Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,456
11,839
5,876
5,155
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects script engines (wscript.exe, mshta.exe, cscript.exe) making outbound network connections to Cloudflare Workers domains (*.workers.dev). This is a primary C2 channel utilized by Gamaredon for GammaLoad payload delivery and beaconing.
Detects wscript.exe launching mshta.exe to execute files in the temporary directory. This behavior is indicative of Gamaredon's GammaDrop launching the GammaLoad HTA payload.
Detects RunOnce registry modifications calling wscript.exe to execute an .icl script silently. This is indicative of GammaLoad malware establishing persistence.
Detects the initial PowerShell command users are instructed to paste and run from the Windows Run dialog following a Microsoft Teams social engineering lure to deploy ModeloRAT. This rule specifically looks for PowerShell execution that downloads content from 'dropbox.com' using 'iwr' (Invoke-WebRequest), extracts an archive using 'Expand-Archive', and targets the 'appdata' directory.
Awk System Execution
Cortex XDR
This rule detects the execution of 'awk' on Linux systems when its command line contains includes suspicious functions like. This pattern is often indicativeof malicious script execution or command injection attempts using awk.
Detects Microsoft 365 access attempts where the ClientAppId masquerades as Microsoft Office (d3590ed6-52b3-4102-aeff-aad2292ab01c) to bypass conditional access policies, but the UserAgent string reveals the use of a programmatic script (e.g., Python, PowerShell). This mismatch is a known tactic utilized by UNC6671 (BlackFile) during automated data exfiltration operations.
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with the Matanbuchus 3.0 loader.
Detects programmatic file access in Microsoft 365/SharePoint environments where the operation is logged as 'FileAccessed' but the UserAgent indicates a scripting library like python-requests or PowerShell. This behavior is indicative of data exfiltration techniques used by actors like UNC6671 (BlackFile) who stream file content directly to bypass traditional 'FileDownloaded' monitoring.
Matanbuchus 3.0 Scheduled Task Creation
Cortex XDR
This rule detects the creation of a scheduled task named 'Update Tracker Task' using either 'schtasks.exe' or PowerShell cmdlets ('Register-ScheduledTask', 'New-ScheduledTask'). This specific task name has been associated with matanbuchus 3.0 loader.
Detects the ClickFix paste-and-run initial-access primitive used by KongTuke and other groups. This involves `explorer.exe` spawning PowerShell with defense-evasion arguments (`-NoProfile`, `-ExecutionPolicy Bypass`, `-WindowStyle Hidden`) and a downloader chain targeting cloud file-sharing services. The combination of `explorer.exe` parent (user typing into Run dialog), hidden execution flags, `Invoke-WebRequest`, and `Expand-Archive` in one command line is the defining fingerprint of the technique.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the execution of the Bun runtime attempting to execute known malicious scripts associated with the Mini Shai-Hulud supply chain compromise. Attackers use Bun during npm installation to evade traditional Node.js security monitoring.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Detects the execution of the Bun runtime attempting to execute known malicious scripts associated with the Mini Shai-Hulud supply chain compromise. Attackers use Bun during npm installation to evade traditional Node.js security monitoring.
Detects execution of Python with PySoxy SOCKS5 proxy arguments (-ssl, -remote_port, -remote_ip) alongside compiled bytecode (.pyc) execution. PySoxy is a 10-year-old open-source SOCKS5 proxy that ReliaQuest observed being deployed via ClickFix as a secondary encrypted access path alongside PowerShell-based C2. The specific combination of these three argument flags with .pyc execution is rare in legitimate use and represents the PySoxy invocation pattern verbatim.
Linux Interpreter with Command Execution
Cortex XDR
Detects the execution of PHP, Perl, or Ruby script interpreters on Linux systems when they are invoked with command-line arguments that suggest direct execution of code, especially when combined with commands or functions commonly used for remote code execution or data exfiltration. This rule aims to identify potential web shell activity or other forms of arbitrary command execution.
Detects PowerShell utilizing the Start-BitsTransfer cmdlet to download the 'syncobs.exe' payload, a known indicator for the PHANTOMPULL loader stage in the REF6598 campaign (PHANTOMPULSE RAT).
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects the execution of mshta.exe attempting to download and execute a remote payload masquerading as an msixbundle file. This technique is used in the InstallFix campaign to deliver ZIP/HTA polyglots.
Detects the variable splitting technique in cmd.exe specifically designed to obfuscate the invocation of PowerShell (e.g., set x=pow&&set y=ershell). This technique is used in the InstallFix campaign to bypass static command-line monitoring.
Detects PowerShell scripts attempting to overwrite the amsiContext buffer using Runtime.InteropServices.Marshal.WriteInt32 to disable AMSI scanning. This technique was notably observed in the InstallFix campaign delivering RedLine Stealer.
Page 142 of 191