Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
Detects the creation of a zero-byte 'pic1.png' file alongside an executable in the same directory, a TTP associated with the Diaoyu Loader's anti-sandbox integrity check. This behavior indicates an attempt to evade detection by verifying the execution environment.
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
ClawdBot C2 Network Communication
Cortex XDR
Detects network connections to known malicious ClawdBot command and control (C2) infrastructure based on specific IP addresses and hostnames.
This rule detects activity associated with the 'ClawdBot' campaign, which involves dropping the ScreenConnect Remote Access Trojan (RAT) via a fake VS Code extension. It identifies suspicious network connections to known malicious domains or Dropbox (when initiated by Code.exe), known malicious file hashes, outbound connections to ScreenConnect C2 ports, creation or start of ScreenConnect services, file drops in temporary directories related to ScreenConnect or Lightshot, and execution of Code.exe or ScreenConnect binaries from temporary folders. It also looks for initial payload downloads from attacker command and control infrastructure.
Detects the suspicious spawning of UserAccountBroker.exe by explorer.exe, which is then observed making an outbound network connection. This behavior is characteristic of a watchdog mechanism used by the ValleyRAT malware to maintain persistence and C2 communication.
This rule detects the presence of known malicious file hashes associated with a weaponized ScreenConnect RAT campaign, specifically targeting a fake ClawdBot VS Code extension. It monitors file and process events for these specific SHA256 hashes.
Chrysalis Backdoor SHA256 Hash Detection
Cortex XDR
This rule detects the presence or execution of the Chrysalis Backdoor by matching known SHA256 hashes of its components. It monitors file and process events for these specific hashes.
Chrysalis Backdoor Network IOCs
Cortex XDR
Detects network connections to known command and control (C2) infrastructure associated with the Lotus Blossom threat group and the Chrysalis Backdoor. This rule identifies suspicious outbound network activity to specific IP addresses and hostnames linked to this threat actor.
Detects execution of cryptocurrency mining software often spawned by web server processes or executed from temporary directories. This behavior is common in post-exploitation scenarios, such as those involving vulnerabilities like XWiki CVE-2025-24893, where attackers deploy miners like XMRig. Sysmon For Linux EventID 1 is the best way to detect this behavior.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects ScreenConnect/ConnectWise Control malware installer MSI and components
Detects the installation of the "Hotta Killer" tool, a Bring-Your-Own-Vulnerable-Driver (BYOVD) process killer used by the Interlock ransomware group to terminate security software. This is identified by the creation of a specific kernel driver file (`UpdateCheckerX64.sys`) and a corresponding Windows service with a distinct naming pattern (`UpdateCheckerX64_{random-numbers}`).
Detects the execution of a process named 'code.exe' or 'lightshot.exe' from a temporary directory.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
Detects the execution of 'Code.exe' from the '%TEMP%\Lightshot' directory. This specific path and filename combination is a strong indicator of the malicious 'ClawdBot' VS Code extension payload.
Detects network connections to Polygon (MATIC) blockchain RPC endpoints. The DeadLock ransomware strain has been observed using smart contracts on the Polygon network to retrieve C2 proxy server addresses, making this a key indicator of compromise.
Detects the creation or execution of files matching known malicious SHA256 hashes associated with a weaponized ScreenConnect installer and a Rust-based loader. This rule identifies the presence of specific known malicious binaries on endpoints.
This rule detects network connections to known malicious IP addresses and domains, as well as the presence of files with known malicious hashes. It specifically looks for indicators associated with the Amatera Stealer, including specific domains, an IP address, and file hashes. The rule correlates network events (DeviceNetworkEvents) and file events (DeviceFileEvents) to identify these indicators of compromise (IOCs).
The goal of this detection is to alert on activity associated with the ClickFix social engineering technique, where a user is coerced into manually executing attacker-controlled commands via the Windows Run dialog after interacting with a malicious website reached through a phishing email. More details can be found in the reference URL linked below
Detects when a potentially malicious file (such as a macro-enabled document, executable, or script) is created within a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious files in these locations to ensure they are opened by the user without security warnings (like Protected View or macro-blocking), facilitating code execution. This rule correlates file creation events with trusted paths dynamically enumerated from the device's registry.
Detects the loading of a vulnerable Baidu Antivirus driver (CVE-2024-51324), a technique used by DeadLock ransomware, followed by the termination of a security product process on the same host. This indicates a 'Bring Your Own Vulnerable Driver' (BYOVD) attack to disable defenses.
Detects the creation of executable files (.exe, .dll) in the `%TEMP%\Lightshot` directory. This directory is used as a staging area by the malicious fake Clawdbot VS Code extension to drop its payloads, including a weaponized ScreenConnect client.
Page 173 of 232