Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects a set of suspicious network related commands often used in recon stages
Detects behavioral indicators associated with the ChocoShell malware, a fileless PowerShell-based infostealer. The rule monitors for malicious command-line activity including AMSI bypass, credential theft from Token Broker and WLAN profiles, disabling of Microsoft Defender signatures, and communication with local API endpoints typical of the CornFlake controller.
Detects execution patterns associated with the Apple macOS Stealer (AMOS) ClickFix malware, specifically the removal of quarantine attributes and permission modification for a staged 'helper' executable within the /tmp directory, followed by the execution of that binary.
Detects instances where PowerShell.exe is launched by a process that has loaded specific Visual C++ Redistributable DLLs (msvcp150.dll or msvcp160.dll). This pattern is often associated with the execution of applications built with Visual Studio 2017/2019 that may be acting as loaders or wrappers for malicious PowerShell scripts.
Detects the execution of pythonw.exe, which is used as a host process for the SynkLoader RAT, initiating outbound network connections to identified adversary-controlled C2 domains. This behavior is indicative of an established command-and-control channel for command retrieval and data exfiltration.
Detects the execution of the PhishLocker module, a component of the SynkLoader malware. This module is designed to display a fake, full-screen Windows lock-screen overlay to conduct credential phishing. The rule identifies processes exhibiting the 'Main Window' title associated with these malicious DLLs (msvcp150.dll or msvcp160.dll) that are typically used for sideloading.
Detects execution of a PowerShell script named 'rust-setup.ps1' or network connectivity to a specific external IP address (23.254.165.112:443) identified as a stage-2 payload delivery or command-and-control communication in a supply chain attack scenario.
Detects macOS persistence mechanism involving the registration of a disguised LaunchAgent via 'launchctl bootstrap', storing payloads in paths masquerading as system cache directories, and the subsequent removal of the 'com.apple.quarantine' extended attribute using 'xattr' to bypass Gatekeeper execution restrictions.
Detects command-line activity indicative of stealer malware behavior, specifically the construction of victim fingerprinting strings by querying environment variables such as computer name, username, disk size, and RAM capacity. This behavior is commonly associated with initial reconnaissance phases of information-stealing malware.
Detects instances where Faronics Core related processes (FaronicsCore.exe, NCService.exe, ScriptRunner.exe) spawn common system utilities (curl.exe, mshta.exe, msiexec.exe) often used for downloading or executing payloads. This pattern may indicate the abuse of legitimate management software to facilitate unauthorized activity or second-stage payload delivery.
Detects the execution of a Faronics Deploy installer that has been renamed to mimic Adobe-related software. This technique is often used in phishing campaigns to trick users into executing binaries that lead to the silent installation of remote monitoring tools like ScreenConnect.
Detects modifications to Windows LSA and LanmanServer registry keys (RestrictAnonymous, NullSessionPipes) in conjunction with ERAAgent.exe process execution, as well as ERAAgent creating named pipes accessible by anonymous logon, which may indicate configuration tampering to facilitate unauthorized access or credential collection.
Detects the execution of a file named 'calc-mapping.bin' when invoked directly or through a path, specifically when the parent process is named 'node'. This pattern may indicate the execution of a malicious binary or payload via a Node.js runtime environment.
Detects msedge.exe launched headless (--headless / --headless=new) with CDP remote debugging enabled (--remote-debugging-port=), a temp profile directory matching the launcher-edge- naming pattern, and window flags positioning it off-screen (--window-position=-32000,-32000, --window-size=1,1). This combination matches the TWINLOOT implant's technique of spawning a headless Edge instance with a Chrome DevTools Protocol connection, using the browser's authenticated same-origin session to proxy Microsoft Graph API C2 traffic so it blends in with legitimate browser network activity while remaining invisible on-screen. Excludes known browser-automation/CI framework parent processes and the --enable-automation flag to reduce false positives.
references:
- https://detections.ai/inspirations/01a01ade-da64-7718-8281-426118171583
- https://detections.ai/inspirations/01a01ade-d9a6-742d-8e2f-f60b5efce416
- https://detections.ai/inspirations/01a01ade-da04-700d-ba14-769eef28e475
- https://github.com/ontinue-research/threat-intel-iocs/blob/main/Public/2026-07-27-TWINLOOT-IOCs.md
- https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/
references:
- https://detections.ai/inspirations/01a01ade-da64-7718-8281-426118171583
- https://detections.ai/inspirations/01a01ade-d9a6-742d-8e2f-f60b5efce416
- https://detections.ai/inspirations/01a01ade-da04-700d-ba14-769eef28e475
- https://github.com/ontinue-research/threat-intel-iocs/blob/main/Public/2026-07-27-TWINLOOT-IOCs.md
- https://www.ontinue.com/resource/python-implant-hiding-its-entire-c2-inside-microsoft-365-azure/
Detects the execution of MEGAsync binaries (MEGAsync.exe, MEGAupdater.exe, or MEGAsyncSetup64.exe) from suspicious locations typically used for staging (Temp, Downloads, Public folders), or the creation of MEGAsync configuration and state cache files in the local AppData directory. This pattern is consistent with an adversary setting up a legitimate cloud storage client for data exfiltration.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
This rule detects the use of the macOS 'xattr' command to remove the 'com.apple.quarantine' extended attribute from files located within '/Library/Application Support/iCloudsync/'. This action is typically performed to bypass macOS Gatekeeper security checks, allowing untrusted binaries or payloads to execute without user confirmation or security prompts.
Detects the use of common command-line utilities (curl or wget) to download files to a temporary directory (/tmp/helper), initiated from within an interactive shell session (sh, zsh, bash). This pattern is commonly observed during the initial stages of post-exploitation, where threat actors download malicious scripts or tools to a staging directory before execution.
Detects the use of curl.exe to download an MSI file (update_ms.msi) from a remote HTTPS source into the ProgramData directory. This pattern is commonly observed in malware delivery campaigns attempting to deploy payloads in a location with lower access restrictions.
Detects the botking RAT issuing Shell/ShellX/runscript commands that spawn powershell.exe from an implant-named parent process, matching the backdoor's remote command-execution capability.
Detects the creation of a shortcut file named 'SystemIn.lnk' using PowerShell, a technique associated with the QUICSILVER malware to establish persistence. The rule monitors for PowerShell command-line arguments involving 'WScript.Shell' and 'CreateShortcut' alongside the specific file name.
Page 285 of 977