Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
747 detections
Filters
Last updated
All Time
Detection languages
369
229
42
30
30
Contributors
227
171
161
51
49
Categories
318
300
145
136
94
Platforms
650
48
24
21
15
Products / Services
192
177
145
133
132
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
747
CVEs
5
4
3
3
2
IDS Classtypes
1
IDS Protocols
1
Detects invocation of the G13 killer driver's WipeProcessUserMemory routine via IOCTL 0x221E64, requiring the wipe target be a distinct, identified process from the process that issued the IOCTL.
Detects coordinated EDR-blinding techniques where a process performs in-memory patching of AMSI (AmsiScanBuffer) or ETW (EtwEventWrite) while simultaneously executing direct syscalls to bypass standard ntdll.dll hooked exports. This combination is highly indicative of malicious activity attempting to evade endpoint security instrumentation.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects XCSSET disabling macOS SoftwareUpdate ConfigDataInstall and Rapid Security Response settings via defaults write, impairing automatic security patching, while excluding known MDM management tools.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects instances where the TOKYOCORE malware (fsociety.exe) attempts to identify or enumerate the presence of security-critical applications, including debuggers, virtual machine guest agents, and antivirus/EDR software. This behavior is indicative of malware attempting to evade analysis or disable security controls.
Detects the load of RstrtMgr DLL (Restart Manager) by an uncommon process.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
This library has been used during ransomware campaigns to kill processes that would prevent file encryption by locking them (e.g. Conti ransomware, Cactus ransomware). It has also recently been seen used by the BiBi wiper for Windows.
It could also be used for anti-analysis purposes by shut downing specific processes.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects the disabling of User Account Control (UAC) by modifying the 'EnableLUA' registry value to 0. Adversaries may disable UAC to bypass elevation prompts and facilitate unauthorized modifications to the operating system.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects the use of the bindutil.exe utility with the --link argument to redirect or interact with amsi.dll. This behavior is indicative of an attempt to bypass or interfere with the Antimalware Scan Interface (AMSI) in Windows, potentially allowing for the execution of malicious scripts or code without detection. The rule includes filters for legitimate processes typically associated with virtualized or containerized environments.
Detects the creation of a 'Ghost-in-the-Silo' configuration using bindutil.exe with the --runj flag. This pattern is often associated with unauthorized creation of silo-bound containers or execution environments and is monitored for activity outside of legitimate management processes like VM compute, container engines, or Windows Sandbox.
Detects the loading of known TELEPUZ-specific DLLs into common Windows host processes (rundll32.exe and svchost.exe). TELEPUZ is known to perform ETW (Event Tracing for Windows) tampering by patching ntdll.dll functions during initialization, which is a technique used to suppress security telemetry.
Detects unauthorized processes (non-msiexec.exe) modifying registry keys related to TempPackages alongside simultaneous modification or interaction with .rbs or .rbf files located within the C:\Config.Msi directory. This behavior is indicative of potential MSI installer hijacking or tampering attempts where an adversary attempts to bypass standard installer execution paths.
Detects attempts by a process to modify its own memory space containing the amsi.dll module, typically indicative of an attempt to patch the AmsiScanBuffer function to disable Antimalware Scan Interface (AMSI) protections for malicious script execution.
Detects modifications to the Windows Registry key 'DisableTaskmgr' within the 'Policies\System' path, which is used to disable the Task Manager. This is a common tactic used by malicious actors to prevent users from monitoring or terminating malicious processes.
Page 28 of 36