Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects malware disabling Microsoft Defender protection by adding C:\Users to the exclusion path via Add-MpPreference and force-restarting the WinDefend service to apply the change, as observed in BlueNoroff ClickFix VBScript loaders (oklnkae.vbs, NltOci4.vbs)
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
KQL Query
No description available.
Detects a PowerShell process executing with a hidden window style while using the Compress-Archive cmdlet to target the tokyocore_data directory or archive, a behavior consistent with TOKYOCORE ransomware data staging for exfiltration.
This rule detects potential Web Proxy Auto-Discovery (WPAD) exploitation or manipulation. It monitors for the presence of 'wpad_capture.ocx' (often associated with WPAD-based credential capturing tools), execution of processes involving WPAD-related command-line tokens, and modifications to the 'AutoConfigURL' registry value, which is used to redirect traffic through an attacker-controlled proxy.
Detects Chrome/Edge launched with remote debugging port and off-screen window position, matching TAG-195's CDP browser automation.
Detects short-lived, randomly-named .txt files (15-30 lowercase letters) created and then deleted within 5 minutes by python.exe or pythonw.exe processes in a folder path containing "native", consistent with the Edgecution native messaging host component using temporary text files as a queue/log for C2 command exchange.
Detects persistence achieved via a shortcut (.lnk) file created in a user's Startup folder that launches an AutoHotkey script. The rule specifically looks for AutoHotkey processes executing scripts from common writable locations (Temp, AppData) with command-line arguments referencing functions (CheckHeadlessEdge, FindAndRunTask) associated with the SNOWBELT loader and UNC6692's Edgecution malware suite.
Detects cmd.exe invoking a Python version-check command (python --version or python3 --version) spawned from an AutoHotkey process or .ahk script. This behavior is consistent with the UNC6692 Edgecution stager, which verifies the presence of a bundled Python interpreter before deploying malicious browser extension payloads.
This rule detects persistence mechanisms via Windows Registry Run or RunOnce keys, specifically targeting the execution of Python scripts or common interpreted/executable files located in suspicious user profile directories (AppData, Temp, or Public folders). This behavior is characteristic of adversaries using Python-based remote access trojans (RATs) to maintain a foothold on a compromised host.
This rule detects persistence mechanisms via Windows Registry Run or RunOnce keys, specifically targeting the execution of Python scripts or common interpreted/executable files located in suspicious user profile directories (AppData, Temp, or Public folders). This behavior is characteristic of adversaries using Python-based remote access trojans (RATs) to maintain a foothold on a compromised host.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Detects execution of the Edgecution malware suite native messaging host (native_host.py), which fingerprints the host system by reading environment variables (USERNAME, COMPUTERNAME, etc.). The rule correlates this behavior with a specific, suspicious process lineage originating from Microsoft Edge (msedge.exe -> native host -> python.exe).
Detects the execution of MCI commands via winmm.dll to play 'fsociety_sound.mp3', a technique used by TOKYOCORE ransomware to perform audio theatrics during its lockscreen phase.
Detects a cmd.exe process using a delayed timeout/del cleanup chain to self-delete the AutoHotkey stager executable and .ahk staging script associated with the UNC6692 Edgecution malware suite, indicating anti-forensic removal of initial staging artifacts after payload deployment.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects the execution of AutoHotkey-based Edgecution malware stagers (set36418917.ahk/.exe) and their associated file-drop events in unusual locations like user temp and downloads folders. This activity is associated with the threat actor UNC6692 following hands-on-keyboard access via Quick Assist.
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Detects a PowerShell or command shell process spawned directly by explorer.exe, consistent with a victim using the Win+R Run dialog to paste and execute a clipboard-borne command as instructed by a fake 'Webcam Compatibility'/'SECURITY WARNING'/'Zoom SDK Update' ClickFix modal. Tightened to reduce false positives from routine admin Run-dialog usage by excluding shell invocations that reference a saved script file (-File, .ps1/.bat/.vbs) or common IT support script/deployment paths, since a genuine ClickFix paste-execute is an inline one-off command typed/pasted directly into the Run box rather than a call to a maintained script. Analysts should additionally corroborate with a short-lived explorer.exe parent session (Run dialog opened immediately before the child process spawn) where session telemetry is available.
Detects schtasks.exe being used to create a new scheduled task that points to an updater/downloader binary located under %APPDATA% or %LOCALAPPDATA%, consistent with SilentMare's persistence mechanism established by its installer to run the updater once per day.
Page 310 of 977