Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
12 detections
Filters
Last updated
All Time
Detection languages
10
1
1
Contributors
4
2
2
1
1
Categories
9
3
2
1
1
Platforms
12
Products / Services
3
3
1
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
Detects the execution of regsvr32.exe with command line arguments containing 'scrobj.dll' and '/i:http'. This behavior indicates the abuse of the Windows Registry Server utility to load a remote COM scriptlet, a technique frequently observed in TA505 adversary activity to execute malicious payloads, such as the Get2 downloader or SDBbot RAT.
Ransomware group exploiting edge devices and managed file transfer software
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects known MonsterV2 malware samples based on their SHA256 file hashes. Detecting these hashes on endpoints can directly identify MonsterV2 infections.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects the C2 communication of the Slopoly PowerShell backdoor, used by the Hive0163 group. It looks for specific HTTP POST requests containing a JSON body with characteristic keys.
Detects the creation of a scheduled task named 'Runtime Broker' that executes files from 'C:\ProgramData\Microsoft\Windows\Runtime\'. This technique is used by the Slopoly malware, deployed by the Hive0163 group, to establish persistence by masquerading as a legitimate Windows service.
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects a two-stage behavior characteristic of the SonicCrypt crypter: 1) A process creates a suspicious executable in a Windows system directory. 2) The newly created executable is then launched by the Windows Task Scheduler.
Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents
Detects mshta loaded by wmiprvse as parent as used by TA505 malicious documents