Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Ping Hex IP
Sigma
Detects a ping command that uses a hex encoded IP address
Detects the presence of reversed PowerShell commands in the CommandLine. This is often used as a method of obfuscation by attackers
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Detects the execution of a renamed AutoIt2.exe or AutoIt3.exe.
AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks.
Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
AutoIt is a scripting language and automation tool for Windows systems. While primarily used for legitimate automation tasks, it can be misused in cyber attacks.
Attackers can leverage AutoIt to create and distribute malware, including keyloggers, spyware, and botnets. A renamed AutoIt executable is particularly suspicious.
Detects potential commandline obfuscation using unicode characters.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit.
Looking for certain techniques implementing Unicode selectors for code injection, used in linked research blog.
Therefore, characters that do not render in code editors or during standard code review.
Therefore, characters that do not render in code editors or during standard code review.
Detects the creation of specific VBScript or PowerShell dropper files (6202033.vbs, 6202033.ps1) within temporary directories. This activity is indicative of malware attempting to establish a foothold or execute malicious code.
Detects DeepLoad-related behavioral chains including ClickFix PowerShell execution, mshta retrieval, scheduled task persistence, Add-Type or APC style injection, LockAppHost or related target process launches, WMI based re-execution, filemanager.exe execution, USB spread indicators, and known DeepLoad infrastructure communication.
Detects the CTRL persistence pattern by correlating suspicious registry value modifications (using disguised names like 'ShellStateVersion1', 'IconSizeVersion1', 'IconUnderlineVersion1') with the creation of scheduled tasks via PowerShell or schtasks.exe. The scheduled tasks often involve hidden or encoded commands and are set to launch at startup or with specific system privileges.
Detects suspicious command-line executions involving PowerShell or WMI, combined with network-related keywords (http, https, encodedcommand, FromBase64String), originating from common user applications like Microsoft Word (winword.exe) or Windows Explorer (explorer.exe). This pattern can indicate malicious activity such as script execution, download of payloads, or obfuscated command execution.
Detects when a process spawned by Microsoft Office or a web browser executes a child process.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
Detects command line executions using the 7z compression utility to extract archives with a specific hardcoded password (-pppp). This behavior is an established staging artifact observed in ClickFix campaigns (such as the QuickBooks and Booking.com clusters) to deploy payloads like the NetSupport RAT.
Detects the creation of the specific mutex 'Windows-Updates-KB852654856' used by the BRUSHLOGGER keylogger to enforce single-instance execution. The malware decodes this string from Base64 at runtime to mimic a legitimate Windows Update KB identifier.
Identifies execution of rundll32.exe with WebDAV functionality (davclnt.dll, DavSetCookie) and UNC paths using @port syntax. This behavior is indicative of remote DLL retrieval over HTTP and may be associated with ClickFix variants abusing LOLBins for payload delivery and execution.
Detects the execution of a Python stager associated with OmniStealer. The stager uses an inline command to decompress and execute the final payload, a common technique for this malware family.
Detects a PowerShell process reading the content of a batch script named 'rEgX.cmd' to extract an appended payload. This technique is used by the DeadVax malware as part of its stage 3 execution.
Detects a specific script execution pattern where a batch file, often named 'rEgX.cmd', is read by a PowerShell process (or a renamed variant like 'mbs.exe') to extract a hidden, encrypted payload from its own content. This self-parsing technique, used by the Dead#Vax malware, looks for lines starting with a specific marker (e.g., '@') to bypass traditional file-based detection.
Detects attempts to exploit a remote code execution vulnerability (CVE-2025-40553) in SolarWinds Web Help Desk. Attackers use hex-encoded escape sequences (`\xNN`) and other JSON parsing gotchas to bypass security filters and achieve deserialization of malicious objects.
Detects PowerShell attempting to read a specific batch file named 'rEgX.cmd' using Get-Content, a signature behavior of the Dead#Vax self-parsing loader. This technique is used to extract a hidden payload from the script itself.
Detects instances where PowerShell is used to read the contents of a batch file (specifically looking for '.cmd' or '.bat' extensions) to extract a payload. This logic focuses on the 'Get-Content' cmdlet being applied to a script file, which is a key component of the campaign's self-parsing and payload extraction mechanism, as seen in the Dead#Vax campaign.
Detects the execution of a PowerShell command intended to read the content of the batch script that launched it.
This technique is often used as a form of steganography to hide and extract an embedded payload from the script file itself.
Attackers, such as in the Dead#Vax campaign, use this method to deobfuscate and load the next stage of an attack in memory.
This technique is often used as a form of steganography to hide and extract an embedded payload from the script file itself.
Attackers, such as in the Dead#Vax campaign, use this method to deobfuscate and load the next stage of an attack in memory.
Page 59 of 81