Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
566
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
429
291
252
179
Platforms
1,209
21
17
3
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,235
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
Detects attempts to establish persistence by modifying registry run keys (Run or RunOnce) to execute scripting interpreters like PowerShell, cmd, or wscript. The rule looks for at least two such events within an hour on the same device and registry key, indicating potential malicious activity.
DHCP CalloutDLL
S1QL
Detects installation of a Callout DLL via CalloutDlls and CalloutEnabled registry parameters, which can be abused to execute code in the DHCP server context.
Detects the creation or modification of an executable named 'GoogleUpdateService.exe' within a user's Windows Startup folder. This activity is indicative of the SStar Agent malware establishing persistence, as it masquerades as a legitimate Google update service but uses an atypical persistence mechanism (Startup folder instead of Scheduled Tasks or Registry Run keys).
Detects PowerShell command lines querying the HKCU:\Printers registry key and executing its contents via ScriptBlock creation. This technique is utilized by Gamaredon's GammaSteel malware for fileless registry staging and persistence.
Detects the Phantom Bot malware modifying the registry Run key with the value 'SystemUpdate' to establish persistence on Windows systems. The rule specifically looks for modifications to 'Software\Microsoft\Windows\CurrentVersion\Run' keys with the value name 'SystemUpdate'.
Detects RomulusLoader persistence behavior where Vulkan components (vulkan-1.dll, vulkaninfo.exe) or encrypted payload files (.bin) are written to the Common Files directory by the TA4922 threat actor.
Detects the creation of the 'Oregon.wdlp' file in the Windows Startup folder, which is a known secondary persistence mechanism used by the BlackBeard malware, linked to the Boggy Serpens threat group.
Detects the creation or modification of a registry run key that masquerades as 'WindowsUpdate' and points to an executable within a 'Temp' directory with a specific naming pattern (e.g., 'winupd_[a-z0-9]+.exe'). This technique is commonly used by adversaries to establish persistence on a system by ensuring their malicious payload executes upon user login.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
Detects PowerShell executions associated with Gamaredon's GammaSteel persistence mechanism, which reconstructs a payload path from the HKCU:\Printers registry key and executes it using [scriptblock]::Create. This technique indicates an attempt to maintain access by leveraging registry keys for autostart execution and dynamic script execution.
This rule detects attempts to modify the 'Run' key in the Windows Registry remotely over SMB (port 445). The 'Run' key is a common persistence mechanism used by attackers to ensure their malicious code executes every time a user logs in. The rule specifically looks for network traffic on port 445 containing the string 'SOFTWARE\Microsoft\Windows\CurrentVersion\Run', indicating a potential remote registry modification related to startup programs.
Identifies .lnk files dropped into Startup folders, a persistence technique tied to WinRAR exploitation.
Detects suspicious modifications to Registry Run and RunOnce keys that include common scripting or command execution keywords (powershell, cmd, .bat). This activity is often associated with persistence mechanisms where adversaries attempt to execute malicious code upon user login.
Identifies registry Run or RunOnce keys being created or modified with a specific 'Update Drivers NVIDEO' naming convention, which has been observed as a persistence mechanism used by the DesckVB malware.
This rule detects the creation or modification of registry run keys that contain specific keywords associated with PlugX malware and the Mustang Panda threat group. It specifically looks for modifications to the 'Run' key under 'Software\Microsoft\Windows\CurrentVersion' in the registry, which is a common persistence mechanism. The keywords 'plugx', 'mustang', 'panda', and 'plug' are used to identify suspicious registry value data.
Detects the creation or modification of a registry value within the Run key that points to wscript.exe executing a .js file, which is a primary persistence mechanism for JS.MonoGlyphRAT. The rule specifically looks for modifications to user-level Run keys and checks for 'wscript.exe' and '.js' within the RegistryValueData, accounting for potential additional arguments after the .js file path.
Detects the creation or modification of registry run keys associated with the BoldTealLayer persistence mechanism, specifically targeting 'BoldTealLayer150'.
Detects the axois-utils phantom bot persistence mechanism attempting to modify the Windows Run registry key with the value 'SystemUpdate' pointing to a Node application. This rule specifically looks for registry set value events where the value name is 'SystemUpdate', the key path contains 'CurrentVersion\Run', and the data contains 'node', indicating an attempt to establish persistence by executing a Node.js application at user login.
Detects the creation of the 'CacheDB' service or specific 'Everything' registry run keys, which are persistence mechanisms utilized by the httpMalice backdoor (a Kimsuky PebbleDash variant).
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
Page 42 of 59