Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
IOC SHA256 Hash VT
YARA-L
Detect file/process events with watchlisted hashes from MISP that VT flagged as MS Office docx file types
Identify process and file creation using safe browsing hashes where the first and last seen are more than 7 days apart
Alert on known File Hash executing known File Hash with VT Relationships.
Detect web traffic to a recently expired domain followed by an exe file creation event
Detects file access requests to the Windows Credential History File by an uncommon application.
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
This can be a sign of credential stealing. Example case would be usage of mimikatz "dpapi::credhist" function
Detects file access requests to crypto currency files by uncommon processes.
Could indicate potential attempt of crypto currency wallet stealing.
Could indicate potential attempt of crypto currency wallet stealing.
Detects file access requests to potentially sensitive files hosted on the Windows Sysvol share.
Detects file access attempts to sensitive Microsoft teams files (leveldb, cookies) by an uncommon process.
Detects an initiated network connection by a non browser process on the system to "azurewebsites.net". The latter was often used by threat actors as a malware hosting and exfiltration site.
Detects suspicious use of an .exe extension after a non-executable file extension like .pdf.exe, a set of spaces or underlines to cloak the executable file in spear phishing campaigns
Detects potential DLL sideloading of "libcurl.dll" by the "gup.exe" process from an uncommon location. This technique can be used by adversaries to execute malicious code by tricking a legitimate application into loading a malicious DLL instead of its legitimate counterpart.
The following analytic identifies the first-time execution of child processes spawned by Zoom (zoom.exe or zoom.us). It leverages Endpoint Detection and Response (EDR) data, specifically monitoring process creation events and comparing them against previously seen child processes. This activity is significant because the execution of unfamiliar child processes by Zoom could indicate malicious exploitation or misuse of the application. If confirmed malicious, this could lead to unauthorized code execution, data exfiltration, or further compromise of the endpoint.
Detects the creation of system DLLs that are usually not present on the system (or at least not in system directories). This technique is commonly used to achieve DLL hijacking, which can lead to defense evasion, persistence, and privilege escalation.
This rule detects attempts to bypass User Account Control (UAC) by loading a fake 'dismcore.dll' with 'dism.exe'. This technique involves placing a malicious 'dismcore.dll' in a location where 'dism.exe' will load it instead of the legitimate system DLL, often leading to privilege escalation.
This rule detects potential DLL sideloading of "chrome_frame_helper.dll". It triggers when "chrome_frame_helper.dll" is loaded from a location other than the legitimate Google Chrome application directories (C:\Program Files\Google\Chrome\Application\ or C:\Program Files (x86)\Google\Chrome\Application\) or the user's local AppData path for Chrome.
Detects potential DLL sideloading using comctl32.dll by monitoring specific Windows executables loading this DLL from a '.local' directory, which is a common technique for privilege escalation and defense evasion.
Detects Deno writing a file from a direct HTTP(s) call and writing to the appdata folder or bringing it's own malicious DLL.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
This behavior may indicate an attempt to execute remotely hosted, potentially malicious files through deno.
Detects file creation events with filename patterns used by Impacket.
Detects processes loading the non-existent DLL "ShellChromeAPI.dll". This behavior is often associated with DLL sideloading attacks, where an adversary places a malicious DLL with a name that a legitimate application expects to load. A known example involves "DeviceEnroller.exe" attempting to load this DLL when used with the "PhoneDeepLink" flag. Adversaries can exploit this by dropping their own renamed malicious DLL to achieve defense evasion, persistence, or privilege escalation.
Detects DLL sideloading of 'vmGuestLib.dll' by the 'WmiApSrv.exe' service. This rule specifically looks for instances where 'WmiApSrv.exe' loads 'vmGuestLib.dll' from a path that includes '\VMware\VMware Tools\vmStatsProvider\win32', while the DLL itself is not legitimately signed. This behavior can indicate an attempt to execute malicious code by tricking a legitimate process into loading a rogue DLL.
Detects potential DLL sideloading of a signed dbghelp.dll by the Sysinternals VMMap utility. This rule specifically looks for VMMap (vmmap.exe or vmmap64.exe) loading a dbghelp.dll from a non-standard path ('C:\Debuggers\dbghelp.dll') where the loaded DLL is signed. This could indicate an adversary attempting to load a malicious, yet signed, DLL to evade detection or achieve persistence/privilege escalation.
Page 399 of 465