Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,443
11,831
5,875
5,151
4,864
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects a suspicious pattern where an endpoint initiates an HTTP GET request to a known staging IP with a specific 'force=1' parameter, followed by the execution of a bash shell process. This behavior is associated with the ClickFix attack chain used to deliver AMOS Stealer payloads on macOS.
Detects the execution of staged scripts (.cmd, .ps1, .vbs, .js) from user temporary directories using cmd.exe, powershell.exe, or wscript.exe. This behavior is consistent with the Sauron Loader malware family, which utilizes these interpreters to execute secondary C2-tasked payloads.
Detects instances where critical system processes (such as svchost.exe, lsass.exe, or w3wp.exe) spawn known command-line interpreters or script execution utilities (e.g., cmd.exe, powershell.exe, certutil.exe) which then initiate outbound network connections to common ports (445, 3389, 135, 5985, 5986, 1433, 80, 443) that are external to the local network. This behavior is often associated with lateral movement, command and control (C2) communication, or reconnaissance.
Detects a Bash stager script associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The script performs system architecture verification to download a specific Mach-O payload, makes the downloaded file executable using chmod, and subsequently executes the payload.
Detects the execution of mshta.exe with a command line involving remote HTTP connections or suspicious file extensions (.dat), which are often used by adversaries to proxy the execution of malicious scripts or HTA files.
Detects the execution of mshta.exe with a command line involving remote HTTP connections or suspicious file extensions (.dat), which are often used by adversaries to proxy the execution of malicious scripts or HTA files.
Detects workflow or repository content referencing the compromised actions-cool/issues-helper or actions-cool/maintain-one-comment GitHub Actions, the known malicious commit, or the Bun-based execution of an obfuscated index.js payload
Detects a suspicious runtime pattern in GitHub Actions where a runner environment installs the Bun runtime and immediately executes an action's index.js file. This pattern is characteristic of supply chain attacks where a compromised GitHub Action uses mutable-tag pinning to smuggle and execute an obfuscated JavaScript payload before legitimate action logic.
Detects the execution of potentially malicious utilities (curl, finger, cmd, powershell) that are launched by the Windows Explorer process (explorer.exe). This pattern is often indicative of malicious activity where an adversary uses legitimate OS processes to spawn command shells or network tools for further exploitation or file retrieval.
Detects the loading of .NET Common Language Runtime (clr.dll) and System.Management.Automation.dll into a process that is not a recognized PowerShell binary (e.g., powershell.exe, pwsh.exe). This behavior is associated with the 'PSInline' technique used by SloppyRAT, where PowerShell capabilities are invoked directly via COM objects to execute commands in memory. The rule further correlates this activity with the creation of files with a .png extension in temporary directories, which is consistent with the exfiltration staging behavior of the malware.
Detects the execution of IronPython or generic Python interpreters where the command line contains suspicious obfuscation patterns, including base64-encoded strings, zlib compression/decompression, and the use of the subprocess module. This pattern is commonly used by adversaries to execute hidden or obfuscated malicious payloads.
Detects the execution of processes that contain command-line arguments indicative of debugger evasion techniques, such as checking for the presence of a debugger using functions like 'IsDebuggerPresent' or 'CheckRemoteDebuggerPresent'. This is commonly associated with malware attempting to evade dynamic analysis in sandboxes or by security researchers.
Detects the use of .NET reflection and assembly loading techniques within PowerShell or C# compiler (csc.exe) command lines. Attackers frequently use these methods to load malicious payloads directly into memory, bypassing disk-based detection mechanisms. The rule looks for the combination of reflection-related namespaces/methods and indicators of obfuscation or encoding such as Base64 strings, Gzip compression, and decryption routines.
Detects the execution of wscript.exe with silent (/B) and no-logo (/Nologo) flags, spawned by a process named MicrosoftEdgeUpdateTaskCore. This pattern is indicative of potential living-off-the-land techniques where an adversary leverages a legitimate system task to execute scripts stealthily.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects execution of PowerShell scripts spawned by wscript.exe or cscript.exe that retrieve configuration data or file paths from process-specific environment variables, a technique observed in LausivLoader to evade command-line monitoring.
Detects the use of PowerShell command lines containing both 'AesManaged' for decryption and '[System.Reflection.Assembly]::Load' for reflective loading of a .NET assembly in memory. This pattern is consistent with the execution stage of malware such as LausivLoader, which stage encrypted payloads and load them directly into the process memory to evade disk-based detection.
Detects the creation of a scheduled task named 'MicrosoftEdgeUpdateTaskCore' that is configured to execute a malicious JavaScript file named 'PhotoStudio.js' using wscript.exe with silent flags. This behavior is indicative of persistence mechanisms employed by the LausivLoader malware family.
Detects the execution of PowerShell scripts that utilize a multi-stage deobfuscation and loading technique. The script decrypts a staged payload using AesManaged (with specific hardcoded byte constants), decompresses the result via GZipStream, and uses [System.Reflection.Assembly]::Load to reflectively execute the resulting .NET assembly in memory. This pattern is characteristic of advanced malware loader chains, such as those used by the 'LausivLoader'.
Detects the creation or execution of scheduled tasks named 'MicrosoftEdgeUpdateTaskCore' that exhibit suspicious behaviors, specifically those marked as hidden, tasks utilizing a LogonTrigger, or tasks executing wscript.exe with specific command-line arguments (e.g., //B, //Nologo) often associated with malicious script execution patterns.
This rule detects PowerShell script blocks that exhibit multiple indicators of obfuscation and in-memory execution. It identifies the combination of AES encryption, embedded key bytes commonly associated with deobfuscation routines, GZip compression, and reflective assembly loading (Assembly.Load). The use of multiple techniques simultaneously significantly increases the likelihood of malicious activity, such as fileless malware loading or execution of obfuscated payloads.
Page 32 of 191