Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,432
11,818
5,871
5,150
4,864
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects mshta.exe being launched from explorer.exe or cmd.exe with a command line argument pointing to a remote HTTP/HTTPS resource ending in .hta. This pattern is commonly used by adversaries to execute malicious remote HTML applications for initial access or code execution.
Detects download or reference to the chrome-injector Chrome App-Bound Encryption decryption tool (github.com/xaitax/Chrome-App-Bound-Encryption-Decryption), attempted by JadeProx operators for post-exploitation browser credential theft.
Detects the BlueNoroff VBScript implant's C2-tasked execution engine — dual wscript.exe invocations with campaign-specific numeric arguments, or a curl-fetched secondary payload chained into cmd/WScript.Shell execution — excluding legitimate installer deployment tooling.
Detects an obfuscated, hidden-window PowerShell loader chaining campaign-specific SET environment-variable assignments to stage a payload path and download a next-stage payload from cdn.zoom-videos infrastructure, consistent with BlueNoroff's ClickFix PowerShell staging technique.
Detects HTTP GET requests to a known malicious endpoint attempting to download a file named 'update_ms.msi', associated with the Chaos msaRAT trojan.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
Detects mshta.exe being launched from explorer.exe or cmd.exe with a command line argument pointing to a remote HTTP/HTTPS resource ending in .hta. This pattern is commonly used by adversaries to execute malicious remote HTML applications for initial access or code execution.
Detects the use of curl.exe to download a specific file named 'update_ms.msi' from a known malicious IP address. This behavior is indicative of a stager for msaRAT being downloaded onto a Windows host, potentially disguised to mimic a legitimate Windows update file.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
Detects the use of PowerShell commands 'irm' (Invoke-RestMethod) or 'iwr' (Invoke-WebRequest) to download content from a direct IP address. This pattern is commonly used by attackers to stage malicious payloads or tools directly from external infrastructure, bypassing domain-based reputation filters.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detection of network communications associated with the TAG-195 campaign, specifically targeting the 'ClickFix' social engineering lure. The rules identify TLS SNI, DNS queries, and HTTP requests involving known C2/staging domains 'screenly.cam' and 'xtrafftrck.net', as well as specific payload retrieval patterns for OCX files and 'curl' usage involving the infrastructure IP 70.34.205.43.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
Detects the installation of Python on Windows systems using various package managers (WinGet, Chocolatey, Scoop), MSI installers, or direct download methods via command-line utilities like PowerShell, curl, or wget.
This rule detects PowerShell commands initiated by web browsers that exhibit characteristics of the 'ClickFix' social engineering technique. The detection logic looks for high-risk flags (hidden window, bypass execution policy) associated with common ClickFix artifacts such as references to temporary directories, domain-specific indicators like 'memshowblob.forum', and the removal of Zone.Identifier alternate data streams which are often used to bypass security warnings.
Detects instances of 'pip' or 'git' being executed by a Python process to clone or install packages from external sources. This behavior is commonly used to install malicious or untrusted custom nodes within a ComfyUI environment, potentially facilitating initial access or code execution.
Detects anomalous, automated data exfiltration cycles in Microsoft 365 environments consistent with the Helix threat group. The rule identifies a pattern of successful sign-ins followed within 6 hours by new MFA registration, suspicious SharePoint enumeration, and a high-frequency, non-human-paced burst of file downloads.
Detects the use of shell interpreters (sh, bash, zsh) to download content from GitHub using curl (specifically using the -s silent flag) and subsequent base64 decoding of potentially obfuscated payloads using the base64 command with the -D flag.
Detects malicious downloader activity where mshta.exe or a spawned runexe.bat script utilizes PowerShell's Net.WebClient to download and execute secondary payloads. This is a common pattern for stage-two malware delivery.
Detects instances where a user receives an email containing a link to 'canva.com' with subject lines suggestive of document sharing or invoicing, and subsequently clicks a URL that redirects them away from the 'canva.com' domain. This behavior is indicative of potential document-based phishing where attackers use legitimate document hosting platforms as a lure to redirect users to malicious or credential-harvesting websites.
Detects instances where the 'Werkbit' process initiates either 'curl' or 'bash' to download files from GitHub-related domains. This behavior is indicative of a living-off-the-land technique used to fetch secondary payloads or scripts during a post-exploitation phase.
Page 35 of 76