Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
36 detections
Filters
Last updated
All Time
Detection languages
20
7
6
2
1
Contributors
36
Categories
20,425
11,812
5,870
5,145
4,864
Platforms
20
11
5
Products / Services
15
5
5
5
4
MITRE Techniques
26
16
14
9
7
CVEs
3
3
2
Detects folder-existence checks for Ledger Live/Wallet, cryptocurrency wallet directories (atomic, Exodus, Guarda, KeepKey, BitBox02), and Signal Desktop under %APPDATA%, correlated with a WMI AV-discovery query from the same process within 15 minutes, consistent with CountLoader's crypto-wallet reconnaissance.
Detects a WMI query against root\SecurityCenter2 AntiVirusProduct for displayName, correlated with an encoded PowerShell execution (-enc/-EncodedCommand/-e) from the same process chain within 10 minutes, consistent with CountLoader's AV-discovery step.
Correlates an outbound public-IP lookup (api.ipify.org/ifconfig.me) with a subsequent PBKDF2/SHA-256/XOR-referencing decode operation within 30 seconds on the same process, consistent with DOUBLECUP's environmental-keying anti-sandbox technique.
Detects a wmic process query followed by Windows Mutex creation, both initiated by python.exe/pythonw.exe running from a non-standard installation path, within a 5-minute window, consistent with DeviceManager's single-instance enforcement check.
Detects at least two of three macOS profiling subprocess commands (sw_vers -productVersion, system_profiler SPHardwareDataType, ioreg -rd1 -c IOPlatformExpertDevice) spawned by the same parent process within a 2-minute window, consistent with the CountLoader macOS variant's system-profiling routine.
Detects a correlated burst of registry enumeration by the impersonating process svchost32.exe touching multiple security-posture-relevant registry locations (Defender exclusions, RDP history, Office MRU, UAC level) within a short window, consistent with CornFlake reconnaissance.
Detects high-frequency enumeration of hard-coded AV/EDR process names via repeated OpenProcess API calls from an initiating process that is unsigned or running outside standard Windows system directories.
Detects uname/whoami host-fingerprinting commands chained as child processes of a bash process spawned from a suspicious /tmp-staged script, matching XCSSET's reconnaissance-and-exfiltration pattern.
Detects G13's expanded target discovery via unsigned/non-SYSTEM process enumeration that also covers services, broadening target discovery beyond the original hard-coded security-product process list.
Detects uname/whoami host-fingerprinting commands chained as child processes of a bash process spawned from a suspicious /tmp-staged script, matching XCSSET's reconnaissance-and-exfiltration pattern.
Detects XCSSET's 'stats' anti-VM module generating a hardware/CPU-based VM verdict string or exfiltrating the verdict to C2 to gate further module delivery.
Detects XCSSET's 'stats' anti-VM module generating a hardware/CPU-based VM verdict string or exfiltrating the verdict to C2 to gate further module delivery.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Page 2 of 2