Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the creation of Windows Scheduled Tasks that follow the 'PythonLauncher-' naming convention, often associated with Starland RAT, using PowerShell commands such as Register-ScheduledTask. The rule monitors for persistence mechanisms configured to run at logon or with highest privileges.
Detects instances where the 'claude' or 'claude-code' process initiates network connections to more than 20 distinct destination IP addresses within a short 5-minute window. This behavior is indicative of a tool performing automated network scanning or discovery activities.
Detects the use of PowerShell to query the WMI 'root/SecurityCenter2' namespace for 'AntiVirusProduct' information, which is a common technique for adversaries to identify installed security software and tailor their attack path.
Detects the execution of the MinIO Client (mc.exe) on Windows with command-line arguments indicating the interaction with external or arbitrary bucket and endpoint locations. This behavior is indicative of an attacker staging or exfiltrating data to an external S3-compatible cloud storage provider.
Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects the use of command-line tools employing recursive search patterns (e.g., -Recurse) targeting document file extensions (PDF, DOCX, XLSX). This activity is often associated with the staging phase of an exfiltration attempt, where an adversary identifies sensitive files across a directory structure before collection.
Detects the use of the bindutil utility to create a link or redirection for a DLL path. This behavior is often associated with modifying search paths or redirecting DLL dependencies in container or virtualization environments. The rule excludes common, legitimate system and container processes that use bindutil for path management.
Detects the creation of a 'Ghost-in-the-Silo' configuration using bindutil.exe with the --runj flag. This pattern is often associated with unauthorized creation of silo-bound containers or execution environments and is monitored for activity outside of legitimate management processes like VM compute, container engines, or Windows Sandbox.
The implant's runtime initialization behavior — Tokio worker-thread sizing via TOKIO_WORKER_THREADS env var or GetSystemInfo. This behavior alone is a generic characteristic of any legitimate Rust/Tokio-based application and has very weak standalone specificity for msaRAT. Do NOT action this alert in isolation. It should only be treated as meaningful when correlated with other msaRAT indicators observed in the same process tree, such as a headless browser (Chrome or Edge) being launched or Chrome DevTools Protocol (CDP) activity occurring from the same parent/child process lineage. Use this rule strictly as a low-confidence enrichment/supporting signal for triage and correlation, not as a standalone detection.
The implant handing off attacker command frames to cmd.exe with its distinctive flag set (/e:ON /v:OFF /d /c), launched as a child of a headless Chrome or Edge instance acting as the covert C2 driver.
Detects the creation of Windows Scheduled Tasks that follow the 'PythonLauncher-' naming convention, often associated with Starland RAT, using PowerShell commands such as Register-ScheduledTask. The rule monitors for persistence mechanisms configured to run at logon or with highest privileges.
Detects the creation of a Windows Shortcut (.lnk) file in the Startup folder using WScript.Shell, often used by the Starland RAT or similar malware to establish persistence. The rule monitors command lines for the combination of WScript.Shell invocation, the CreateShortcut method, and targeting of pythonw.exe or LICENSE.txt files.
Detects the use of the Windows 'takeown.exe' utility to recursively change the ownership of the 'Microsoft\User Account Pictures' directory. This specific behavior is associated with the NoEscape ransomware, which modifies permissions on system folders to facilitate file encryption or impede recovery operations.
Detects the execution of processes containing command line strings associated with the NoEscape ransomware lock screen. These messages are used to intimidate victims by displaying full-screen ransom demands.
This rule monitors for the execution of a process with a specific SHA1/MD5 file hash known to be malicious. This is a high-fidelity detection strategy for blocking or alerting on specific threats already identified as malicious in threat intelligence.
Detects communication between suspicious processes (rundll32.exe, svchost.exe, dllhost.exe, install.exe) and the Steam Community website, specifically targeting a known TELEPUZ malware dead-drop profile ID used to resolve XOR-encoded C2 addresses.
This rule detects PowerShell commands initiated by web browsers that exhibit characteristics of the 'ClickFix' social engineering technique. The detection logic looks for high-risk flags (hidden window, bypass execution policy) associated with common ClickFix artifacts such as references to temporary directories, domain-specific indicators like 'memshowblob.forum', and the removal of Zone.Identifier alternate data streams which are often used to bypass security warnings.
Detects instances of 'pip' or 'git' being executed by a Python process to clone or install packages from external sources. This behavior is commonly used to install malicious or untrusted custom nodes within a ComfyUI environment, potentially facilitating initial access or code execution.
Detects a renamed Plink/PuTTY binary (frontpage.exe) launched from C:\users\public\music\ with command-line flags -C -N -R establishing a remote SSH port-forward tunnel to a sftp@ destination on port 3522, consistent with HelloNet C2/data exfiltration tunneling.
This rule detects various common methods of achieving persistence on Linux and macOS systems. It monitors file system changes to systemd unit files and macOS LaunchAgent plist files, as well as the execution of commands related to managing systemd services and user crontab entries.
Page 322 of 977