Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
140 detections
Filters
Last updated
All Time
Detection languages
50
42
24
6
6
Contributors
44
35
20
9
6
Categories
59
44
20
9
7
Platforms
106
14
10
8
5
Products / Services
20
17
12
8
7
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
IDS Classtypes
4
1
1
IDS Protocols
6
Form-grabbing and credential stealing malware-as-a-service
Ransomware group exploiting edge devices and managed file transfer software
Ransomware group exploiting edge devices and managed file transfer software
Detects browser extension renderer processes (Chrome or Edge) performing virtualization, sandbox, or debugger evasion checks. This is achieved by monitoring for suspicious WMI queries to discover virtualized environments, access to registry keys associated with virtual machine guest additions, and the loading of DLLs related to VM guest support tools.
Detects the execution of known diagnostic, debugging, or analysis tools (such as IDA Pro, Process Hacker, Wireshark, etc.) by processes other than standard Windows system processes. This behavior may indicate an adversary conducting reconnaissance, attempting to bypass protections, or analyzing system artifacts.
High-velocity ransomware-as-a-service with aggressive leak-site extortion
Campaign converting compromised FortiGate firewalls into credential stealers
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
Rust-based ransomware family targeting enterprise environments
Open-source derived remote access trojan with plugin architecture
Modular remote access trojan associated with long-term espionage intrusions
Malvertising loader delivering CastleStealer via malicious Google Ads
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Lightweight remote access trojan deployed in recruiter-themed social engineering
Rust-based macOS infostealer implant embedding prompt injection payloads
Form-grabbing and credential stealing malware-as-a-service
Rust-based ransomware family targeting enterprise environments
Detects processes invoking common Windows API functions typically used to detect the presence of debuggers (IsDebuggerPresent, CheckRemoteDebuggerPresent, NtQueryInformationProcess, GetTickCount) when these processes are executed from suspicious locations (such as specific AppData subdirectories) or masquerading as system binaries (SystemSettings.exe). These behaviors are commonly used by malware to detect analysis environments or debuggers and alter execution flow to evade detection.
This rule detects instances of the SNOWLIGHT dropper (wusvc.exe) initiating or interacting with processes identified as common debugger or system analysis tools. The rule monitors for the simultaneous presence of wusvc.exe and a blacklist of tools like processhacker.exe, ida.exe, and wireshark.exe within a 120-second window on the same device.
Detects the SNOWLIGHT dropper (associated with UNC5221) attempting to evade analysis. The rule monitors for the loading of 'verifier.dll' by the suspicious 'wusvc.exe' process (a common disguise for this malware) as a mechanism to perform debugger checks, alongside the enumeration of various security and analysis tools (e.g., debuggers, packet sniffers, and virtualization tools).
Page 4 of 7