Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects a PowerShell process reading its own or another script's content to extract a hidden payload. This technique was observed in the Dead#Vax campaign to deobfuscate and execute payloads stored within the script file itself.
Detects attempts to perform Indirect Prompt Injection (IDPI) by embedding malicious instructions for AI agents or Large Language Models (LLMs) within web content. This rule identifies when common prompt injection keywords are present in conjunction with CSS techniques used to hide the text from being rendered in a browser, a method used to evade human review while targeting automated systems.
Detects the command-line pattern of reassembling a ZIP or CAB file from fragmented parts using the 'copy' command. This technique was observed in a campaign where adversaries manually reconstructed payloads on disk to evade detection by splitting them into multiple parts and then reassembling them.
Detects Indirect Prompt Injection (IDPI) attempts where malicious instructions are dynamically injected into the DOM using JavaScript or concealed within HTML data attributes. Attackers use these methods to bypass static analysis tools and deliver hidden prompts to AI/LLM agents that process raw web content.
Detects PowerShell commands using the call operator '&' with 'Get-Command' (gcm) or 'Get-Alias' (gal) containing wildcards to resolve and execute sensitive cmdlets. This is a common technique to evade static string-based detections for commands like 'Invoke-Expression' or 'Invoke-WebRequest'.
This rule detects activity associated with a developer-targeting campaign leveraging malicious Next.js repositories. It identifies suspicious network connections to known Vercel staging domains and C2 IPs/ports/paths, as well as suspicious process execution patterns involving Node.js or VS Code related processes, and file events related to specific repository artifacts or sensitive file access by developer-adjacent processes. The detection logic covers network communication, process execution, and file system activities indicative of this specific threat.
Detects the use of certutil.exe to decode a batch script that is referencing itself as the source file. This is a 'fileless' technique used by attackers to hide and extract embedded payloads, as seen in the 'Contagious Interview' campaign.
Detects Microsoft PowerPoint spawning a command-line interpreter (cmd.exe or powershell.exe) to perform suspicious file operations. This behavior was observed in an APT36 campaign where a malicious PowerPoint Add-in (.ppam) was used to create staging directories and extract embedded payloads.
Detects Microsoft PowerPoint spawning a command-line interpreter (cmd.exe or powershell.exe) to perform suspicious file operations. This behavior was observed in an APT36 campaign where a malicious PowerPoint Add-in (.ppam) was used to create staging directories and extract embedded payloads.
Detects Base64 decoded content being executed via a shell on macOS, consistent with malicious OpenClaw skill style obfuscated command execution.
This rule detects files associated with Dohdoor activity. It uses two primary detection methods: matching known SHA256 file hashes and identifying distinctive text markers. The text markers include strings related to DoH request construction (e.g., 'insomnia/11.3.0', 'Accept: applications/dns-json'), staging path patterns (e.g., '/111111?sub=s'), DLLs and LOLBins used for disguise (e.g., 'propsys.dll', 'Fondue.exe'), and obfuscated infrastructure patterns (e.g., 'MswInSofTUpDloAd', '.DeSigN'). A hash match indicates a strong lead, while text marker matches suggest potential activity requiring further investigation.
Detects a phishing delivered JScript stage that spawns a hidden PowerShell instance (often via WMI Win32_Process.Create)
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
Detects csc.exe compiling code from Temp or AppData locations, a common pattern for dropper and loader build steps on compromised hosts.
Detects the creation of configuration files (.cfg) in sensitive or temporary Linux directories. This behavior is associated with the GRIDTIDE backdoor, which stages a configuration file containing a key to decrypt its C2 settings.
Detects PowerShell executing a self-parsing command to extract a hidden payload from a batch file. This technique was observed in the Dead#Vax campaign. The malware reads its own batch file content to find a line starting with '@' which contains the next-stage encrypted payload.
This rule detects the behavioral pattern of the dYdX RAT, which executes Python scripts from temporary directories with suppressed output. It looks for Python processes (identified by original filename) executing from common temporary directories while also suppressing output (e.g., redirecting to /dev/null or using CREATE_NO_WINDOW).
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
This rule detects the execution of PowerShell or PowerShell Core (pwsh.exe) with command-line arguments indicating the use of Base64 encoded commands. Adversaries often use Base64 encoding to obfuscate malicious PowerShell scripts, making them harder to detect by signature-based methods and to evade basic command-line logging. This detection specifically looks for the '-EncodedCommand', '-enc', or '-ec' flags (and their variations in casing) which are used to execute Base64 encoded strings as PowerShell commands.
This rule detects the creation of specific mutexes known to be associated with the Graven crypter. The detection is based on the exact string match of the mutex name '7ce3e80173264ea19b05306b865eadf9'. The rule targets process creation events on Windows systems.
This rule detects Python processes that are executed with command-line arguments indicative of silent execution or output redirection to null devices, combined with execution from a temporary directory. This pattern was observed in the dYdX PyPI package compromise, where a RAT ran undetected using these techniques.
This detection identifies suspicious command-line obfuscation executed by common scripting engines such as PowerShell, CMD, and Windows Script Host. It detects high signal behaviors including string concatenation, repeated string reconstruction, character based assembly, and encoded command execution flags.
These techniques are commonly used to conceal execution intent and evade security monitoring. Alerts should be reviewed in context to distinguish legitimate scripting from potentially evasive activity.
These techniques are commonly used to conceal execution intent and evade security monitoring. Alerts should be reviewed in context to distinguish legitimate scripting from potentially evasive activity.
Page 60 of 81