Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,677
9,759
6,693
4,421
3,749
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects when a .NET assembly DLL from the Windows assembly cache (C:\Windows\assembly\) is loaded by a Microsoft Office application. This behavior can indicate an attempt to execute malicious code or achieve persistence through Office applications by leveraging .NET assemblies.
Detects threat actors proxy executing code and bypassing application controls by leveraging wmic and the `/FORMAT` argument switch to download and execute an XSL file (i.e js, vbs, etc). This rule specifically looks for `wmic.exe` loading scripting libraries like `jscript.dll` or `vbscript.dll`.
Detects potentially suspicious execution of 'csc.exe' (C# compiler) when spawned by common applications like Office programs, scripting engines (cscript.exe, wscript.exe, mshta.exe, powershell.exe), or from suspicious file system locations. This behavior can indicate payload delivery, compilation of malicious code on the fly, or defense evasion techniques.
Detects suspicious child processes spawned by Microsoft OneNote. This rule identifies attempts to execute malicious embedded objects from a .one file by monitoring for OneNote spawning known LOLBINs (Living Off the Land Binaries) or executables from suspicious paths. This behavior is often associated with initial access and execution techniques used by adversaries.
Detects process access to 'verclsid.exe' that involves injecting shellcode, originating from a Microsoft Office application or VBA macro. This behavior is indicative of malicious activity, potentially leveraging 'verclsid.exe' for defense evasion and privilege escalation.
Detects Microsoft Office applications executing child processes that include directory traversal patterns in their command line. This behavior is indicative of exploitation attempts, specifically referencing vulnerabilities like CVE-2022-30190 (MSDT RCE, also known as Follina) and CVE-2021-40444 (MSHTML RCE). The rule looks for common Office applications as parent processes and specific directory traversal strings in the child process's command line.
Detects any registry event that targets the key 'SECURITY\Policy\Secrets\n', which is a known indicator of SNAKE malware activity as described by CISA. This specific registry key is used by SNAKE malware for covert storage.
Detects the creation of a scheduled task by monitoring file creation events in the standard Windows scheduled task directories. This rule specifically looks for new files being written to ':\Windows\System32\Tasks\', ':\Windows\SysWOW64\Tasks\', and ':\Windows\Tasks\', which are common locations for scheduled task definitions.
Detects the execution of 'curl.exe' on Windows systems. This activity can indicate an attempt to download files from a remote location, make web requests to external servers, or potentially be used for command and control communication. Adversaries often use tools like curl for ingress tool transfer or to retrieve additional malicious payloads.
This rule detects the execution of rundll32.exe when it attempts to call a DLL export by its ordinal number. This technique is often used by malware for defense evasion, as it can bypass security tools that might not monitor rundll32.exe or its specific command-line arguments. The rule specifically looks for command-line patterns like ',#' or '.dll #' which indicate an ordinal call. It includes filters to reduce false positives from legitimate Windows components like EDGEHTML.dll or Visual Studio build processes.
This rule detects attempts by PowerShell processes (powershell.exe or pwsh.exe) to create a remote thread in the Local Security Authority Subsystem Service (LSASS) process. This activity is a common technique used by adversaries to dump credentials from memory.
Detects the creation of script files (JSE, VBE, JS, VBA, VBS) in common user or program data directories by wscript.exe or cscript.exe. This behavior is often associated with malware droppers or initial access techniques.
Detects when specific legitimate Windows applications or LOLBINs (Living Off the Land Binaries) create script files on disk. This behavior is often indicative of malicious activity where adversaries leverage trusted processes to drop and execute malicious scripts, bypassing security controls.
This rule detects a specific UAC bypass technique (UACMe method 39) that leverages .NET Code Profiler and DLL hijacking against mmc.exe. It specifically looks for the creation of a DLL named 'pe386.dll' within a user's temporary AppData directory, which is characteristic of this bypass method.
Detects signs of the WMI script host process "scrcons.exe" loading scripting DLLs which could indicate WMI ActiveScriptEventConsumers activity. This is a common technique for persistence and privilege escalation.
Detects potential DLL sideloading of DLLs that are known to be abused from suspicious locations. This rule identifies when specific DLLs (coreclr.dll, facesdk.dll, HPCustPartUI.dll, libcef.dll, ZIPDLL.dll) are loaded from unusual or suspicious directories, such as Perflogs, Users\Public, Temporary Internet Files, Windows\Temp, or various user profile subdirectories like Favorites, Favourites, Contacts, and Pictures. This behavior is indicative of an adversary attempting to execute malicious code by tricking a legitimate application into loading a malicious DLL from an unexpected path.
Detects the usage of the Time Travel Debugging (TTD) utility (tttracer.exe). Adversaries can leverage tttracer.exe to execute malicious processes or dump process memory, such as LSASS, for credential access. This rule specifically looks for process creation events where tttracer.exe is the parent process, indicating its use to launch other processes.
This rule detects Sysmon Event ID 27, which signifies a "FileBlockExecutable" event. This event is generated when Sysmon's configured block policy prevents an executable file from being created or modified. This indicates an attempt to introduce or alter an executable that violates the defined security policy.
Detects the creation of a remote thread from a PowerShell process (powershell.exe or pwsh.exe) into another process. This activity can be indicative of process injection techniques used by adversaries to execute malicious code or evade defenses. A filter is included to exclude known legitimate activity from CompatTelRunner.exe.
Detects Microsoft Excel loading an Add-In (.xll) file. Adversaries may use malicious Excel Add-Ins to execute arbitrary code, establish persistence, or perform other malicious activities. This rule specifically looks for the loading of '.xll' files by 'excel.exe'.
Detects the download of a file with a potentially suspicious extension from a .zip top-level domain. This rule specifically looks for the creation of alternate data streams (ADS) containing a 'Zone.Identifier' indicating a download from a '.zip' TLD, combined with suspicious file extensions commonly used for malicious payloads.
Page 442 of 465