Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the execution of an executable file that was immediately launched by 7-Zip (7z.exe or 7zG.exe) after processing a file, characteristic of a Mark-of-the-Web (MOTW) bypass exploit involving RAR5 archives. By extracting files from these archives, the 7-Zip process can inadvertently strip or prevent the assignment of the Zone.Identifier Alternate Data Stream, allowing the payload to bypass SmartScreen security prompts.
Detects a malicious HTA lure disguised as a military pay calculator. The attack involves a JScript routine that renames an embedded data file ('styles.dat') to an executable ('styles.dat.exe') and triggers its execution, characteristic of a spearphishing attachment delivering malware.
Detects the LEASHTEST MIPS-compiled test binary linked to UAT-7810 ORB network R&D activity; presence indicates device compromise
Detects PE binaries associated with INC Ransom or Lynx ransomware families identified during the FortiBleed campaign. The rule flags files containing both family-specific identification strings and commands intended to delete Volume Shadow Copies to prevent system recovery.
Detects the execution of unsigned binaries located in directories typically excluded from EDR/AV scanning, such as Windows Defender folders, security vendor installation directories, and quarantine locations. Attackers utilize these paths to bypass file-system monitoring and on-execute detection by taking advantage of pre-configured security exclusions.
This rule detects the presence and execution of files and scripts associated with the exploitation of CVE-2026-55200, such as harness binaries and proof-of-concept scripts. Additionally, it identifies post-exploitation behavior where common network-related processes (like curl, git, or sshd) spawn suspicious or unexpected child processes, which may indicate successful code execution or lateral movement originating from the compromised service.
Detects the PamStealer second-stage Rust-based arm64 Mach-O infostealer masquerading as Finder, identified by known SHA256 hash and embedded Rust toolchain build artifacts
Detects the second-stage Rust-based Mach-O binary downloaded and executed by the PamStealer JXA stager, identified via embedded C2 domain strings
Detects the extraction of executable, script, or macro-enabled files from archives using 7-Zip utilities. This behavior is notable because 7-Zip often fails to propagate the Mark-of-the-Web (MotW) Zone.Identifier Alternate Data Stream (ADS) to extracted files, which can bypass Windows SmartScreen and security zone protections upon subsequent execution of the extracted files.
Detects the creation of multiple executable files following a specific naming pattern (RageCore prefix with win_guard suffix) across common staging directories like Temp, Public, and ProgramData. This behavior is indicative of a malicious installer or worm-like component attempting to hide itself or proliferate by placing multiple copies of its payload in common, low-privilege-accessible locations.
This rule detects the extraction of files from RAR5 archives using 7-Zip (7z.exe/7zG.exe), followed closely by the execution of a file from a user-writable directory (e.g., Downloads, Temp, AppData). This behavior is characteristic of an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted from certain container formats may not inherit the original MotW Zone.Identifier alternate data stream, potentially allowing malicious files to execute without standard Windows security warnings.
Detects the execution of potential malware disguised as 'winupdate.exe' and specific network traffic associated with it. The rule identifies suspicious file paths (e.g., in AppData cache) and execution by the binary while communicating with external domains such as pastebin.com or discord.com, which are often abused for command-and-control or payload delivery.
Detects the creation of unsigned executable files (.exe or .dll) larger than 50MB on an endpoint. This activity is often associated with the staging of large, unsigned, or potentially malicious binaries, which may indicate the deployment of tools for further malicious activity or masquerading.
Detects Cavern Agent trojanized uxtheme.dll that hides real payload logic behind the EnableThemeDialogTexture export (ordinal #20) among 82 inert stub exports
IoT botnet malware family used for DDoS and proxy infrastructure
Detects the execution of known malware families (Atlas RAT, RomulusLoader, SilentRunLoader) or processes spawned from temporary directories (AppData/Local/Temp, AppData/Roaming/Temp, Windows/Temp) by common email clients, browsers, and file archivers. This behavior is indicative of a user-initiated execution of a malicious payload, typically associated with phishing or drive-by download attacks.
Detects the creation of suspicious, low-prevalence executable files (PE format) in user-writable directories (Temp, AppData, ProgramData) by processes commonly associated with cloud storage and synchronization services (e.g., OneDrive, Dropbox, Chrome, Edge). This activity mimics known TTPs attributed to the OceanLotus (APT32) group, specifically using these processes as hosts for staging or injecting malicious payloads. The rule filters out known legitimate paths for these applications to focus on anomalies.
Detects the use of the Tiny C Compiler (tcc.exe) with command-line arguments to compile and execute shellcode from a 'config.ini.c' file located in the %LOCALAPPDATA%\TCC directory. This technique is specifically associated with BeepRAT to execute code directly in memory while attempting to evade security controls like AMSI, ETW, and WLDP.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
Detects a suspicious sequence where 7-Zip is used to extract a RAR archive, immediately followed by the creation of executable files (.exe, .bat, .cmd, etc.) in common user-writable directories. This chain often indicates an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted by archive tools may not inherit the MotW zone information, allowing potentially malicious files to execute without security prompts.
This rule detects the creation of executable files within specific directories in the user's AppData Roaming profile, specifically matching patterns associated with known persistence or malicious staging filenames (xwreg or xgdf). This location is frequently abused by attackers to store persistent payloads that execute outside of standard program directories.
Page 57 of 80