modifications to Windows Registry keys associated with URL protocol handlers or automatic startup mechanisms. Adversaries often use custom URL schemes or registry run keys to maintain persistence or execute malicious code when a specific protocol is invoked or upon user logon.
Detects signs of the ClosedQuorum implant by correlating at least two redundant persistence mechanisms (Registry Run keys, Scheduled Tasks, WMI execution) on the same host within a 10-minute window. The rule focuses on artifacts originating from suspicious user-writable paths or unsigned binaries, while excluding known legitimate installation paths.
This rule monitors for coordinated persistence efforts by detecting the occurrence of at least two out of three specific persistence techniques (registry run key modification, scheduled task creation, or WMI-based script execution) on the same device within a 30-minute window. It explicitly filters out activities from signed binaries or those occurring in standard system/application directories, focusing on potentially malicious artifacts originating from user-writable locations.
Detects a coordinated malicious installation chain involving the creation of specific mutexes, establishment of persistence via Windows Registry Run keys, and subsequent tampering with Microsoft Defender exclusions using PowerShell. This sequence is indicative of the CHOSEN BRICK malware installation process.
Detects suspicious behavior where an identical executable (same path and SHA256) is launched twice within a short window (60 minutes) following a system reboot, utilizing two distinct persistence methods: one triggered via the Task Scheduler (under svchost.exe -k netsvcs) and one via a user logon autostart mechanism (spawned by explorer.exe).
This rule detects potential persistence mechanisms associated with the GlobalProtect VPN application where the binary is unsigned. It specifically monitors for unauthorized 'RunOnce' registry entries, the creation of suspicious scheduled tasks, or updates to scheduled tasks involving 'GlobalProtect.exe'. These actions are initiated by either 'msiexec.exe' or 'GlobalProtect.exe', suggesting a possible attempt to masquerade malicious activity as a legitimate VPN update or installation process.
This rule detects potential persistence mechanisms associated with the GlobalProtect VPN application where the binary is unsigned. It specifically monitors for unauthorized 'RunOnce' registry entries, the creation of suspicious scheduled tasks, or updates to scheduled tasks involving 'GlobalProtect.exe'. These actions are initiated by either 'msiexec.exe' or 'GlobalProtect.exe', suggesting a possible attempt to masquerade malicious activity as a legitimate VPN update or installation process.
This rule detects potential persistence mechanisms associated with the GlobalProtect VPN application where the binary is unsigned. It specifically monitors for unauthorized 'RunOnce' registry entries, the creation of suspicious scheduled tasks, or updates to scheduled tasks involving 'GlobalProtect.exe'. These actions are initiated by either 'msiexec.exe' or 'GlobalProtect.exe', suggesting a possible attempt to masquerade malicious activity as a legitimate VPN update or installation process.
This rule detects potential persistence mechanisms associated with the GlobalProtect VPN application where the binary is unsigned. It specifically monitors for unauthorized 'RunOnce' registry entries, the creation of suspicious scheduled tasks, or updates to scheduled tasks involving 'GlobalProtect.exe'. These actions are initiated by either 'msiexec.exe' or 'GlobalProtect.exe', suggesting a possible attempt to masquerade malicious activity as a legitimate VPN update or installation process.
Detects a behavioral chain where a process establishes persistence using a 'WindowsUpdate' Registry Run key or a scheduled task, followed within five minutes by an outbound network connection from the same process. The rule specifically excludes cases where a ZIP file was written to disk, identifying potential in-memory staging for exfiltration.
Detects a dual persistence mechanism where an adversary establishes persistence both via a registry Run key and a scheduled task, both named 'WindowsUpdate'. The rule correlates these events occurring on the same device within a 15-minute window.
Detects a suspicious pattern where a single process loads high-risk cryptography and system-level modules (e.g., sqlite3, win32crypt, win32api) followed within 30 minutes by credential harvesting actions such as dumping Wi-Fi keys using 'netsh' or establishing persistence via 'schtasks'. This behavior is indicative of a 'lazy-import' stealer or malicious loader attempting to evade simple signature-based detection.
Detects processes establishing persistence via Windows Registry 'Run' keys followed by frequent outbound network connections over non-standard ports. This behavior is consistent with the SystemBC/Coroxy SOCKS5 proxy backdoor often utilized by ransomware actors like Ryuk, Conti, BlackBasta, Play, and Rhysida.
Page 4 of 59