Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects malicious activity associated with the ClickFix/Vidar campaign, where adversaries create persistence using the Windows Run registry key while masquerading as the legitimate 'VoidTools Everything.exe' utility. The rule correlates registry modifications with the creation or execution of a file path mimicking the legitimate software in suspicious locations.
Detects malicious activity associated with the ClickFix/Vidar campaign, where adversaries create persistence using the Windows Run registry key while masquerading as the legitimate 'VoidTools Everything.exe' utility. The rule correlates registry modifications with the creation or execution of a file path mimicking the legitimate software in suspicious locations.
This rule detects malicious activity related to the exploitation of MpDlpService.exe. It looks for the execution or presence of known malicious file hashes associated with this threat, including a P-stage script, payload files, and a malicious mpclient.dll. Additionally, it identifies instances where the legitimate MpDlpService.exe binary is executed from a non-standard, suspicious directory, which is a common indicator of side-loading or persistence techniques.
Detects malicious activity associated with the ClickFix/Vidar campaign, where adversaries create persistence using the Windows Run registry key while masquerading as the legitimate 'VoidTools Everything.exe' utility. The rule correlates registry modifications with the creation or execution of a file path mimicking the legitimate software in suspicious locations.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
This rule detects malicious activity related to the exploitation of MpDlpService.exe. It looks for the execution or presence of known malicious file hashes associated with this threat, including a P-stage script, payload files, and a malicious mpclient.dll. Additionally, it identifies instances where the legitimate MpDlpService.exe binary is executed from a non-standard, suspicious directory, which is a common indicator of side-loading or persistence techniques.
This rule detects a multi-stage malicious behavior chain: the execution of a suspected loader (identified by hash or specific mutex), followed by network communication to a known C2 domain or IP, and concluded by the placement of a file in the Windows Telemetry folder (typically mimicking msedge.exe). The events are correlated within a short time window (2 hours between each stage) on the same device.
Detects the execution of msiexec.exe to install an MSI package from a remote URL (http/https). The command line includes flags for passive installation (/passive) and an installation parameter (/i), initiated directly by Windows Explorer (explorer.exe), which is often associated with a user manually downloading and opening a malicious MSI file.
Detects the creation of a scheduled task or registry manipulation involving the string 'psychedelicloveUtils' occurring within 30 minutes of the execution of the process 'psychedeliclove.exe'. This pattern is indicative of a persistence mechanism being established by potentially malicious software.
Detects User Account Control (UAC) bypass attempts where an adversary writes to specific registry keys under HKCU\Software\Classes to hijack COM handlers, followed shortly by the execution of auto-elevating Windows binaries like fodhelper.exe, computerdefaults.exe, or sdclt.exe. This activity facilitates silent privilege escalation.
Detects process execution patterns consistent with the "ClickFix" social
engineering technique, where a user is lured (via a fake CAPTCHA, browser
error, or "verify you are human" page) into pressing Win+R, pasting a
pre-copied malicious command, and pressing Enter. This typically launches
PowerShell, mshta, cmd, or curl directly as a child of explorer.exe with
no legitimate parent chain (no browser, no script host), often with
obfuscated or encoded command lines, and frequently reaching out to
attacker infrastructure.
engineering technique, where a user is lured (via a fake CAPTCHA, browser
error, or "verify you are human" page) into pressing Win+R, pasting a
pre-copied malicious command, and pressing Enter. This typically launches
PowerShell, mshta, cmd, or curl directly as a child of explorer.exe with
no legitimate parent chain (no browser, no script host), often with
obfuscated or encoded command lines, and frequently reaching out to
attacker infrastructure.
Detects a suspicious process chain where an AutoIT loader (originating from temporary directories or associated with charmap.exe command line anomalies) executes charmap.exe, followed by the loading of amsi.dll within that charmap.exe process. This behavior is indicative of AsyncRAT injection patterns, specifically where charmap.exe is used as a host process to tamper with AMSI via in-memory patching of AmsiScanBuffer.
This rule monitors for execution of files with specific SHA256 hashes known to be malicious, and network connections to a known malicious domain associated with Vultr storage. It aggregates file creation, process execution, and network connection events to detect potential threat activity.
Detects the use of the 'security' utility on macOS to modify the partition ID list of keychain items. This action is commonly performed to grant silent, persistent access to sensitive stored credentials or cookies, such as those used by web browsers, by bypassing the system's interactive keychain access prompt.
Detects a suspicious sequence of anti-analysis behaviors on macOS, where a process first checks for the presence of a hypervisor via sysctl (kern.hv_vmm_present) and subsequently invokes ptrace with PT_DENY_ATTACH, a technique often used to prevent debuggers from attaching to a process.
Detects a suspicious sequence of events where a user or process removes the 'com.apple.quarantine' extended attribute from a file bundle using 'xattr -cr', immediately followed by ad-hoc code signing the same file using 'codesign -s -'. This pattern is commonly used to bypass macOS Gatekeeper security controls by stripping quarantine flags and re-signing the application to allow execution of untrusted or modified code.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects the execution of processes named 'UpdateAssistant.exe', 'AppUpdateHelper.exe', or 'SysMaintenance.exe' from specific common application directories that are either unsigned or lack a valid Microsoft digital signature. This pattern is commonly used by adversaries to masquerade malicious binaries as legitimate system update components to evade detection.
Detects execution of mass file-deletion or system wipe commands triggered by processes running from known persistence or staging locations associated with the CHOSEN BRICK campaign. The rule monitors for the combination of suspicious process paths (such as disguised winappx.exe or SysWOW64-lookalike directories) and destructive command-line arguments like 'del', 'cipher', 'format', or 'vssadmin' operations.
Detects PowerShell or PowerShell ISE spawned directly from Windows Explorer (explorer.exe, covering both Start-menu launches and the Run dialog abused by ClickFix) whose command line carries a genuine obfuscation/evasion signal - true -EncodedCommand/-e usage, a hidden/minimized window flag, or a remote download cradle (IEX, Invoke-WebRequest, DownloadString, certutil, mshta, etc.) - while excluding invocations that point at an on-disk script file under a standard install path, since ClickFix payloads are inline one-liners rather than references to a local .ps1. Bare -NoProfile/-NoLogo flags no longer trigger alone, since they are common in legitimate automation.
This rule detects potential unauthorized access to sensitive information by correlating the execution of command-line tools (sed, bash, sh) with secret-related flags or file references, followed shortly by execution of cloud CLI commands that enumerate or retrieve secrets. This behavior is indicative of an attacker attempting to parse or extract sensitive data stored in local configuration files or memory, and then fetching specific secret values from a cloud secret manager.
Page 170 of 977