Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.
Detects creation of a hidden Windows desktop (via CreateDesktopW/SetThreadDesktop) followed by launching explorer.exe onto that desktop with CREATE_NEW_CONSOLE, a pattern used by HVNC (Hidden VNC) modules to run a covert, off-screen shell for remote control and screenshot streaming.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects a hidden, non-interactive PowerShell process that programmatically enumerates mounted disk images (VHDX/ISO) using Get-DiskImage or Get-Partition, dismounts them, and potentially deletes the backing files. This behavior is indicative of post-execution cleanup routines used by malware delivered via mounted container images, such as the Overlord RAT.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects the use of PowerShell or administrative command-line tools (net, sc) to enumerate and forcefully stop critical backup, database, and virtualization services. This behavior is commonly observed in ransomware attacks where adversaries disable security-critical or data-hosting services prior to encryption to ensure file locks are released and backups are incapacitated.
Detects the creation of a Registry Run key (HKCU\Software\Microsoft\Windows\CurrentVersion\Run) with a specific value name ('MyApp') that invokes mshta.exe to execute a remote HTA file hosted at 'zynaris.io/ru1.hta'. This activity indicates an attempt to achieve persistence by leveraging a legitimate Windows binary (LOLBAS) to run potentially malicious scripts upon user logon, as observed in the SHADOW#REACTOR campaign.
Detects instances of dllhost.exe running with elevated integrity (High or System) that were not spawned by the standard DCOM Server Process Launcher (svchost.exe). This behavior is characteristic of COM object hijacking or auto-elevation techniques used to bypass UAC.
Detects process creation events where a file name containing a Right-to-Left Override (RTLO) character (U+202E) also ends with a .scr extension and includes a bait keyword ('ReportFinal'). This combination suggests an attempt to disguise a malicious screensaver file as a benign PDF document to deceive users into executing it.
Detects cred_exec/token_run command tokens within the TAG-195 WebSocket C2 message schema, used for credential/token-backed lateral movement.
Detects regsvr32.exe silently registering an OCX file staged in a user-writable temp or local app data directory when spawned from a browser, shell, or Run-dialog parent process.
Detects colorcpl.exe being spawned as a suspended injection host by an interpreter dropped to C:\Users\Public\Libraries as part of the TTF Trap campaign, regardless of whether the triggering parent is luajit.exe or AutoIt3.exe. The campaign implements two functionally equivalent injection chains into colorcpl.exe - a LuaJIT-FFI path that resolves kernel32 APIs via FFI/bit libraries and a parallel AutoIt-driven ntdll-unhooking path - both of which launch colorcpl.exe suspended, then perform VirtualAllocEx, WriteProcessMemory, and CreateRemoteThread to reconstruct and execute Donut-packed shellcode in its address space. Matching on the Public\Libraries staging path (rather than solely on interpreter name) ensures the rule fires on either trigger path even if the interpreter binary is renamed.
Detects ClickFix social engineering used in the TELEPUZ/VIDAR campaign where a user is tricked into executing a PowerShell command that downloads a binary from memshowblob.forum using bypass flags and removes the Zone.Identifier ADS. Part of the CLICKFIX-VIDAR initial access chain delivering TELEPUZ MaaS malware.
Detects attempts to bypass User Account Control (UAC) by invoking the CMSTPLUA COM interface (CLSID: {3E5FC7F9-9A51-4367-9063-A120244FBEC7}). This technique allows an attacker to execute processes with elevated privileges by leveraging the auto-elevation property of this COM object, often using the 'Elevation:Administrator!new' moniker.
Detects the execution of the McUploader component associated with the GigaWiper malware, which is used for file staging and exfiltration.
This rule detects the use of XOR encoding patterns in PowerShell command-line arguments. Adversaries frequently use XOR encoding or other obfuscation techniques within scripts to hide malicious commands or payloads from static analysis and security tools.
Detects evidence of log clearing or tampering activity associated with the GigaWiper destructive backdoor, specifically monitoring for the use of wevtutil to clear event logs, the manual deletion of the Security.evtx log file, or the presence of a specific marker string often utilized by this threat.
Detects signs of GigaWiper malware attempting to disable system recovery, take ownership of critical Windows boot files, and subsequently delete them to ensure system failure or destruction.
Detects evidence of the TELEPUZ malware establishing persistence by installing a Windows service named 'CipherAllocator' or 'PilotmasterMast'. The rule monitors for the installation of these specific services via Windows Event ID 7045, process command line execution, and direct registry key modifications.
Page 321 of 977