Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the keylog_start/keylog_stop C2 command schema with active-window-title capture used by ChonkyChicken's keylogging capability.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects processes attempting to enumerate common CI/CD environment variables, a technique observed in the SleeperGem supply chain attack used for sandbox evasion and environment awareness to determine if the malware is running in a CI/CD build environment.
Detects the use of common Windows Living-off-the-Land Binaries (LOLBins) or PowerShell cmdlets typically utilized to download and execute remote payloads. The rule specifically monitors for BITSAdmin transfers, CertUtil URL cache retrievals, MSHTA remote execution, and PowerShell combined with WebClient/DownloadString and hidden windows.
This rule detects the execution of known malicious files associated with the FakeGit campaign by matching their SHA256 hashes. Additionally, it identifies suspicious process execution patterns involving 'luau.exe', specifically when it is launched as a standalone process or when initiated by command-line scripts such as .cmd or .bat files.
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects the use of PowerShell to perform webcam image capture by utilizing .NET reflection with 'System.Drawing' and 'System.Windows.Forms' namespaces. This technique has been identified as being used by the TOKYOCORE ransomware to perform victim surveillance by capturing and saving camera snapshots as PNG files.
Detects instances where the TOKYOCORE malware (fsociety.exe) attempts to identify or enumerate the presence of security-critical applications, including debuggers, virtual machine guest agents, and antivirus/EDR software. This behavior is indicative of malware attempting to evade analysis or disable security controls.
Detects the execution of cmd.exe with specific command-line arguments (/e:ON /v:OFF /d /c) that disable delayed expansion and autoloading of auto-run commands. This configuration is often used by adversaries to execute malicious payloads while bypassing certain environment checks or security controls that rely on command shell defaults.
Detects a suspicious PowerShell execution sequence initiated by explorer.exe that exhibits multiple indicators of malicious behavior within a short timeframe. The detection logic correlates PowerShell process creation (using obfuscated arguments or common attack flags) with subsequent network connections (C2), file writes to temporary directories, and execution of child processes from those same directories. This pattern is characteristic of multi-stage malware loaders, such as Vidar Stealer, staging payloads and executing them.
Detects the use of the 'net.exe' command to reset the password of a local administrator account. This behavior is specifically associated with the NoEscape ransomware, which utilizes this command as part of its impact-oriented activity to prevent authorized access to the compromised system.
Detects instances where common web server processes (such as php-fpm, apache, nginx, or w3wp) spawn a command interpreter (sh, bash, or cmd.exe). This pattern is highly indicative of potential web shell activity, where an adversary executes commands on the underlying host after exploiting a web application.
Detects the creation of a scheduled task named 'Photo Studio' or the execution of a VBScript file named 'PhotoStudio.vbs' located within a 'PhotoStudioVBS' folder, which are artifacts associated with the Blind Eagle (APT-C-36) threat group to maintain persistence.
Detects an unsigned process performing a specific behavioral sequence indicative of AI-assisted target profiling: high-volume software enumeration via registry keys, unauthorized access to browser data (history, cookies, bookmarks), and periodic C2-like network beaconing. The rule requires these actions to correlate within a tight 6-hour burst and exhibit persistent beaconing behavior over at least 3 days.
Detects osascript process execution spawned by launchd/LaunchAgent chains where the invoked AppleScript command line contains obfuscated/encoded content, consistent with EtherHiding's Launch Agent-triggered AppleScript payloads used to query blockchain C2 infrastructure.
The implant's runtime initialization behavior — Tokio worker-thread sizing via TOKIO_WORKER_THREADS env var or GetSystemInfo. This behavior alone is a generic characteristic of any legitimate Rust/Tokio-based application and has very weak standalone specificity for msaRAT. Do NOT action this alert in isolation. It should only be treated as meaningful when correlated with other msaRAT indicators observed in the same process tree, such as a headless browser (Chrome or Edge) being launched or Chrome DevTools Protocol (CDP) activity occurring from the same parent/child process lineage. Use this rule strictly as a low-confidence enrichment/supporting signal for triage and correlation, not as a standalone detection.
Detects the creation of scheduled tasks using the 'schtasks.exe' utility, where the parent process is a Windows script host ('wscript.exe' or 'cscript.exe'). This is a common technique used by malware for persistence.
Detects the execution of Google Chrome or Microsoft Edge in headless mode by the Windows Installer service (msiexec.exe), utilizing remote debugging ports and custom user-data directories. This behavior is indicative of browser-hijacking techniques, such as those observed in msaRAT, used to establish covert C2 channels by manipulating the browser's CDP interface.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
This rule detects the execution of the Screaming Frog SEO Spider application followed by outgoing network traffic to web ports (80/443). Screaming Frog is a legitimate web crawler often repurposed by adversaries for internal or external network reconnaissance and site scraping.
Page 313 of 977