Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,456
11,839
5,876
5,155
4,865
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects C2Looper's remote interactive shell and ShellExecuteW run-and-self-delete command execution, correlated with the c2_out.txt output-capture artifact.
This rule detects the suspicious execution of the native Windows FTP utility ('ftp.exe') initiated by a shortcut file (.lnk). It specifically looks for the '-s' command-line switch, which is used to execute a script file for non-interactive FTP operations. This pattern is commonly observed in malware campaigns where an adversary uses a shortcut file to trigger a secondary stage of the attack by downloading payloads via FTP scripts.
This rule detects the installation of malicious VS Code extensions by monitoring file system writes within common VS Code and VS Code Server extension directories. It specifically alerts on a predefined list of extension namespaces associated with a known malicious coordinated campaign that impersonated legitimate publishers.
This rule detects potential DLL sideloading by monitoring SumatraPDF.exe (SmartaPDF.exe) for the loading of a library named 'libmupdf.dll' from a non-standard or user-writable location. It combines process image load events with file activity patterns related to SumatraPDF cache and settings files, which are common indicators of malicious activity associated with this binary.
Detects the presence of Afd4Eop12_x64.dll or the execution of command lines referencing specific exploit indicators such as 'initialize_afd_npfs_exploit' or 'enable_god_mode', often associated with local privilege escalation exploits leveraging kernel vulnerabilities.
Detects the execution of msiexec.exe to install specific MSI packages (ManageEngine-OpManager.msi or Advanced-IP-Scanner.msi) when initiated by explorer.exe. This pattern is indicative of user-driven execution, which may be part of an initial access or software deployment workflow.
Detects anomalous behavior by pythonw.exe where it interacts with screen locker assets or loads specific DLLs from non-standard locations, indicative of a PhishLocker-style fake lock screen being deployed to capture user credentials.
Detects Mirage2FA phishing stager artifacts by requiring multiple distinctive indicators together: XOR key 0xAD decode chain, LINX*/token placeholders, obfuscator.io _0x naming, api/xls C2 path, iframe injection, and SVG ECMAScript AiTM redirect
Detects a new build-dependencies entry adding a networking crate (ureq/reqwest/rustls) to a Cargo.toml that previously had no such dependency, correlated with a recent Cargo.lock modification, flagging a package gaining unexpected build-time network capability.
Detects the presence of known vulnerable drivers (rwdrv.sys and hlpdrv.sys) associated with 'Bring Your Own Vulnerable Driver' (BYOVD) attacks. Adversaries utilize these drivers to gain kernel-level access, allowing them to disable security software, escalate privileges, or maintain persistence.
Detects processes attempting to interact with multiple browser binaries (chrome.exe or msedge.exe) across different standard application directories within a short time window. This behavior often indicates an adversary or malicious script probing for specific installed browsers to facilitate credential harvesting, configuration dumping, or session hijacking.
The following analytic detects the suspicious creation of msmpeng.exe or mpsvc.dll in non-default Windows Defender folders. It leverages the Endpoint.Filesystem datamodel to identify instances where these files are created outside their expected directories. This activity is significant because it is associated with the REvil ransomware, which uses DLL side-loading to execute malicious payloads. If confirmed malicious, this could lead to ransomware deployment, resulting in data encryption, system compromise, and potential data loss or extortion.
Detects TWINLOOT PyArmor 9.2.5-protected implant components via known file hashes combined with expected filesize range and filename/extension pattern (bootstrap-fat.pyc, pyarmor_runtime.pyd, .pyarmor.ikey, embedded vendor ZIP) to reduce false positives from renamed unrelated files with coincidental hash context
This rule identifies rare web browser extensions installed on Chrome or Edge browsers by monitoring file events for low-prevalence extension IDs. An extension is considered rare if it has been observed on fewer than 3 devices within the last 30 days. This pattern is often used to detect malicious or unauthorized extensions, which can be leveraged for persistence or credential theft.
Detects the C2Looper secondary payload dropped as pld.exe under %LocalAppData%, typically staged as a ransomware precursor after backdoor check-in.
This rule detects suspicious activity where an executable named 'new.exe' located in a temporary directory initiates a process image load of a non-DLL file or an unspecified module. This pattern is indicative of reflective code loading or process injection, where a malicious binary attempts to execute payloads directly in memory rather than relying on standard DLL loading mechanisms.
This rule detects potential spearphishing attempts by identifying emails with ZIP attachments that contain filenames or subjects masquerading as specific organizations or job opportunities (e.g., 'Lockheed Martin', 'Enveil'). It triggers on incoming emails containing suspicious job-lure keywords in the subject line or file attachments, which are often used to deliver initial access payloads.
This rule detects potential infection by fake-VPN browser extensions associated with the 'Myxa VPN' campaign by monitoring for specific file paths and filenames linked to known malicious extension IDs. Additionally, it monitors for network connections to known command-and-control IP addresses associated with this campaign.
Detects a read of /etc/os-release by a binary outside known system-utility paths, a precursor to the Rust-based RAT's host-fingerprinting telemetry; paired with a correlation rule requiring a subsequent outbound connection from the same binary to reduce noise.
This rule Hunts Microsoft Defender for Endpoint DeviceFileEvents for .aspx/.ashx/.asmx files created by w3wp.exe (the IIS worker process) inside SharePoint-specific directories (wss\VirtualDirectories, Web Server Extensions, TEMPLATE\LAYOUTS, App_Code, App_Web, \bin\) — a classic webshell-drop pattern used once an attacker has already gained code execution on the server. It excludes benign SYSTEM/TrustedInstaller writes of default.aspx/upgrade.aspx to cut noise from normal patching/upgrade activity. This is a post-exploitation signature — it doesn't detect the exploit itself, only the artifact an attacker typically drops afterward.
CVE-2026-63520 An unauthenticated remote-code-execution flaw in SharePoint Server's Business Connectivity Services, caused by unsafe .NET type instantiation, disclosed jointly by Rapid7 and Microsoft. It lets an attacker execute arbitrary code with the privileges of the SharePoint site's service account. It's the second half of a two-part chain — combined with the earlier CVE-2026-55040 (disclosed the prior month), it enables full unauthenticated RCE. As of disclosure there was no public PoC and no observed exploitation, though Microsoft rated it "exploitation more likely," and CVSS attack complexity is high, meaning reliably chaining both CVEs takes real effort.
Since no exploitation artifacts for this CVE chain are public yet, this rule is a generic SharePoint webshell hunt tagged to the CVEs for tracking -- it's not a signature of the BCS exploitation primitive itself.
CVE-2026-63520 An unauthenticated remote-code-execution flaw in SharePoint Server's Business Connectivity Services, caused by unsafe .NET type instantiation, disclosed jointly by Rapid7 and Microsoft. It lets an attacker execute arbitrary code with the privileges of the SharePoint site's service account. It's the second half of a two-part chain — combined with the earlier CVE-2026-55040 (disclosed the prior month), it enables full unauthenticated RCE. As of disclosure there was no public PoC and no observed exploitation, though Microsoft rated it "exploitation more likely," and CVSS attack complexity is high, meaning reliably chaining both CVEs takes real effort.
Since no exploitation artifacts for this CVE chain are public yet, this rule is a generic SharePoint webshell hunt tagged to the CVEs for tracking -- it's not a signature of the BCS exploitation primitive itself.
Detects file creation, write, or rename operations to specific paths known to be used in exploitation of CVE-2026-63077.
Page 59 of 139