Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
This rule detects the loading of DLL modules from non-standard system directories (outside of Windows, System32, SysWOW64, or Program Files) by signed processes, or the loading of files with known suspicious filenames such as 'MiniJunk' or 'TRUSTRAP'. This behavior is indicative of potential DLL sideloading, search order hijacking, or the loading of malicious payloads masquerading as legitimate libraries.
Loader used in click-hijacking traffic distribution scheme
This rule detects the creation of new executable files in suspicious locations, specifically targeting potential masquerading or evasion attempts in Windows Error Reporting (WER) paths (using randomly named folders) and generic Windows Temp directories by non-system accounts (excluding Microsoft Defender's engine process).
Detects the execution or loading of executables (.exe) or dynamic link libraries (.dll) located in user-specific temporary or roaming directories (AppData). These directories are common locations for attackers to drop payloads, execute malicious code, or achieve persistence, as they are writable by standard users without elevated privileges. The rule includes filters for known legitimate processes that may perform operations in these directories to reduce noise.
Clipboard hijacking malware for cryptocurrency address substitution
Detects instances where WinRAR.exe is observed writing potentially malicious script or link files (.hta, .vbs, .js, .ps1, .lnk) into the Windows Startup folder. This pattern is indicative of exploitation of CVE-2025-8088, a path traversal vulnerability in WinRAR often leveraged by the Gamaredon group to establish persistence.
Detects the creation of web-executable files (e.g., .aspx, .ashx, .php, .jsp, .asmx) within sensitive web root directories (IIS, Exchange, SharePoint) when the writing process is identified as an IIS worker process (w3wp.exe) or an Exchange Unified Messaging worker process (UMWorkerProcess.exe). This activity is highly indicative of web shell deployment for post-exploitation persistence, commonly associated with vulnerabilities like CVE-2021-26855 or CVE-2022-41082.
Detects PE files exhibiting behavior consistent with LokiBot malware, specifically the use of a custom CRC32-variant hash function with a XOR polynomial of 0x4358AD54 for runtime API resolution. This technique is used to evade static import analysis by resolving Windows APIs dynamically via hashed identifiers.
Detects the use of rundll32.exe to execute the 'ExecuteTask' function from a specific DLL (agt.dll) located in C:\ProgramData\CorsairUtil\. This activity is consistent with proxy-execution techniques used by Vidar/HijackLoader variants to execute malicious payloads, often triggered by a dropped loader executable.
Detects potential exploitation of 7-Zip RAR5 vulnerabilities where the Mark-of-the-Web (MOTW) Zone.Identifier is not propagated during extraction, enabling files to execute without SmartScreen warnings. The rule monitors for the creation of executable file types in common user-writable directories by 7-Zip processes and the subsequent execution of files from those locations by explorer.exe.
Detects artifacts and activity related to the exploitation of CVE-2026-55200 in libssh2. The rule monitors for the creation or execution of identified libpwn exploit harness files and scripts, as well as suspicious network activity involving TCP port 2222, which is the default port for the PoC rogue SSH server. It also correlates the appearance of these exploit files with subsequent outbound SSH connections.
Detects the creation of files with specific names associated with Proof of Concept (PoC) code, remote code execution (RCE) harnesses, or exploit probes for CVE-2026-55200. This pattern indicates the presence of offensive security tooling or attempted exploitation of a specific software vulnerability on the host.
Detects modifications to Windows 'Run' registry keys where the referenced executable path is located within the 'AppData\Roaming' directory. This pattern is commonly used by malware and unauthorized persistent agents to masquerade as legitimate system processes like 'svchost.exe', 'MsEdgeUpdate.exe', or 'rcsdriver.exe' to maintain persistence upon user logon.
Detects the use of rundll32.exe to process files with common image extensions (.jpg, .jpeg, .png, .bmp, .gif). This behavior is often associated with steganography or attempts to disguise malicious payloads by masquerading them as image files.
Malvertising loader delivering CastleStealer via malicious Google Ads
Form-grabbing and credential stealing malware-as-a-service
Rust-based ransomware family targeting enterprise environments
This rule detects the creation of specific temporary directories following a pattern often used by installers or malware, and the subsequent writing of 'wermgr.exe' (Windows Error Reporting manager) into these temporary locations. This behavior is indicative of potential masquerading or process hijacking attempts, where a malicious executable is disguised as a legitimate Windows process by operating from an unexpected, temporary directory.
Detects suspicious activities related to the RoguePlanet vulnerability (CVE-2026-50656), characterized by the creation of temporary directory structures in user folders, mounting of disk images (ISO/VHD) from user-accessible paths, and subsequent execution of binaries from these temporary workspaces.
Detects behavior indicative of the Kimsuky threat group's JSE loaders. The rule identifies two distinct phases: the use of 'Scripting.FileSystemObject' to write a PE executable to a temporary directory, and the subsequent silent execution of that file using 'WScript.Shell.Run' with a hidden window style. This is a common pattern for dropper activity originating from malicious JScript files.
Detects the execution of the Windows HTML Help executable (hh.exe) to open a Compiled HTML Help (.chm) file. The rule specifically monitors for known indicators associated with Kimsuky, including the 'Review.chm' lure name and a specific file hash identified in threat intelligence reporting as part of a multi-stage attack involving decoy content.
Page 58 of 80