Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,545 detections
Filters
Last updated
All Time
Detection languages
2,480
532
344
301
286
Contributors
1,303
815
737
215
193
Categories
20,460
11,847
5,879
5,158
4,866
4,545
Platforms
3,841
1,051
473
40
29
Products / Services
1,837
1,138
211
183
171
MITRE Techniques
1,604
1,424
1,300
750
473
CVEs
19
17
16
11
11
IDS Classtypes
23
1
IDS Protocols
16
7
1
Detects creation of the appscreen.log file under %PROGRAMDATA%\appscreen, an artifact used by GoGRPC backdoor variants to track malware execution activity.
Detects file-system artifacts from JadeProx spearphishing delivery. The nested _CL_###### staging folder path is treated as the primary, high-confidence indicator on its own. Campaign decoy archive names (Estado de Cuenta.zip, Claude-Pro-Relay-Technical-Overview.zip) are generic business-document-style names that could coincide with unrelated legitimate files, so they only trigger the rule when accompanied by evidence of an LNK shortcut in the same drop (the shared JadeProx LNK machine ID desktop-47cf5k7, or a generic .lnk file) staging the TriBack Loader triad and decoy document.
Detects short-lived, randomly-named .txt files (15-30 lowercase letters) created and then deleted within 5 minutes by python.exe or pythonw.exe processes in a folder path containing "native", consistent with the Edgecution native messaging host component using temporary text files as a queue/log for C2 command exchange.
Detects persistence achieved via a shortcut (.lnk) file created in a user's Startup folder that launches an AutoHotkey script. The rule specifically looks for AutoHotkey processes executing scripts from common writable locations (Temp, AppData) with command-line arguments referencing functions (CheckHeadlessEdge, FindAndRunTask) associated with the SNOWBELT loader and UNC6692's Edgecution malware suite.
Detects creation of Chromium/Edge NativeMessagingHosts registry keys or supporting files (native_host.py, *.api.json) pointing to non-Program Files locations such as AppData, Temp, or ProgramData, consistent with the Edgecution malicious edge extension backdoor's native messaging host persistence mechanism used by UNC6692 to enable extension-to-native-process IPC.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects the execution of AutoHotkey-based Edgecution malware stagers (set36418917.ahk/.exe) and their associated file-drop events in unusual locations like user temp and downloads folders. This activity is associated with the threat actor UNC6692 following hands-on-keyboard access via Quick Assist.
Detects potential lateral movement by identifying the creation or modification of a file named 'fsociety.exe' on sensitive Windows administrative shares (ADMIN$ or C$). This behavior is consistent with the TOKYOCORE worm-like threat activity, where malicious binaries are replicated across the network.
Detects an untrusted process accessing sensitive browser credential and cookie files across multiple browser families and profiles in a short period, followed immediately by the creation of a ZIP archive. This pattern is consistent with the behavior of credential-stealing malware like Dolphin X, which aggregates stolen browser data into an archive for exfiltration.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects TriBack Loader signed host binary (avk.exe or hostfxr.dll) being written to the Windows Startup folder. Correlation input paired with the encrypted companion file drop detection.
This rule detects attempts to sabotage or brick Linux systems by monitoring for modifications or overwrites of critical system binaries responsible for reboot, shutdown, and power management, including 'reboot', 'shutdown', 'halt', 'poweroff', 'systemctl', and 'telinit'. It specifically identifies activity associated with the 'ELFOOD' header-corruption marker, a technique linked to the Tengu malware strain which prevents legitimate system reboots to maintain persistence and impede remediation efforts.
Detects the presence of BridgeHead tunneler binaries disguised as legitimate library files ('unbcl.dll' or 'libwinpthread-1.dll') within non-standard directories, a behavior associated with Mirage Kitten intrusions.
Detects DLL sideloading of 'version.dll' by a signed 'OneDrive.exe' process where the DLL was created via 'WriteFile' (indicating direct write rather than browser download) and lacks a 'Zone.Identifier' (Mark-of-the-Web). This combination is characteristic of evasion techniques found in toolkits like Dolphin X Agent Builder to bypass SmartScreen and initial execution defenses.
Detects the creation of specific screenshot files associated with the TOKYOCORE ransomware, which uses these images for surveillance and data exfiltration. The rule monitors for the specific file name 'tokyocore_ss.png' or generic 'screenshot.png' files created in directories containing 'screenshots' within the file path.
Detects TriBack Loader signed host binary (avk.exe or hostfxr.dll) being written to the Windows Startup folder. Correlation input paired with the encrypted companion file drop detection.
Fires only when the TriBack Loader signed host binary (avk.exe/hostfxr.dll) and its expected encrypted companion .dat file are both dropped into the same Windows Startup folder location and within a 5-minute window of each other, rather than alerting on either filename alone. This reduces false positives from legitimate G DATA AVK installs or unrelated MSI packages that could coincidentally drop matching filenames without the paired companion artifact.
Detects creation of a file whose name is exactly ~del.vbs.bat, the self-deletion batch script JadeProx uses to remove its staging VBScript a few seconds after execution. Tightened to require an exact filename boundary and creation by wscript.exe or cmd.exe to reduce coincidental matches.
This rule detects a suspicious pattern on Linux systems where a process creates a file in the /tmp directory with a name consisting of a long hexadecimal string (indicative of a hash, often used by Rust-based loaders for Sliver or similar implants), followed immediately by the execution of that same file by the initiating process.
Detects SleeperGem RubyGems supply chain artifacts: hardcoded Forgejo C2 reference in gem Ruby source, the git-credential-manager binary dropped under the hidden gcm path, and supporting deploy.sh/persistence indicators (ping6 backdoor, systemd/cron service under the git-credential-manager name)
Detects unauthorized access or staging operations on the C:\Windows\debug\NetSetup.log file. This activity is often associated with the NightLedger tool, which collects this diagnostic log alongside process listings for potential exfiltration. The rule filters out legitimate system processes that typically interact with this file during domain or workgroup join operations.
Page 85 of 217