Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,116 detections
Filters
Last updated
All Time
Detection languages
6,549
6,199
1,473
1,002
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,567
3,899
1,465
1,391
1,330
Platforms
13,722
1,392
1,318
824
738
Products / Services
3,828
3,129
2,448
912
908
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of rundll32.exe calling a specific exported function ('open') associated with the fake lock screen DLL ('com6848.dll') to capture user passwords. This technique is often used in credential harvesting campaigns.
Detects the creation of specific files associated with the UAC-0184 threat group, often used in DLL sideloading scenarios. The rule looks for the presence of 'cluster-overlay64.exe', 'plane9engine.exe', 'plane9engine.dll', 'openvr_api.dll', 'kernel-diag.lib', and 'filter.bin' in common temporary or user data directories. It triggers if three or more of these files are found within an hour, or if 'kernel-diag.lib' or 'filter.bin' are present.
Detects workloads created with privileged mode, host namespace sharing, dangerous Linux capabilities, Docker socket, containerd socket, or sensitive hostPath mounts. These configurations can be abused by adversaries to escape containers and gain access to the underlying host.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning.
Detects the execution of scripts (.vbs, .js, .wsf, etc.) proxied through explorer.exe or rundll32.exe (via shell32.dll).
Threat actors embed these commands in .LNK files to bypass direct cscript/wscript detections and break process tree lineage. Because the user executes the LNK from the GUI, the desktop explorer.exe acts as the parent, mimicking normal user activity.
Threat actors embed these commands in .LNK files to bypass direct cscript/wscript detections and break process tree lineage. Because the user executes the LNK from the GUI, the desktop explorer.exe acts as the parent, mimicking normal user activity.
Identifies instances of mshta.exe being used to execute remote payloads over HTTP/HTTPS. This matches the initial ClickFix access vector used in the Amatera Stealer campaign.
KQL Query
Detects the creation of scheduled tasks named 'ChromeCheck' or 'EdgeCheck' that execute regsvr32.exe. This behavior is associated with Kimsuky's MemLoad loader, which establishes persistence to deploy the httpTroy backdoor.
Detects file access attempts targeting the erroneous SysWOW64 path for Kaspersky drivers. This is a specific bug and a high-confidence indicator of Amatera Stealer's anti-sandbox and evasion checks. The malware specifically looks for 'klif.sys', 'kldisk.sys', 'klhk.sys', and 'kneps.sys' within the incorrect '\Windows\SysWOW64\drivers' directory.
Detects the clearing of Windows event logs using command line tools like wevtutil or PowerShell. This is a standard example rule.
Identifies instances of mshta.exe being used to execute remote payloads over HTTP/HTTPS. This matches the initial ClickFix access vector used in the Amatera Stealer campaign.
Detects the execution of a Java runtime engine masquerading as 'miicrosoft.exe', a known evasive execution technique utilized by MicroStealer to run its payload.
Detects processes utilizing ${IFS} in conjunction with Base64 decoding. This technique is used by the Gogs argument injection exploit to bypass Git branch name space restrictions while delivering encoded shell payloads.
Docker Run/Exec Guardrails Bypass
Cortex XDR
This rule detects the execution of a Docker command with the '--privileged' flag on a Linux system, combined with the execution of specific system information gathering commands. This combination is often indicative of an attempt to escape a container or gain elevated privileges within a containerized environment, potentially leading to host compromise. The '--privileged' flag grants a container nearly all capabilities of the host machine, making it a critical security concern when used maliciously.
This rule detects suspicious command-line activity involving several Windows executables (wscript.exe, cscript.exe, wmic.exe, ssh.exe) when combined with specific keywords. It looks for wscript.exe or cscript.exe executing 'SyncAppvPublishingServer.vbs', wmic.exe executing 'process', 'call', or 'create', or ssh.exe using 'ProxyCommand'. Additionally, the rule filters for command lines containing keywords like 'gal', 'i*x', 'gcm', '*stM*', 'jsdelivr.net', 'github', or 'powershell', which are often associated with malicious activity, obfuscation, or external resource loading.
The Storm-0408 malvertising campaign uses RegAsm.exe from the .NET Framework as a living-off-the-land binary for command and control. After the initial dropper from GitHub establishes a foothold, the malware injects code into RegAsm.exe to connect to C2 over TCP ports 15647 or 9000, exfiltrate data, and access DPAPI. This rule looks for RegAsm.exe launched from a temp or user writable path, which is unusual because the legitimate RegAsm is typically in the .NET Framework directory. In plain terms, it catches when a normal-looking system tool is being used from the wrong place to talk to an attacker.
Kali365 PHaaS Device Code Detection
Cortex XDR
This rule detects potential device code phishing attempts by correlating a device code flow initiated from an unmanaged/non-compliant device with a suspicious user agent (e.g., 'python-requests' or '-live') and an 'unbound' signInTokenProtectionStatus, with a subsequent 'Cmsi:Cmsi' token replay event for the same user. This combination suggests a successful device code phishing attack where an adversary has obtained and is replaying a token after the victim has authenticated.
Detects file creation, modification, or renaming events in the suspicious '%AppData%\WinDataScope' directory. This directory is hardcoded in the FrostyNeighbor dropper for staging PicassoLoader, indicating potential malware activity.
Detects wscript.exe launching mshta.exe to execute files in the temporary directory. This behavior is indicative of Gamaredon's GammaDrop launching the GammaLoad HTA payload.
Linux Timestomping via Reference FIle
Cortex XDR
Detects the use of the 'touch' command on Linux with '-m' and '-r' (reference file) or '--reference' arguments. This combination can be used for timestomping, a technique to modify file timestamps to evade detection or forensic analysis by making malicious files appear to have legitimate creation/modification times.
Detects registry modifications setting ConsentPromptBehaviorAdmin to 0, which weakens UAC protections by elevating without prompting. This behavior was observed in the TAX#TRIDENT campaign where a script disguised as a PNG altered UAC policies prior to silently installing a ManageEngine agent.
Page 475 of 863