Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,108
15,615
12,573
8,385
6,206
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
This rule detects activity associated with the GhostLock ransomware by combining three types of signals: file artifact creation/access, specific Python module loads indicative of GhostLock's execution, and the presence of GhostLock-specific command-line arguments. It aims to identify the ransomware across different stages of its operation.
Detects the presence of specific string artifacts related to the TEASOUP JavaScript obfuscator within script blocks. TEASOUP is heavily used by the Russia-nexus threat group GREYVIBE to obfuscate initial access payloads in PhantomMail campaigns.
Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.
Detects XOR-encrypted payload delivery used to evade signature detection
Detects the execution of PowerShell scripts containing strings associated with the DAYLIGHT obfuscator. This obfuscator is utilized by the Russia-nexus threat group GREYVIBE to hide post-compromise payloads and PhantomRelay implants.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of the DPAPI cmdlet ConvertTo-SecureString alongside the HKCU:\Printers path. This technique binds the encryption to the active user session to hinder forensic analysis.
Detects the Miasma worm kill chain triggered via binding.gyp during npm install. The attack
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
spawns node-gyp which executes a malicious index.js, downloads Bun runtime via curl, and
launches the payload with bun. A legitimate npm install should not spawn curl/unzip or
download alternative JavaScript runtimes.
Detects the presence of JavaScript obfuscation indicators such as 'atob(', 'Blob(', or 'URL.createObjectURL' in process command lines. These functions can be used by malicious scripts to decode or create objects from obfuscated data, often as part of a defense evasion strategy.
This rule detects suspicious network connections where the initiating process command line contains keywords indicative of evasion techniques such as 'obfuscate', 'encode', or 'encrypt'. It specifically looks for these activities over common web ports (80, 443, 8080, 8443) and triggers an alert if 10 or more such attempts are observed from a device within an hour.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of ConvertTo-SecureString alongside the HKCU:\Printers path. This technique is used by Gamaredon to bind payload encryption to the active user session and hinder forensic analysis.
Detects scheduled tasks created with embedded PowerShell XOR decoding logic, ReadAllBytes, and Invoke-Expression techniques that may be used to establish persistence and execute obfuscated payloads. The rule specifically looks for 'schtasks.exe' creating a task with '/create', containing 'OneDrive', 'Startup', 'Task' in the command line, and also includes '-bxor', 'ReadAllBytes', 'iex', and '[Text.Encoding]::UTF8.GetBytes' which are indicative of obfuscated PowerShell execution via XOR decoding.
This rule detects potential JavaScript obfuscation within HTTP responses by looking for the presence of both 'eval(' and 'unescape(' within the first 500 bytes of file data in a client-bound HTTP flow. This combination of functions is often used in malicious JavaScript to hide its true intent and evade detection.
This rule detects the presence of a large Base64 encoded string (at least 100 characters) within the HTTP client body of network traffic. This pattern is often used by attackers to obfuscate malicious payloads, aligning with the MITRE ATT&CK technique T1027 for Defense Evasion.
Detects PowerShell commands that reverse byte arrays before dynamically loading assemblies into memory, a behavior commonly associated with advanced malware loaders and fileless execution techniques. The rule specifically looks for PowerShell process command lines containing 'IO.File', 'System.Reflection.Assembly', 'Length-1', and '..0', which are indicative of byte array manipulation and in-memory assembly loading.
Detects PowerShell commands using XOR operations together with execution primitives that may indicate obfuscated in-memory payload decoding. Specifically looks for 'powershell.exe' executing with '-bxor', '81', and either 'IEX' or 'Invoke-Expression' in the command line.
Detects excessive caret (^) escaping in command lines, a common obfuscation technique used by attackers to evade detection and conceal malicious commands. The rule specifically looks for command-line executions by cmd.exe, powershell.exe, or pwsh.exe that contain more than 5 caret characters and a pattern of at least three alphanumeric characters immediately followed by a caret.
Identifies wscript.exe executing a JavaScript file from a user directory and subsequently spawning a PowerShell process with execution policy bypass (-nop) and encoded command (-enc) flags, indicative of potential MonoGlyphRAT staging activity.
Detects the creation of specific payload staging files (filter.bin, kernel-diag.lib) in the anomalous ApplicationData32 directory, a behavior indicative of UAC-0184 staging prior to decoding and execution.
Detects variable splitting technique in cmd.exe to obfuscate PowerShell invocation.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
Page 54 of 81