Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,504 detections
Filters
Last updated
All Time
Detection languages
8,116
7,177
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,504
11,884
5,888
5,179
4,868
Platforms
18,099
3,056
1,506
124
104
Products / Services
5,727
4,306
3,717
1,175
958
MITRE Techniques
9,496
7,578
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of .NET reflection assembly loading techniques (e.g., Assembly.Load, [Reflection.Assembly]::Load) within the command line arguments of known LOLBAS (Living Off the Land Binary and Script) processes. This behavior is frequently associated with fileless malware execution or the loading of malicious assemblies directly into the memory space of trusted Windows binaries.
This rule detects processes named 'firefox.exe' running from locations other than the standard Mozilla Firefox installation directories. This behavior is often indicative of an adversary attempting to masquerade malicious activity by using a legitimate browser process name.
Detects execution, file writing, or network activity associated with the process named 'Stella_Gary', which may indicate the retrieval or use of malicious plugin modules.
This rule detects the execution of 'OrionQuests-Setup.exe' triggered via a shortcut (.lnk) file. It correlates file creation events involving .lnk files with subsequent process creation events for the specified executable to track potential user execution or masquerading attempts.
Detects the execution of PowerShell with common obfuscation or stealth-related flags (e.g., -enc, -nop, -w hidden) when initiated by CMD or from a LNK file, particularly when originating from Windows Explorer. This is a common pattern for malicious file execution and dropper activity.
This rule detects the execution of 'OrionQuests-Setup.exe' triggered via a shortcut (.lnk) file. It correlates file creation events involving .lnk files with subsequent process creation events for the specified executable to track potential user execution or masquerading attempts.
This rule searches for any process, image load, or file events containing the string 'Stella_Gary' within file names, folder paths, or process command lines. This is a generic hunting rule typically used to identify artifacts, indicators, or files associated with a specific entity or project codename.
This rule searches for any process, image load, or file events containing the string 'Stella_Gary' within file names, folder paths, or process command lines. This is a generic hunting rule typically used to identify artifacts, indicators, or files associated with a specific entity or project codename.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla installation directories, such as AppData, Temp, Downloads, or ProgramData. Additionally, the rule validates if the binary is digitally signed by Mozilla. This behavior is indicative of a masquerading attempt, where an attacker runs a malicious executable disguised as Firefox.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla installation directories, such as AppData, Temp, Downloads, or ProgramData. Additionally, the rule validates if the binary is digitally signed by Mozilla. This behavior is indicative of a masquerading attempt, where an attacker runs a malicious executable disguised as Firefox.
Detects instances where a process named firefox.exe, executing from the ProgramData directory, is used to establish persistence via Windows Registry Run keys or to create scheduled tasks/services. This behavior is indicative of a malicious process masquerading as the legitimate Firefox browser to maintain persistence on a host.
Detects instances where a process masquerading as 'firefox.exe' executes common system reconnaissance commands such as systeminfo, ipconfig, whoami, and tasklist from non-standard file paths. This behavior is indicative of the BabylonRAT malware attempting to gather system and network information after establishing persistence.
Detects instances where a process named firefox.exe is running from a non-standard location or includes keywords indicative of keylogging activity such as 'SetWindowsHookEx', 'GetAsyncKeyState', 'GetKeyState', or 'keylog'. This is a common behavioral indicator for the BabylonRAT malware.
Detects execution of the suspicious installer 'OrionQuests-Setup.exe' or the creation of shortcut (.lnk) files associated with this specific executable name. This activity is indicative of potential malicious installer behavior, likely used to distribute malware or drop persistent components.
Detects execution of the suspicious installer 'OrionQuests-Setup.exe' or the creation of shortcut (.lnk) files associated with this specific executable name. This activity is indicative of potential malicious installer behavior, likely used to distribute malware or drop persistent components.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla Firefox program directories, a technique used by BabylonRAT and other malware to masquerade as a legitimate browser application.
Detects the creation of a scheduled task named 'Google Chrome Update' using the Windows schtasks.exe utility. The rule flags instances where the task is created from locations other than the legitimate Google Chrome installation directories, identifying potential persistence mechanisms masquerading as a common software update process.
Detects the execution or loading of modules, processes, or command lines associated with the Stella_Gary C# backdoor framework. This framework is utilized by the Kimsuky (APT-C-55) threat group as part of a modular, plugin-based capability loading architecture.
Detects PowerShell command lines that perform environment validation by enumerating running processes for security software (AV/EDR/Analysis tools) and querying WMI for virtualization artifacts. This behavior is consistent with anti-analysis and anti-sandbox evasion techniques used by threat actors, such as Kimsuky, to identify and verify the execution environment before proceeding with malicious activity.
Detects the creation of Windows Run registry keys by a process named 'firefox.exe' that originates from a non-standard file path. This behavior is indicative of BabylonRAT attempting to establish persistence by masquerading as the Mozilla Firefox browser.
Detects the execution of 'OrionQuests-Setup.exe' followed by the creation of a shortcut (.lnk) file by the same process. This activity is a known indicator of the Kimsuky (APT-C-55) Stella_Gary infection chain, where a disguised installer drops malicious shortcuts to facilitate further execution.
Page 234 of 977