Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects execution of potentially suspicious processes ('Launcher.exe' or 'GapiUpdate.exe') originating from ClickOnce-related processes ('dfsvc.exe' or 'rundll32.exe' with 'dfshim.dll'). ClickOnce is often abused to proxy execution of malicious code, allowing adversaries to execute applications from user-writable directories without administrative privileges.
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects NeedleStealer Rust-based stealer binaries via Go module path strings, C2 domain, build tag, and embedded browser wallet extension identifiers
Detects NeedleStealer Go-based stealer payload via embedded module path, internal API namespace, build tag, and C2 backend domain
Detects NeedleStealer Go-based stealer payload via embedded module path, internal API namespace, build tag, and C2 backend domain
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects the execution of known malicious files associated with the BlueDelta threat group, specifically the HOOKEDGE and HEADLACE malware families, using a curated list of SHA-256 file hashes. Additionally, the rule monitors for the execution of scripts with GUID-based filenames, a common tactic for temporal or staged file deployment.
Matches known HOOKEDGE malware samples attributed to BlueDelta (APT28) via SHA256 hash comparison
Detects the Kimsuky trojanized .NET installer OrionQuests-Setup.exe that decrypts embedded AES resource OrionSetup.payload.enc to drop a decoy OrionLauncher installer and malicious LNK file
Detects known malicious files associated with Kimsuky (APT-C-55) Stella_Gary attack chain by MD5 hash: OrionQuests-Setup.exe installer, guide.url.lnk, test.bef_fri, and backdoor payload component
This rule detects instances where a process named 'wsc_updata.exe' executing from a Temp directory loads a library named 'wsc.dll'. This behavior is characteristic of DLL side-loading or DLL hijacking, where a malicious or potentially unwanted executable attempts to load a library from a user-writable directory to execute arbitrary code.
Detects execution artifacts of the MovieReaper stage 2 implant, specifically its capability to parse and load COFF modules into memory without writing them to disk. The rule monitors process command lines for 'module_init' and identifies suspicious API activity related to memory-based module loading, such as reflective DLL loading or remote thread creation.
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects Mimikatz binary or in-memory module used for credential harvesting following PaperCut RCE exploitation
Detects cmd.jar, a JAR-based command executor used by threat actors on compromised Cisco Secure FMC to run arbitrary shell commands via /bin/sh -c
Detects the execution of OrionQuests-Setup.exe, a .NET-based executable identified as a malicious installer used by the Kimsuky (APT-C-55/BabyShark) threat group. The rule flags PE files that match the specific filename and contain both .NET framework indicators and references to LNK files, suggesting the dropper mechanism for initial stage infection.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla installation directories, such as AppData, Temp, Downloads, or ProgramData. Additionally, the rule validates if the binary is digitally signed by Mozilla. This behavior is indicative of a masquerading attempt, where an attacker runs a malicious executable disguised as Firefox.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla installation directories, such as AppData, Temp, Downloads, or ProgramData. Additionally, the rule validates if the binary is digitally signed by Mozilla. This behavior is indicative of a masquerading attempt, where an attacker runs a malicious executable disguised as Firefox.
Detects files that are masquerading as Rich Text Format (RTF) documents but do not contain valid RTF magic bytes and instead contain embedded Portable Executable (PE) headers or DOS stubs. This behavior is indicative of malware delivery via file-type masquerading, often used in spearphishing campaigns by actors such as Kimsuky.
This rule detects potential BabylonRAT malware samples by identifying a combination of dynamic API resolution techniques (using GetProcAddress and LoadLibrary) and XOR-obfuscated string blocks representing critical DLL and API names. The detection utilizes high file entropy and specific artifact strings to identify binaries attempting to evade static analysis.
Page 42 of 80