Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Detects the execution of an 'update.exe' process initiated by 'svchost.exe' where the update executable resides in non-standard, user-writable directories (AppData, Temp, Users Public, or Downloads). This behavior is highly suspicious as svchost.exe should typically only execute binaries from system directories, and the target file is running in a location common for malware staging.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
Detects the second-stage payload of the ChainDrop/Mini Shai-Hulud npm supply chain worm, specifically targeting GitHub Actions runner environments. The rule identifies obfuscated Bun-bundled CommonJS credential-stealing scripts (math_init.js) designed to harvest secrets from the Runner.Worker process memory and communicate with C2 infrastructure via EtherHiding Ethereum contract interaction.
This rule monitors for known file hashes and network indicators associated with Bindcloak malware. It alerts on endpoint file execution events matching specific SHA256/MD5/SHA1 hashes and network connection events to suspicious domains or a specific malicious IP address.
Detects instances where a web browser process creates a new executable file (.exe) in the 'Downloads' folder without a corresponding network connection event recorded by the browser to an executable URL. This pattern is indicative of potential in-browser assembly of a malicious file or an executable being dropped via non-standard browser download pathways, such as through local file system manipulation or hidden secondary processes.
This rule detects two potentially malicious behaviors: 1) The creation or installation of a Windows service using the 'Cloudflared' executable, which can be leveraged for unauthorized tunneling or persistence. 2) The execution of an executable named 'svchost.exe' located within a user's Documents folder, which is a common indicator of file masquerading to evade detection.
Detects the creation, rename, or modification of potential CountLoader malicious binaries masquerading as OneDrive executables (ponedrive.exe, conedrive.exe, monedrive.exe). The rule identifies these by looking for execution in user-writable directories combined with PE metadata mismatches (Original Filename or File Description) that do not align with legitimate OneDrive binaries.
Detects execution of files named svchost32.exe or chrome_update.exe running from non-system paths (AppData, Temp, Downloads) that are unsigned or whose code-signing certificate does not match the expected legitimate signer (Microsoft/Google), indicative of the CornFlake RAT dropper used by Midnight Blizzard/Storm-2945 in the CaptiveCrunch campaign.
Detects a downloaded archive that does not begin with the standard ZIP local file header 'PK' magic bytes yet still contains valid ZIP central directory or end-of-central-directory signatures alongside Edgecution-specific package content (extension/background.js path, embedded python-3.13.3-embed-amd64-with-pip.zip runtime, or the com.ppeasqabfpxcz.api native messaging host id), consistent with the Edgecution/UNC6692 technique of stripping PK bytes from archives (e.g. patch3265343.a) before an AutoHotkey stager reconstructs bsvqikydknqqk.zip by prepending 0x50 0x4B at runtime
Matches known Larva-24009 (HeptaX) malicious file hashes
Detects a browser process (chrome.exe, msedge.exe, firefox.exe, brave.exe) writing a new, previously-unseen executable to a Downloads/Temp/Cache path and then launching that same executable within minutes — the terminal behavior of SourTrade's in-browser malware assembly pipeline, consistent with local execution of the JSCEAL (WeevilProxy) stealer payload.
This rule detects the creation of executable files within Git hooks directories ('.git/hooks') initiated by 'git' or 'gitea' processes. The logic specifically excludes files ending in '.sample' to focus on active hook deployment. This behavior is indicative of the 'diffpatch' collision technique (CVE-2026-60004), where attackers attempt to plant malicious Git hooks to achieve remote code execution (RCE) in the context of the Gitea service account.
Detects TOKYOCORE ransomware artifacts referencing the fsociety.exe binary being dropped to Downloads and copied to System32, alongside the WindowsUpdate.exe persistence copy
Detects CornFlake RAT Go stub/standalone build artifacts: requires the Go-compiled size/entropy heuristic to co-occur with a localized high-entropy PE section consistent with an XOR-encrypted embedded C2 config, and with absence of the standard main.main symbol consistent with garble-style symbol obfuscation, rather than matching on size/entropy alone
Fires only when the TriBack Loader signed host binary (avk.exe/hostfxr.dll) and its expected encrypted companion .dat file are both dropped into the same Windows Startup folder location and within a 5-minute window of each other, rather than alerting on either filename alone. This reduces false positives from legitimate G DATA AVK installs or unrelated MSI packages that could coincidentally drop matching filenames without the paired companion artifact.
Detects Edgecution/SNOW malware suite components across the kill chain via known SHA256 file hashes (phishing HTML, AutoHotkey stager, Edgecution ZIP archive, extension background.js, Python native host backdoor) and combinations of embedded code/path strings associated with SNOWGLAZE/SNOWBASIN; requires multiple distinctive strings together to reduce false positives
Detects executables with digital signatures that fail trust validation while claiming to be from well-known vendors, consistent with Dolphin X's 'Fake Code Signature' mechanism. This technique attempts to evade defenses by masquerading as a trusted application.
Detects SourTrade browser-assembled malicious executables requiring the combination of a PE section named .bun, embedded JavaScriptCore bytecode reference (app.js), and anomalous high-entropy padding, distinguishing malicious assembled payloads from legitimate Bun single-file executables that contain a .bun section alone
Detects DLL sideloading of 'version.dll' by a signed 'OneDrive.exe' process where the DLL was created via 'WriteFile' (indicating direct write rather than browser download) and lacks a 'Zone.Identifier' (Mark-of-the-Web). This combination is characteristic of evasion techniques found in toolkits like Dolphin X Agent Builder to bypass SmartScreen and initial execution defenses.
Page 53 of 80