Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,863
5,881
5,162
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects techniques used to bypass PowerShell Constrained Language Mode (CLM) including version downgrades, execution from trusted binary proxy hosts (such as InstallUtil, MSBuild, or Regasm), and manipulation of the __PSLockDownPolicy environment variable.
This rule detects malicious activity associated with Kimsuky JSE loaders, which leverage XML DOM manipulation (e.g., bin.base64) and ADODB.Stream components to decode and drop base64-encoded payloads into the ProgramData directory. It further monitors for subsequent decoding attempts using certutil and the presence of specific, suspicious file extensions (e.g., .a9oc, .lpXD, .lpxQ) often used by this threat actor.
Detects the execution of cmd.exe triggered by specific potentially malicious filenames or involving known ransomware-related artifacts, such as 'boottel.dat', ransomware note files, or specific suspicious file extensions like '.SZO'. This is indicative of ransomware deployment or post-compromise cleanup and extortion activities.
Detects a multi-stage attack chain where a system downloads a Python embeddable package via curl, renames the 'pythonw.exe' executable to an arbitrary name, and subsequently executes this renamed binary or a file containing 'config.cat', which is often indicative of automated malware deployment or persistence mechanisms.
This rule detects potential malvertising or drive-by download activity by identifying when common web browsers spawn script-interpreting processes (such as powershell.exe, cmd.exe, or mshta.exe) that execute suspicious commands indicative of obfuscation or payload delivery (e.g., IEX, EncodedCommand). It further correlates this activity with outbound network connections initiated by the child process within a 30-second window, which is characteristic of the second stage of a malware delivery chain.
Detects a suspicious sequence of events attributed to APT37, where a HWP or HWPX decoy file is written to user-accessible staging directories (Downloads, Temp, Desktop, Public) followed by the execution of a .lnk file using cmd.exe or explorer.exe within 30 seconds on the same device.
Detects potential clipboard harvesting behavior indicative of information stealers like StealC. The rule monitors for processes executing from suspicious, user-writable directories (e.g., AppData, Temp) that perform clipboard access operations while lacking typical interactive process characteristics.
Detects ClickFix social engineering attacks where a web browser process spawns a scripting interpreter (powershell.exe, mshta.exe, or wscript.exe) or where a command shell executes PowerShell with encoded arguments, typically indicating a user has been tricked into executing malicious code.
Detects the execution of the LANDFALL spyware's SELinux policy manipulation helper (`l.so`). The spyware's loader (`b.so`) sets a `PRELOAD_PATH` environment variable pointing to `l.so` and uses `LD_PRELOAD` to inject another payload into the benign `/system/bin/id` process. This behavior is specific to the "interactive" execution mode of the spyware.
Detects MYRA RAT delivery via malicious npm package lifecycle scripts (e.g., postinstall) that trigger the compilation of native binaries such as libcache.so, memfd_loader, and others on Linux hosts.
Detects anomalous system and process enumeration activity characteristic of the macOS.Gaslight threat, specifically looking for repeated execution of diagnostic commands like ps, sysctl, uname, and sw_vers in a short timeframe, which suggests an attempt to profile the infected host environment.
Detects the macOS.Gaslight Rust-based implant receiving and executing backdoor commands (e.g., shell, kill, upload, persistence) via the Telegram Bot API. The rule correlates outbound network connections to api.telegram.org with subsequent process execution patterns typical of command dispatch (such as execvp or posix_spawnp).
Detects behavior indicative of the AMOS (Atomic macOS) infostealer, where a malicious process uses 'osascript' to display a fake System Preferences password prompt to the user and then attempts to validate the harvested credentials using 'dscl -authonly'.
Detects suspicious bash one-liners executed within macOS Terminal typically associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The rule monitors for a sequence involving temporary file creation, downloading a disk image (DMG) from a known malicious domain ('svs-verificationdate.beer'), and silently attaching the DMG via hdiutil.
Detects execution of macOS.Gaslight malware by identifying specific function calls within process command lines, specifically 'SecTrustSetAnchorCertificatesOnly' for certificate pinning, 'SCDynamicStoreCopyProxies' for proxy awareness, and 'CCRandomGenerateBytes' for cryptographical operations. These behaviors are typical of the implant's efforts to maintain encrypted C2 communication while frustrating network inspection tools.
Detects a multi-stage in-memory .NET DLL loader chain where an executable from AppData\Roaming mimics legitimate software (TuglaInsaatci) to load malicious DLLs ('Optimax.dll' and 'System Optimizer Ultimate.dll') entirely in memory. This behavior is indicative of the FortiBleed steganographic loader campaign, which aims to evade disk-based security controls.
Detects anomalous activity where multiple distinct Living-off-the-Land (LotL) binaries (e.g., powershell.exe, cmd.exe, wmic.exe, tasklist.exe, systeminfo.exe) are executed on the same device within a single hour. This threshold of 4 unique administrative or discovery tools being used in a short timeframe is often indicative of reconnaissance, lateral movement, or post-exploitation environment assessment by an adversary.
Detects potential DLL hijacking persistence by identifying modifications to registry values containing executable or library files that point to locations outside standard Windows system directories (System32 or SysWow64), subsequently joined with the execution of legitimate binary proxies known to be abused for side-loading like rundll32.exe or regsvcs.exe.
Detects the use of command-line arguments associated with Windows token impersonation techniques (e.g., 'SeImpersonate', 'ImpersonateLoggedOnUser') initiated by common command-line interpreters (powershell.exe, cmd.exe, wmic.exe). This activity is often indicative of an adversary attempting to elevate privileges by stealing or manipulating access tokens.
Detects the execution of processes with command-line arguments containing keywords related to known supply chain attacks (e.g., solarwinds, 3cx, kaseya, npm, pypi). This rule is intended for threat hunting to identify potential exploitation attempts or malicious activity involving software supply chain components.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Page 471 of 976