Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,664 detections
Filters
Last updated
All Time
Detection languages
713
605
71
56
52
Contributors
726
301
301
80
71
Categories
20,427
11,813
5,871
5,145
4,864
1,664
Platforms
1,485
238
159
39
18
Products / Services
644
258
183
65
49
MITRE Techniques
639
582
377
235
191
CVEs
6
5
5
5
4
IDS Classtypes
6
IDS Protocols
5
1
Detects the creation of an executable file (.exe, .scr, .com, .pif) in user-writable directories (Temp, AppData, ProgramData) followed by the immediate execution of that same file. This is a common pattern for malware droppers where a file is dropped to disk and subsequently executed to initiate the next stage of an attack.
This rule monitors for the creation of .exe or .msi files within common user-writable directories (Downloads, Temp, AppData) initiated by web browser processes (Chrome, Edge, Firefox, Brave). This behavior is often indicative of drive-by downloads or users interacting with malicious web content that delivers installers to the host.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
This rule monitors for suspicious activity linked to files or processes within the Windows temporary directory. It identifies three distinct malicious patterns: (1) sensitive privilege usage (e.g., SeDebugPrivilege) by processes running from temp; (2) presence of known malicious file names associated with a specific campaign (vile_*.ico, vile_*.lnk, etc.); and (3) PowerShell execution of a specific decryptor shortcut file from the temp directory.
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
Malvertising loader delivering CastleStealer via malicious Google Ads
Loader used in click-hijacking traffic distribution scheme
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Photo-themed ZIP phishing campaign dropping a Node.js implant
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
IoT botnet malware family used for DDoS and proxy infrastructure
High-velocity ransomware-as-a-service with aggressive leak-site extortion
IoT botnet malware family used for DDoS and proxy infrastructure
Supply chain worm targeting npm packages and GitHub Actions, linked to Shai-Hulud/Hades lineage
Rust-based macOS infostealer implant embedding prompt injection payloads
Phishing-as-a-Service kit abusing OAuth device code flow against Microsoft 365
Banking trojan and loader using malicious Office macro delivery
Form-grabbing and credential stealing malware-as-a-service
AI-powered phishing-as-a-service abusing device-code authentication
Banking trojan and loader using malicious Office macro delivery
AI-powered phishing-as-a-service abusing device-code authentication
Page 62 of 80