Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
20
7
6
2
1
Contributors
36
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
20
11
5
Products / Services
15
5
5
5
4
MITRE Techniques
26
16
14
9
7
CVEs
3
3
2
Detects msagent.sys kernel driver load events immediately followed by targeted module/filter enumeration (driverquery/fltmc) referencing the same driver.
Detects enumeration of installed applications via .desktop files by a process outside known desktop-environment binaries, correlated with a subsequent persistence-related file write, matching the botking implant's discovery-then-persist behavior.
Detects at least 3 distinct C2Looper-associated discovery commands (ipconfig /all, whoami /all, nltest /dclist, net group /domain "domain admins"/"domain computers", wmic product get name,version, ls, drives) executed by the same parent process within a 60 second window, reducing false positives from isolated legitimate admin usage of any single command.
Detects at least 3 distinct C2Looper-associated discovery commands (ipconfig /all, whoami /all, nltest /dclist, net group /domain "domain admins"/"domain computers", wmic product get name,version) executed by the same parent process within a 60 second window, reducing false positives from isolated legitimate admin usage of any single command.
Detects correlated host and geolocation reconnaissance (sw_vers, whoami, ioreg, system_profiler) executed in quick succession by a non-standard process and written to a system_info.json file, matching AmnesiaStealer's recon routine.
Detects sandbox/VM fingerprinting via combined Win32_DiskDrive and Win32_VideoController WMI queries from the same process/host within a short window — anti-analysis behavior observed in the ACRStealer AutoIt payload prior to execution.
Detects RtkNGUI64.exe creating a mutex named as an 8-character hex string, consistent with the backdoor's CRC-32(USERNAME+USERDOMAIN+COMPUTERNAME) per-victim beacon ID used for single-instance checking.
Detects a read of /etc/os-release by a binary outside known system-utility paths, a precursor to the Rust-based RAT's host-fingerprinting telemetry; paired with a correlation rule requiring a subsequent outbound connection from the same binary to reduce noise.
Detects execution of the typosquatted process synchost.exe (distinct from the legitimate svchost.exe) when unsigned or running outside System32.
Detects presence of the EICAR AV test file only when co-occurring with ShieldBreak exploit artifacts (PoC binary, build files, or Warden.dll) in the same directory or process context, indicating exploit development/testing activity rather than routine AV testing.
Detects execution of whoami.exe as NT AUTHORITY\SYSTEM within a short window of, and parented by, a suspicious SYSTEM-privileged shell spawn — a common post-exploitation confirmation step following successful ShieldBreak exploitation. Standalone whoami execution is excluded by design.
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
Detects a security-software presence check (360 Total Security/eScan process names) followed within 10 minutes by a persistence-establishing event from the same parent process.
Correlates at least 3 of 4 distinct Abyssos background polling threads (clipboard, process list, network connections, screen capture) launched by the same unsigned/unknown-signature parent process within the same 5-minute window.
Detects correlated host-profiling reconnaissance by the DeviceManager RAT: three or more distinct indicators (MachineGuid, volume serial, user SID, AV product enumeration, domain/workgroup enumeration) executed within a 15-minute window from the same python.exe/pythonw.exe parent process.
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
Detects pgrep searching for ngrok, cloudflared, or wireguard-go process names from within a Claude Code shell-snapshot session, indicating discovery of tunnel/VPN tooling as part of an agent-driven attack chain.
Detects pgrep searching for ngrok, cloudflared, or wireguard-go process names from within a Claude Code shell-snapshot session, indicating discovery of tunnel/VPN tooling as part of an agent-driven attack chain.
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
Detects Abyssos RAT modules (DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, RDPWRAP) by requiring a shared XOR/AES-CBC key alongside a temp-folder write using a module-specific short prefix (dcf, vul, plg, rdp) that is followed by execution via an anomalous export function name (abyss or the module-specific Get*Text/Json exports)
Correlates a GetUserDefaultUILanguage locale check with subsequent deletion of a known-malicious scheduled task (MicroUpdaterV1, GoogleUpdateService, or MSEdgeUpdateService) and its install directory within a 5-minute window, consistent with DeviceManager's CIS-locale sandbox/analyst evasion self-cleanup routine.
Page 1 of 2