Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,748 detections
Filters
Last updated
All Time
Detection languages
1,333
86
83
79
79
Contributors
515
305
271
90
67
Categories
20,440
11,814
5,871
5,145
4,864
1,748
Platforms
1,485
337
160
7
7
Products / Services
937
169
119
81
56
MITRE Techniques
759
440
326
250
242
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects execution of squid.exe or commands containing squid with arguments related to AddressSanitizer or buffer overflows.
Detects suspicious command line arguments containing null byte indicators, often used to bypass file extension filters or path processing security measures.
Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for paths matching the regex `(?i)\AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\"` and excludes common browser executables like chrome.exe, msedge.exe, and update.exe to reduce false positives.
Correlates the Get-Clipboard cmdlet execution natively invoked by the user shell, proving the "paste-to-run" ClickFix mechanism. This rule specifically looks for PowerShell execution of 'Get-Clipboard' where the initiating process is 'explorer.exe'.
Detects attempts by the Remcos RAT loader to perform WebRTC IP leakage by monitoring process command lines for keywords like 'webrtc', 'stun', 'turn', or 'ice' when initiated by common browsers (chrome.exe, firefox.exe, opera.exe) and having a parent process related to 'Remcos'. This indicates an attempt to gather victim IP addresses.
Detects potential privilege escalation attempts by the Remcos RAT loader using token impersonation. The rule looks for process command lines containing keywords related to token manipulation ('impersonate', 'token', 'duplicate', 'SeImpersonate', 'logon') specifically when the initiating process is identified as 'Remcos'.
Identifies characteristics of compiled Go binaries (e.g., executing from temp with specific build path signatures in memory) taking malicious actions. This rule specifically looks for process execution of an executable, combined with network connections on port 445 (SMB), and the creation or modification of files ending with '.gentlemen'.
Detects repeated creation attempts for the same mutex, pipe, lock file, or loopback endpoint by several module processes, leaving one active leader. This behavior is indicative of the Kazuar malware establishing a leader election mechanism to coordinate its activities on a compromised system.
Identifies Storm-1175 utilizing the rclone utility (often renamed) with MEGA or Mega-CMD configurations to exfiltrate vast data troves before encryption.
This rule detects a rapid sequence of host profiling commands commonly used by the AMOS malware to gather system information, specifically to generate the hardware UUID of the victim machine. It looks for the execution of 'whoami', 'id', 'hostname', and 'ioreg' commands within a 10-second window, requiring at least three distinct commands from this set, with 'ioreg' being a mandatory component.
Detects a module enumerating local processes, named pipes, loopback listeners, mutexes, or shared-memory sections to locate bot peers, indicative of Kazuar malware activity.
Identifies anomalous process execution explicitly originating from heavily nested or randomized directories within AppData\LocalLow or Temp, indicating staged payloads. This rule specifically looks for processes executing from paths matching the regex `AppData\Local(Low)?\Temp\[a-f0-9A-Z]{8,}\` and excludes common browser executables like chrome.exe, msedge.exe, and update.exe to reduce false positives.
This rule detects suspicious command-line activity indicative of process injection techniques. It looks for the presence of API calls like 'VirtualAlloc', 'WriteProcessMemory', and 'CreateRemoteThread' in conjunction with keywords such as '.dll', '.exe', or 'shellcode' within Security Event ID 4688 (a process creation event). A count of two or more such occurrences within an hour for a given computer and user triggers an alert.
Detects AutoHotkey (AHK) scripts executing from the 'Microsoft.WindowsSoundDiagnostics' directory, which is an unusual location for such scripts and has been observed as a staging directory for malware like AsyncRAT. This rule specifically looks for process events where the initiating process or the process itself is located in 'Microsoft.WindowsSoundDiagnostics' and the command line contains '.ahk'.
Detects AD/LDAP reconnaissance commands executed by the Backdoor.Turn RAT, specifically when initiated by 'dbgview64.exe' and using commands like 'dsquery', 'nltest', 'csvde', or 'ldifde'.
Bitwarden Cli Npm Hijack
YARA-L
Identifies developers or CI pipelines executing the hijacked @bitwarden/cli npm package (v2026.4.0) during the exposure window.
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory, often associated with the XWorm malware.
Detects files or processes matching SHA256 indicators published by Google Threat Intelligence Group for the INFINITERED campaign. The hashes cover the help.php persistence component, credential harvesters, backdoors, and droppers. A match should be treated as a high-confidence indicator of compromise and investigated immediately.
Identifies PowerShell commands that copy a .bat file from the %TEMP% directory to the Startup folder, a technique used by Vidar malware for persistence.
Detects the execution of a spoofed Adobe.application ClickOnce deployment manifest, often initiated by web browsers or the explorer process, indicating a potential phishing attempt.
This rule detects attempts by a process, potentially a Remcos RAT loader identified by 'GST*.com' or 'GST' in its command line, to evade sandbox or virtual machine environments. It looks for the presence of common sandbox/VM indicators in the command line.
Page 59 of 84