Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
76 detections
Filters
Last updated
All Time
Detection languages
37
19
12
5
3
Contributors
76
Categories
20,427
11,813
5,871
5,145
4,864
Platforms
33
23
16
2
1
Products / Services
22
11
6
5
4
MITRE Techniques
45
20
19
9
8
CVEs
11
11
2
1
IDS Classtypes
2
1
IDS Protocols
3
Detects Linux persistence and removal activity by the botking implant, systemd user-service creation with the 'System Config User Service' description marker, secondary symlink persistence, or systemctl --user enable/disable for install/removal.
Detects System-process (PID 4) registry writes or deletions targeting Windows Defender tamper-protection values or Run/RunOnce persistence keys, indicating use of the BTR.sys kernel registry-write primitive to disable protections or establish persistence.
Flags direct registry staging of a Boot Bus Extender service (SERVICE_SYSTEM_START) whose Args value contains ':changelist', bypassing the Service Control Manager, where the driver image lies outside the Defender platform folder or uses a randomized 8-character filename — the SCM-bypass pattern used to stage BTR.sys for boot-time or immediate execution.
Detects creation of a macOS LaunchAgent plist referencing a suspicious temp path or unrecognized vendor bundle identifier, consistent with the botking implant's macOS persistence mechanism.
Detects creation of an HKCU Run key value whose data references a temp or AppData temp path, consistent with the Windows persistence step of the botking implant after the build-time payload drop.
Detects creation of LaunchAgent/LaunchDaemon plists, /etc/zshenv, or SSH authorized_keys attributed to screensharingd/helpers or occurring within a Screen Sharing session window — persistence via the root file-write primitive.
Detects enumeration of installed applications via .desktop files by a process outside known desktop-environment binaries, correlated with a subsequent persistence-related file write, matching the botking implant's discovery-then-persist behavior.
Detects crates.io publish events combining an impersonation indicator (attacker account names/forged author email) with one of the known malicious package names, indicating a compromised or impersonated maintainer account was used to publish the Rust supply-chain payload.
Detects C2Looper sideloading a malicious wtsapi32.dll from a non-System32 path by terminating and relaunching the legitimate OneDrive.exe process to load it.
Detects HTTP requests to StopAndProtect's WordPress webshells and malicious MU-plugin backdoor endpoints.
Detects RtkNGUI64.exe being launched via a WMI consumer using the 8.3 short-path form (Progra~1\Realtek\Audio), the same masquerading binary used for backdoor persistence.
Detects Run key persistence for follow-on ACRStealer payloads (creator-ws.exe under ProgramData\Rapid, pgocvt.exe under ProgramData\TIEmounter) launched via a cmd /c start wrapper.
Requires the 'Realtek'-named WMI object AND (the 19:50 time-trigger query pattern OR the RtkNGUI64.exe destination) together, rather than matching on the name alone -- avoids flagging unrelated benign WMI objects that happen to share the name.
Detects C2Looper sideloading a malicious wtsapi32.dll from a non-System32 path by terminating and relaunching the legitimate OneDrive.exe process to load it.
Detects a build process (cargo/rustc/build-script-build) that drops an executable to /tmp/rust-setup and launches it detached so it persists after the build completes — the payload-delivery mechanism used by the compromised proc-macro1 Rust crate.
Static file-based detection of the ACRStealer dropper, encrypted AutoIt payload, and DCRCVDrv.sys BYOVD driver via filenames, service/device names, signer names, and certificate serial. Certificate/signer matches only fire in combination with the driver file or service artifacts to avoid flagging the legitimate vendor certificate alone.
Detects a LaunchDaemon plist named to impersonate Apple's crash reporter, staged at /tmp/starter before being moved into /Library/LaunchDaemons and bootstrapped via launchctl, matching AmnesiaStealer's persistence mechanism.
Detects a LaunchAgent plist written by screensharingd or its file-copy helpers, indicating persistence staged via the file-copy root-write primitive; excludes known legitimate installer paths.
Detects DLL side-loading of the unsigned tbbmalloc.dll by the signed binary pgocvt.exe from the C:\ProgramData\TIEmounter\ staging directory — a second-stage follow-on payload technique in the ACRStealer campaign.
Detects sideload installation of the malicious 'PDF Viewer' browser extension used by Jewelbug, identified by manifest content requesting cookies, debugger, native-messaging, and all-site scripting permissions together from a non-Web-Store install path.
Detects creation of a scheduled task named 'IntelSoftwareUpdater' via schtasks.exe that launches pythonw.exe with run.pyw, used by the UNC5142 DeviceManager RAT for persistence, relaunching every 10 minutes.
Page 1 of 4