Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,866 detections
Filters
Last updated
All Time
Detection languages
1,757
1,593
604
243
199
Contributors
944
801
787
614
315
Categories
20,462
11,849
5,879
5,158
4,866
Platforms
3,711
737
612
405
100
Products / Services
1,458
648
498
272
235
MITRE Techniques
1,330
1,214
888
785
772
CVEs
7
5
5
5
5
IDS Classtypes
546
20
16
5
4
IDS Protocols
417
66
60
39
13
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
Detects Windows systems invoking rundll32.exe to execute DLLs associated with compromised npm package versions of eslint-config-prettier (10.1.6–10.1.9). These versions were published without corresponding GitHub commits and may initiate callbacks to FirebaseDotSu, indicating potential command-and-control activity.
Rundll32.exe is a built-in Windows utility that enables execution of DLL files by invoking specific functions exported from them. While it is used legitimately across various system operations, attackers frequently exploit it to execute malicious code because it is a trusted binary and less likely to trigger security alerts. This technique is recognized in the MITRE ATT and CK framework under the identifier T1218.011 as a method for defense evasion.
In typical usage scenarios, Node.js operates as a JavaScript runtime for developing applications and executing server-side scripts. It does not ordinarily engage with DLL files or initiate their execution through rundll32.exe.. When Node.js is observed invoking rundll32 to launch a DLL, this represents highly unusual behavior and may signal a compromise or malware deployment. Such activity warrants investigation, especially when linked to suspicious network callbacks or unverified software packages distributed through npm.
In typical usage scenarios, Node.js operates as a JavaScript runtime for developing applications and executing server-side scripts. It does not ordinarily engage with DLL files or initiate their execution through rundll32.exe.. When Node.js is observed invoking rundll32 to launch a DLL, this represents highly unusual behavior and may signal a compromise or malware deployment. Such activity warrants investigation, especially when linked to suspicious network callbacks or unverified software packages distributed through npm.
The following analytic detects potential post-exploitation activity related to the Microsoft SharePoint CVE-2025-53770 vulnerability. After successful exploitation via the ToolPane.aspx endpoint, attackers typically deploy a webshell named "spinstall0.aspx" in the SharePoint layouts directory. This detection identifies GET requests to this webshell, which indicates active use of the backdoor for command execution, data exfiltration, or credential/key extraction. Attackers commonly use these webshells to extract encryption keys, authentication tokens, and other sensitive information from the compromised SharePoint server.
This rule detects the execution of DLLs that exhibit signs of advanced code obfuscation, such as dynamic jumps (e.g., JMP RAX) or indirect function calls (e.g., CALL RAX). This technique is used by malware like SLOW#TEMPEST to hinder static and dynamic analysis. The rule specifically looks for indicators from an advanced EDR, sandbox, or memory analysis tool.
This rule detects a specific DLL hash (3583cc881cb077f97422b9729075c9465f0f8f94647b746ee7fa049c4970a978) associated with the SLOW#TEMPEST campaign. This file is a DLL that contains an encrypted payload. The rule searches for this hash in both executed processes and files on disk.
This detection rule identifies the presence of the SLOW#TEMPEST ISO file based on its SHA256 hash. This ISO file is the initial delivery mechanism for the malware campaign.
The analytic detects the `wermgr.exe` process attempting to connect to known IP check web services. This activity is significant because `wermgr.exe` is typically used for Windows error reporting, and its connection to these services may indicate malicious code injection, often associated with malware like Trickbot. If confirmed malicious, this behavior could allow attackers to recon the infected machine's IP address, aiding in further exploitation and evasion tactics.
Detects execution of the Interlock RAT PHP variant and associated activity by looking for specific execution parameters, initial download commands, and known malicious file hashes, domains, and IP addresses.
Detects Odyssey Infostealer, a macOS malware known for stealing sensitive data and establishing persistence. This rule identifies specific strings related to its C2 communication, data theft, and persistence mechanisms.
KQL Query
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
Detects components of the Atomic macOS Stealer (AMOS) malware, specifically the backdoor and persistence artifacts described in a July 2025 report.
KQL Query from file: DEVMAN ransomware detection
KQL Query from file: DefenderXDR - Devman Ransomware Detection
KQL Query
KQL Query from file: Threat Intelligence Data from Sentinel UEBA
KQL Query
This query visualises total emails with Spam detections over time summarizing the data daily
KQL Query from file: Email Campaign - Exploiting SVG Files and trycloudflare.com to Spread Malware
Page 193 of 232