Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
128 detections
Filters
Last updated
All Time
Detection languages
74
35
16
3
Contributors
128
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
98
28
3
Products / Services
55
14
10
8
7
MITRE Techniques
82
33
30
23
11
CVEs
4
4
1
Correlates AES-CBC shellcode decryption (EXECURL_AES_HOL/EXECLOCAL_AES_HOL/AESHOL) with a preceding external download and a full VirtualAllocEx-WriteProcessMemory-CreateRemoteThread injection sequence into a named target process within 1 hour.
Detects Abyssos RAT modules (DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, RDPWRAP) by requiring a shared XOR/AES-CBC key alongside a temp-folder write using a module-specific short prefix (dcf, vul, plg, rdp) that is followed by execution via an anomalous export function name (abyss or the module-specific Get*Text/Json exports)
Detects binaries containing hardcoded VM tooling process names alongside a CPUID hypervisor-detection instruction immediately followed by evasive conditional branching or a process-termination call, consistent with Abyssos hypervisor fingerprinting and sandbox evasion.
Detects the Abyssos RAT main executable via known sample hashes, or by requiring a minimum weight/threshold of co-occurring structural PE traits (obfuscated single-executable-section layout, minimal static import table consistent with CRC32-based dynamic API hashing, and absence of a valid certificate), rather than any single trait alone.
Detects the SMOKE#SCREEN loader.cs technique of inserting a ~180 second delay between ScreenConnect/RMM MSI installation and the resulting service start, deliberately used to break EDR/SIEM correlation windows.
Detects the Abyssos UAC_BYPASS_ICMLUAUTIL technique: a process referencing the ICMLuaUtil COM interface/CLSID that ends up running at High/System integrity without going through consent.exe.
Detects creation of a mutex matching Abyssos's Global\[UUID4]_Admin/_User single-instance naming convention, or the specific known hardcoded mutex GUID.
Detects CornFlake RAT dropper binaries requiring the svchost32 persistence path, fake update progress window strings, decoy update-lure terms, and Go-binary compiler artifacts together to reduce false positives on unrelated Go binaries or benign installers
Detects cscript.exe/wscript.exe execution where the command line contains both low-RAM sandbox detection indicators and analysis-tool/process enumeration indicators, consistent with VBScript-based sandbox evasion logic observed in the SMOKE#SCREEN campaign.
Detects multiple distinct categories of Windows Defender and SmartScreen tampering commands executed by the same host/user/causality process within a 10-minute window, consistent with the SMOKE#SCREEN campaign's defense evasion tradecraft.
Detects PowerShell or pwsh processes that download remote content and subsequently compile it in-memory using Add-Type, a fileless execution technique observed in the SMOKE#SCREEN campaign to load .NET loaders without writing an executable to disk.
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects cloud app account activity indicating that usage alerting or audit logging has been disabled, which could allow attackers to hide token jacking or unauthorized AI resource consumption.
Correlates a GetUserDefaultUILanguage locale check with subsequent deletion of a known-malicious scheduled task (MicroUpdaterV1, GoogleUpdateService, or MSEdgeUpdateService) and its install directory within a 5-minute window, consistent with DeviceManager's CIS-locale sandbox/analyst evasion self-cleanup routine.
Detects a correlated sequence where an unsigned cscript.exe/wscript.exe process executes a .vbs script, WMI-based hidden process creation is observed, and msiexec.exe performs a silent MSI installation, consistent with the SMOKE#SCREEN VBScript dropper chain that uses WMI to silently install a ScreenConnect MSI payload.
Detects a PowerShell-driven sequence where a file is downloaded, has its Mark-of-the-Web removed via Unlock-File, then is executed through msiexec /i on the same file path within a 10-minute window, mirroring the SMOKE#SCREEN ScreenConnect delivery chain.
Detects PowerShell/pwsh processes using .NET reflection to set amsiInitFailed and disable AMSI scanning, when spawned interactively or from a scripting/shell host and unsigned, correlated with subsequent download-cradle or encoded-command execution within a 5-minute window.
Detects operations that remove, disable, delete, or update billing limits, spending limits, usage alerts, spend notifications, billing thresholds, or cost alerts on AI service accounts, which may indicate an attacker attempting to remove financial guardrails to enable unrestricted abuse of stolen AI API credentials.
Detects UAC bypass attempts abusing SilentCleanup, wsreset.exe, or sdclt.exe via registry hijacks, correlated with the subsequent auto-elevated execution, plus anti-forensic cleanup indicators.
Detects mshta.exe invoked with a remote HTTP(S) URL argument, consistent with CountLoader's taskType 10 command proxying malicious script execution through mshta.exe, excluding local file/HTA paths.
Detects the (currently dormant in observed samples) CountLoader capability to rewrite browser shortcuts so they co-launch conhost.exe --headless alongside a legitimate browser.
Page 4 of 7