Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects attempts to bypass User Account Control (UAC) by invoking the CMSTPLUA COM interface (CLSID: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}). This technique allows an attacker to execute processes with elevated privileges by leveraging the auto-elevation property of this COM object, often using the 'Elevation:Administrator!new' moniker.
This rule identifies rarely executed Windows binaries that are listed in the LOLBAS (Living Off the Land Binaries and Scripts) project dataset. By comparing process execution events from the last 30 days against the official LOLBAS list, it surfaces the least frequently used binaries, which may indicate unusual activity or potentially malicious use of legitimate system tools.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects the execution of sendmail via a shell (sh, bash, dash) spawned by a web server process (Apache, Nginx, httpd) where the process working directory matches the wp2shell plugin pattern (wp2shell_<hex>). This is indicative of remote code execution or web shell activity associated with the wp2shell vulnerability, where the attacker uses sendmail for exfiltration or command output delivery.
Detects the wp2shell post-exploitation cleanup pattern where a shell spawned by a web server process determines its current working directory, matches it against a wp-content/plugins path using the specific `case "$d" in */wp-content/plugins/*) cd / && rm -rf "$d";; esac` one-liner shape, and recursively deletes that directory to remove the deployed web shell plugin. This is tightened to require the exact case-statement/one-liner construction executed by a shell that is a child of a web server process, rather than any generic recursive delete under wp-content/plugins, which would also fire on legitimate WordPress plugin uninstall hooks that remove their own plugin directory. Absence of the plugin directory afterward should not be treated as evidence the host is clean.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects a web server process (apache2/httpd/nginx/php-fpm) spawning a shell interpreter from a WordPress wp-content working directory, the durable behavioral signature of successful wp2shell exploitation regardless of entry vector.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects Python process creation where the command line references base64, zlib, and ctypes libraries concurrently. This combination is frequently used by attackers to deobfuscate, decompress, and execute payloads dynamically in memory, often bypassing traditional file-based detection mechanisms.
Detects execution of pythonw.exe from the Local AppData Temp directory. Attackers often use this directory as a writeable location for staging and running malicious Python scripts or bundled payloads to avoid detection.
Detects the use of mshta.exe to execute code directly from a remote URL that includes a numeric path segment. This behavior is often associated with the retrieval of HTA, VBScript, or JScript payloads from attacker-controlled servers, where the numeric path may indicate a versioned payload or a specific exploit delivery mechanism.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Detects the execution of rundll32.exe attempting to load a DLL from a remote WebDAV share by monitoring for the '@ssl' notation in the command line. This technique is often used to execute malicious code or load DLLs from attacker-controlled remote infrastructure, bypassing local security controls.
Detects instances of dllhost.exe running with elevated integrity (High or System) that were not spawned by the standard DCOM Server Process Launcher (svchost.exe). This behavior is characteristic of COM object hijacking or auto-elevation techniques used to bypass UAC.
Detects the creation of scheduled tasks using specific, suspicious task names associated with the CURP threat campaign. This rule monitors for 'schtasks.exe' command line executions involving the creation of tasks with names 'brokerhost' or 'net_queue_32', which are identified as indicators of persistent threat activity.
Detects rundll32.exe loading davclnt.dll, which triggers the WebClient service to auto-start and perform a network callout to retrieve WebDAV-hosted content.
Detects the execution of wchelper.exe in conjunction with the reference of a 'wch.zip' file. This behavior is associated with surveillance modules attributed to the Blind Eagle (APT-C-36) threat group, which typically function as spyware to exfiltrate system data.
Detects indicators of the Miasma worm compromise on Windows and macOS systems. This includes the execution of malicious Spectral CLI payloads from npm npx cache directories, the staging and execution of sync.js payloads, the creation of Miasma-specific lock files and Cryptnet cache artifacts, and persistence established via Windows Registry Run keys.
Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.
Page 318 of 977