Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,460
11,847
5,879
5,158
4,866
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Detects file-system artifacts from JadeProx spearphishing delivery. The nested _CL_###### staging folder path is treated as the primary, high-confidence indicator on its own. Campaign decoy archive names (Estado de Cuenta.zip, Claude-Pro-Relay-Technical-Overview.zip) are generic business-document-style names that could coincide with unrelated legitimate files, so they only trigger the rule when accompanied by evidence of an LNK shortcut in the same drop (the shared JadeProx LNK machine ID desktop-47cf5k7, or a generic .lnk file) staging the TriBack Loader triad and decoy document.
This rule detects potential Web Proxy Auto-Discovery (WPAD) exploitation or manipulation. It monitors for the presence of 'wpad_capture.ocx' (often associated with WPAD-based credential capturing tools), execution of processes involving WPAD-related command-line tokens, and modifications to the 'AutoConfigURL' registry value, which is used to redirect traffic through an attacker-controlled proxy.
Threat actors are exploiting the recently Discovered WordPress Vulnerability. Vulnerability Management platform like defender not fully capable of identifying the vulnerable WordPress Core Application being installed on the organizations Servers. If you are using Defender XDR, here's the KQL to hunt for WordPress Installed Linux and Windows Servers.
Detects creation of Chromium/Edge NativeMessagingHosts registry keys or supporting files (native_host.py, *.api.json) pointing to non-Program Files locations such as AppData, Temp, or ProgramData, consistent with the Edgecution malicious edge extension backdoor's native messaging host persistence mechanism used by UNC6692 to enable extension-to-native-process IPC.
This rule detects the presence of the Edgecution native_host.py Python backdoor by identifying specific, hardcoded code structures used for XOR deobfuscation. It specifically looks for the decryption loop combined with the registry lookup against 'HKCU\SOFTWARE\Microsoft\Edge' used to derive the decryption key, as well as distinct function names and error strings associated with the malware's implementation.
This rule detects unauthorized access or modifications to hardware watchdog device files (/dev/watchdog, /dev/watchdog0, /dev/misc/watchdog, /dev/FTWDT101_watchdog) on Linux systems. Adversaries may manipulate these files to disable the hardware watchdog's automatic reboot functionality, potentially to maintain persistence or to ensure system stability while performing malicious actions without the risk of an unexpected forced reboot.
Detects the legacy SourTrade Mark-of-the-Web spoofing variant, where a downloaded file's Zone.Identifier data or an observed network request references the jimmywarting.github.io/StreamSaver.js helper path with an embedded attacker domain, date, and installer.exe filename — used to disguise the true download provenance of browser-assembled malware.
Detects TriBack Loader signed host binary (avk.exe or hostfxr.dll) being written to the Windows Startup folder. Correlation input paired with the encrypted companion file drop detection.
Detects the presence of BridgeHead tunneler binaries disguised as legitimate library files ('unbcl.dll' or 'libwinpthread-1.dll') within non-standard directories, a behavior associated with Mirage Kitten intrusions.
Detects instances where a process other than the legitimate Discord client or its updater accesses the Local Storage/leveldb directory. This path contains cached authentication tokens and session data, making it a frequent target for credential theft malware such as SectopRAT in the FakeAgent campaign.
Detects the creation of an executable with a system process name in folders other than the system ones (System32, SysWOW64, etc.).
It is highly recommended to perform an initial baseline before using this rule in production.
It is highly recommended to perform an initial baseline before using this rule in production.
Detects TriBack Loader signed host binary (avk.exe or hostfxr.dll) being written to the Windows Startup folder. Correlation input paired with the encrypted companion file drop detection.
Detects creation of a file whose name is exactly ~del.vbs.bat, the self-deletion batch script JadeProx uses to remove its staging VBScript a few seconds after execution. Tightened to require an exact filename boundary and creation by wscript.exe or cmd.exe to reduce coincidental matches.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Detects creation of the mmcompat.pth file in Python site-packages, the mrmustard stealer's persistence mechanism designed to survive package uninstall.
Detects unauthorized write or modification access to core Windows boot-related files such as bootmgr, winload.efi, and the BCD store. This activity is indicative of destructive wiper malware attempting to render the operating system unbootable to prevent recovery, a technique observed in the TOKYOCORE wiper campaign.
Bulk file-write activity by a single process within a 1-minute window, filtered to exclude common high-volume legitimate processes (backup agents, AV scanners, installers, sync clients) and correlated with the appearance of ransom-note-style filenames or unusual/new file extensions in the same window, indicative of ransomware encryption post-RAT access.
Detects creation of a PHP file under a WordPress wp-content/cache directory attributed either to the mysqld process or to a web-server process (apache2) whose command line contains an INTO OUTFILE-style SQL pattern. In the wp2shell exploit chain, SQL injection reaching author__not_in can be abused to write a webshell via SQL INTO OUTFILE directly into wp-content/cache instead of the plugin-install path, bypassing plugin-directory-focused detections. Requiring database-process or INTO OUTFILE attribution reduces false positives from legitimate caching plugins that generate PHP cache files under this same directory.
Detects creation of a file whose name is exactly ~del.vbs.bat, the self-deletion batch script JadeProx uses to remove its staging VBScript a few seconds after execution. Tightened to require an exact filename boundary and creation by wscript.exe or cmd.exe to reduce coincidental matches.
Detects creation of a file whose name is exactly ~del.vbs.bat, the self-deletion batch script JadeProx uses to remove its staging VBScript a few seconds after execution. Tightened to require an exact filename boundary and creation by wscript.exe or cmd.exe to reduce coincidental matches.
Detects file-system artifacts from JadeProx spearphishing delivery. The nested _CL_###### staging folder path is treated as the primary, high-confidence indicator on its own. Campaign decoy archive names (Estado de Cuenta.zip, Claude-Pro-Relay-Technical-Overview.zip) are generic business-document-style names that could coincide with unrelated legitimate files, so they only trigger the rule when accompanied by evidence of an LNK shortcut in the same drop (the shared JadeProx LNK machine ID desktop-47cf5k7, or a generic .lnk file) staging the TriBack Loader triad and decoy document.
Page 63 of 139