Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,108
15,615
12,573
8,385
6,205
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects the creation of specific files associated with the UAC-0184 threat group, often used in DLL sideloading scenarios. The rule looks for the presence of 'cluster-overlay64.exe', 'plane9engine.exe', 'plane9engine.dll', 'openvr_api.dll', 'kernel-diag.lib', and 'filter.bin' in common temporary or user data directories. It triggers if three or more of these files are found within an hour, or if 'kernel-diag.lib' or 'filter.bin' are present.
Detects processes utilizing ${IFS} in conjunction with Base64 decoding. This technique is used by the Gogs argument injection exploit to bypass Git branch name space restrictions while delivering encoded shell payloads.
Detects file creation, modification, or renaming events in the suspicious '%AppData%\WinDataScope' directory. This directory is hardcoded in the FrostyNeighbor dropper for staging PicassoLoader, indicating potential malware activity.
Detects command-line obfuscation via Windows environment variable substring expansion (%var:~offset,length%), an evasion technique used by APT37 in the Operation Deepfake/HumanitarianBait-adjacent campaigns to reconstruct malicious commands at runtime and bypass static command-line scanning. This rule catches both the APT37-specific single-character extraction pattern (,1%) and the broader high-count substring-expansion pattern that any obfuscated command exhibits regardless of chunk size. It also flags cmd.exe /k invocation, which APT37 commonly uses.
Detects the variable splitting technique in cmd.exe specifically designed to obfuscate the invocation of PowerShell (e.g., set x=pow&&set y=ershell). This technique is used in the InstallFix campaign to bypass static command-line monitoring.
This rule detects suspicious command-line patterns indicative of obfuscation, encoding, or stealth techniques often used by adversaries. It scores various characteristics such as hidden window styles, variable manipulation, string operations, and decoding functions (e.g., Base64, Gzip, Deflate). The rule filters out known legitimate processes and command-line boilerplate to reduce false positives and classifies detections based on the highest scoring obfuscation category.
Detects the presence of JavaScript obfuscation indicators such as 'atob(', 'Blob(', or 'URL.createObjectURL' in process command lines. These functions can be used by malicious scripts to decode or create objects from obfuscated data, often as part of a defense evasion strategy.
Detects PowerShell commands reading their own batch file contents via the %~f0 self-reference combined with .NET ReadAllText, the technique Deep#Door uses to extract its embedded Python payload from install_obf.bat without external network retrieval. The combination of these specific patterns has near-zero legitimate use.
Detects the presence of specific JavaScript functions used to generate and handle Blob objects in memory. This technique is utilized by the BlobPhish campaign to keep the phishing payload in memory, thereby evading file and network scanning.
Detects files with specially crafted filenames that embed Base64-encoded bash payloads designed to execute when processed by shell scripts.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
These filenames exploit shell interpretation quirks to trigger hidden commands, a technique observed in VShell malware campaigns.
Detects Obfuscated Powershell via VAR++ LAUNCHER
Detects specific techniques often seen used inside of PowerShell scripts to obfscuate Alias creation
Detects usage of base64 utility to decode arbitrary base64-encoded text
Detects the extraction of password protected ZIP archives. See the filename variable for more details on which file has been opened.
Detects Obfuscated Powershell via RUNDLL LAUNCHER
Detects base64 encoded .NET reflective loading of Assembly
Detects suspicious base64 encoded and obfuscated "LOAD" keyword used in .NET "reflection.assembly"
Detects calls to base64 encoded WMI class such as "Win32_ShadowCopy", "Win32_ScheduledJob", etc.
Detects specific combinations of encoding methods in PowerShell via the commandline
Detects presence of a potentially xor encoded powershell command
Detects a suspicious process creation as SYSTEM user (suspicious program or command line parameter)
Page 55 of 81