Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,445
11,833
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
This rule detects various activities associated with the Sha1-Hulud campaign, including the creation of malicious files (setup_bun.js, bun_environment.js) identified by their SHA256 hashes or filenames within .npm directories. It also identifies the execution of malicious preinstall scripts involving 'node' and 'setup_bun.js'. Furthermore, the rule looks for persistence mechanisms related to GitHub Actions, specifically the creation of 'discussion.yaml' within '.github/workflows' or 'run.sh'/'config.sh' within '/.dev-env/'. Finally, it detects destructive commands used as a fallback, targeting both Linux (using 'find', 'shred', 'xargs', 'delete') and Windows (using 'del', 'rd' on '%USERPROFILE%').
Detects process execution patterns associated with the "Sha1-Hulud: The Second Coming" NPM supply chain attack. This includes the silent installation of the 'bun' runtime during an 'npm install' and a destructive file shredding command. The rule filters out legitimate manual installations by developers by checking the initiating parent process.
Detects the creation of VBScript or Batch files in the Windows Startup folder. This is a common persistence technique used by various malware families, including the scripts (`pws1.vbs`, `PWS.vbs`, `startuppp.bat`) dropped by the SERPENTINE#CLOUD campaign.
Detects the initial execution phase of the CHAMELEON#NET campaign, where specific obfuscated JavaScript files (e.g., POP2.js, adobe.js, svchost.js) are dropped into a temporary directory and then executed by a script host like wscript.exe or cscript.exe. The rule correlates file creation events of these suspicious JavaScript files in the user's temporary directory with their subsequent execution by wscript.exe or cscript.exe within a short timeframe.
Detects the execution of a command pattern associated with malicious .lnk files used in the SERPENTINE#CLOUD campaign. The threat actor uses a .lnk file to launch cmd.exe, which then uses robocopy to download a .wsf script from a WebDAV share hosted on a Cloudflare Tunnel, and finally executes it with cscript.exe.
Detects suspicious behavior where a Node.js-based application, potentially EvilAi malware, launches cmd.exe to query MachineGuid from the registry or system model via PowerShell. This activity indicates potential fingerprinting or persistence activity, often originating from the \AppData\Local\Programs\ directory with medium integrity.
Detects python.exe executing from an unusual directory (e.g., a user's 'Contacts' folder) and injecting code into a benign process like notepad.exe. This is a specific behavior observed in the SERPENTINE#CLOUD campaign, where a Python-based loader is used to execute shellcode in memory.
Detects the execution of shell scripts and creation of files associated with the FlexibleFerret macOS malware campaign, which is tied to fake job recruitment lures to trick users into executing malicious commands.
Detects the execution of an executable file from the AppData\Local directory by the Windows Script Host (wscript.exe or cscript.exe). This behavior is unusual and was observed in the CHAMELEON#NET campaign where JavaScript droppers were used to launch subsequent stages.
Detects a PowerShell script that uses Invoke-WebRequest with custom headers to download a file, which is then executed via Start-Process. This technique is used by malware to bypass simple network filtering or for C2 authentication. It was observed in a campaign delivering multiple RAT families including AsyncRAT, DCRAT, and PUREHVNC.
Detects the Tsundere botnet infection chain where msiexec.exe launches a hidden, encoded PowerShell process, which in turn executes a Node.js spawner script.
Detects the execution of a Python interpreter with suspicious characteristics, such as running from a temporary location or using command-line arguments associated with obfuscation and in-memory execution. This behavior is consistent with Python-based stealers like Xillen Stealer.
Detects a PowerShell process launched by a JavaScript script host (wscript.exe or cscript.exe) that contains command-line arguments indicative of downloading, decoding, and reflectively loading a payload, a technique used by Phantom Stealer.
Detects the execution of a hidden PowerShell process with a bypassed execution policy, spawned from a script host process (cscript.exe or wscript.exe). This behavior is indicative of a multi-stage dropper, as observed in the analysis of a batch file that uses a VBScript to launch a PowerShell stager invisibly.
Detects the execution of PowerShell by the Windows Script Host (wscript.exe or cscript.exe). This behavior is often associated with malicious JavaScript droppers that download and execute second-stage payloads, as seen in the delivery of malware like NanoCore RAT.
Detects remote command execution via PowerShell's Invoke-Command, a technique used by The Gentlemen ransomware for lateral movement and deploying payloads.
Detects the in-memory execution of AppleScript or JXA payloads via osascript, a technique used by the DigitStealer malware to download and run malicious code while evading file-based detections.
This rule detects instances where PowerShell (powershell.exe or pwsh.exe) spawns 'node.exe' with command-line arguments containing '-e' and the process path is located within the 'AppData\Roaming' or 'AppData\Local' directories. This behavior can be indicative of malicious activity, such as the execution of Node.js-based scripts or malware by PowerShell, potentially for persistence or further execution within user-specific application data folders.
Detects a PowerShell script used by Gootloader for reconnaissance. This script collects environment variables with a specific length limit, operating system details, and information about running processes.
Detects a Python process creating a scheduled task or adding a Windows Defender exclusion, a technique used by malware like InvisibleFerret for persistence and defense evasion.
Detects powershell.exe execution from non-standard parent processes or atypical file system locations, a behavior often associated with ClickFix social engineering attacks.
Page 159 of 191