Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects PowerShell execution that includes specific command-line arguments consistent with decoding XOR-encoded payloads. It looks for 'powershell.exe' processes where the command line contains '-bxor' and references to files like 'Profile.ps1', '1.dat', or 'Com.dat', which are associated with the Dragon Weave campaign's decoding activities.
Identifies downstream ClickFix where users paste and execute PowerShell or CMD commands via the Explorer Run menu, specifically looking for commands that include Invoke-WebRequest, IEX, or mshta, and are associated with network connections to 'wigetticks.com' or 'wizzleticks.com'.
Detects browser network events fetching secondary stage loaders from api.wizzleticks.com, specifically when initiated by cmd.exe, powershell.exe, or mshta.exe. This indicates a potential supply chain attack where a legitimate process is used to download and execute malicious content.
Detects the loading of a compromised JavaScript file from a CDN (cdn-static.okendo.io/reviews-widget-plus/js/okendo-reviews.js) followed by the execution of mshta.exe on the same device within a 10-minute timeframe, indicating a potential supply chain attack by SmartApeSG.
This rule connects the creation of the 'Edgre' persistence registry key, which contains 'zuidrt.hta', to the actual process execution of 'zuidrt.hta'. This activity is associated with Operation XENOFISCAL, where the SideCopy threat group deploys the XenorRAT malware.
Looks for curl or wget downloading a payload followed by node or bun immediately executing a .js or .mjs file. This pattern is indicative of supply chain attacks, particularly those targeting JavaScript ecosystems like npm.
Correlates mshta.exe (post-HTA load) spawning PowerShell to execute secondary stages like the .vmxx shellcode, as observed in Operation XENOFISCAL.
This rule detects network connections to the 185.235.137.0/24 subnet, which is associated with XenoRAT command and control (C2) infrastructure. The detection specifically looks for these connections being initiated by 'mshta.exe' or 'powershell.exe', indicating potential malware activity or C2 communication.
Detects if 'install-persistent.php' or 'class-wc-subscription-diagnostics.php' files are modified by tools like powershell.exe, certutil.exe, or cmd.exe, indicating potential alternative persistence methods or backdoor installation.
Detects suspicious child processes (cmd.exe, cscript.exe, powershell.exe) spawned by Microsoft Outlook or Word. This behavior is often indicative of malicious activity, such as phishing attacks delivering malicious documents or emails that execute scripts or commands.
Detects malicious script injection into HTTP responses via MitM
Detects the execution of the 'moladb_superusers.py' script, which is associated with the MuddyWater threat group for database enumeration.
Detects Python accessing desktop authenticator, token, OTP, or MFA application databases and configuration. This rule specifically looks for Python processes executing with command-line arguments that indicate an attempt to interact with sensitive authenticator application data.
Detects a compiled Python extension writing .py or .pyc files into a temporary or profile directory for later execution. This behavior is often associated with malware that uses Python for its runtime logic, where the compiled Python code (e.g., from Cython) extracts and drops the actual Python scripts for execution.
Detects registry or PowerShell changes that disable script block logging, module logging, or transcription before payload execution. This rule specifically looks for modifications to the PowerShell ScriptBlockLogging registry key where the EnableScriptBlockLogging or EnableScriptBlockInvocationLogging values are set to 0, indicating a disablement of these logging features.
Detects PowerShell launched with hidden or non-interactive options and encoded, compressed, or character-reassembled content. This behavior is often indicative of malicious activity, as adversaries use these techniques to evade detection and obscure their commands.
Detects the execution of MassLogger RAT components where the command line contains 'masslogger', 'mass.logger', or 'logger.exe', specifically when initiated by PowerShell or a process associated with 'RemotePC'. This rule aims to identify the loading or execution phase of the MassLogger RAT.
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
Detects Python scripts accessing the /proc/*/mem file of the Runner.Worker process. This activity is indicative of memory scraping, potentially to extract sensitive information like masked GitHub Actions secrets, as observed with malware like Miasma.
Detects process injection attempts using ptrace or LD_PRELOAD originating from scripting languages like Python or Node.js. This technique is associated with the SPECTRALVIPER threat group for process hollowing and defense evasion.
Detects Node.js executing inline base64 encoding specifically aimed at configuration files prior to exfiltration.
Page 130 of 191