Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
This detection identifies a command-line pattern characteristic of "ClickFix" attacks on macOS. It looks for a shell process (like zsh, bash, sh) that is spawned by a known terminal application and executes a command involving echoing a string, decoding it with 'base64 -D', and piping it into another shell for execution. This technique is used by adversaries to trick users into running malicious code, bypassing standard OS protections.
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
FileFix is a sophisticated social engineering attack, emerging in mid-2025, that abuses the Windows File Explorer address bar to execute malicious PowerShell commands. It is an evolution of the "ClickFix" technique, shifting from the Run dialog (Win+R) to the Explorer address bar (Ctrl+L).
This rule detects suspicious process creation events where `explorer.exe` (Windows Explorer) launches various scripting or utility executables (`powershell.exe`, `cmd.exe`, `wscript.exe`, `mshta.exe`, `rundll32.exe`, `regsvr32.exe`, `installutil.exe`, `wmic.exe`, `certutil.exe`, `msdt.exe`). The detection is specifically triggered when the command line of the launched process contains indicators of network communication (e.g., `http://`, `https://`, `iwr`, `invoke-webrequest`, `curl`, `wget`, `bitsadmin`, `downloadstring`, `downloadfile`), encoded commands (`-e` or `-encodedcommand` with base64-like strings), or UNC paths (`\\`). It also specifically looks for `certutil` being used with `-urlcache`, `-decode`, or `-f` flags. The rule includes exclusions for common legitimate activities such as downloads from `chocolatey.org`, `nuget.org`, `aka.ms`, `cmd.exe` launching a browser to a URL, and `certutil -hashfile` operations.
Detects ClickFix PowerShell payloads
Using a variety of known Command Patterns and Fake Messages
Using a variety of known Command Patterns and Fake Messages
This rule detects the dropping of specific DLL files associated with OysterLoader malware within the 'AppData\Roaming' directory. The detection logic specifically looks for file creation events where the target filename contains 'AppData\Roaming' and one of the following strings: 'COPYING3.dll', 'VisualUpdater', 'AlphaSecurity', or 'DetectorSpywareSecurity'. This activity is indicative of a stage 3 drop by OysterLoader before a scheduled task is created, as detailed in a Sekoia report.
This rule detects Python scripts that use base64 decoding and execution, specifically looking for the 'import base64' statement appearing early in the file, followed by 'exec(base64.b64decode(' and ').decode('utf-8'))'. This pattern is indicative of a common method for obfuscating and executing malicious Python payloads, often seen in malware like KongTuke.
Detects unsigned processes creating directories and dropping multiple suspicious files (DLLs, executables, crypto libraries) in AppData Temp folders which may indicate malware staging behavior
Detects PowerShell execution containing multiple repeated empty-string literal patterns such as "" or '' (including variants with whitespace), often used in trivial string-obfuscation techniques observed in malicious scripts. The regex is greedy so per environment tuning may be necessary.
Detects the creation of a mutex with a persistent suffix '!&fse?%AS!'. This string has been observed across multiple versions and campaigns of OysterLoader (also known as Broomstick/CleanUp).
Detects PowerShell spawned by explorer.exe with extensive whitespace padding followed by comment characters and fake document paths. This technique is used in social engineering attacks where victims are instructed to paste commands into File Explorer, with malicious code hidden by whitespace and a visible fake path comment (e.g., "# C:\Documents\policy.docx") to appear benign.
Detects PowerShell scripts that perform a multi-stage obfuscation pattern involving the decompression of data using 'IO.Compression.DeflateStream' or 'IO.Compression.GzipStream', followed by base64 decoding using 'FromBase64String' or 'Convert::FromBase64', and finally loading the resulting payload as a .NET assembly using 'Reflection.Assembly' or 'Assembly]::Load'. This combination of actions is indicative of malware delivery techniques.
Malware often hides its payload in folders that look legitimate. In this case, it uses a path that sounds like an Intel driver folder, but it is fake. A real Intel installer would use a different, standard path. What makes this suspicious is that the file is created by a script, such as PowerShell or a batch file, not by an installer. Normal software installs show a setup wizard and write to known locations. Here, a script writes a file with an unusual name to a folder that mimics a trusted vendor. Security teams should treat any file created in this path by a script as highly suspicious. This rule helps catch that behaviour early in the attack.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
Malware sometimes creates files with names that look like system files. In this attack, it creates a file with a name that sounds like a Windows DLL. But the file is not a real DLL. It is a text file that holds hidden, encoded data. The malware uses it to pass data between stages of the attack. A script creates this file, not a normal program install. It appears in temp or ProgramData folders, which are common places for malware to hide. Real DLLs are usually installed by installers in specific system folders. Security teams should treat this exact filename being created by a script as highly suspicious. This rule helps catch that behaviour before the next stage runs.
In this attack, malware uses a renamed copy of PowerShell to read a hidden file and run it. The file contains more malware that gets executed in memory. What makes this suspicious is that the activity is started by a batch or command script, not by the user directly. A normal user would run programs by double-clicking or from a menu. Here, one script launches another, which then reads and runs hidden content. This is a common pattern in multi-stage attacks where each step hides the next. Security teams should look for this chain: a batch or command window starts a process that reads a specific file and executes what it finds. This rule helps catch that behaviour before the full malware takes over.
This rule detects the creation of specific image files (windows.png, koala.png, or Default.png) in common application data directories (AppData\Local\ or ProgramData\). The creation event must be initiated by Microsoft Office applications (WINWORD.EXE, EXCEL.EXE) or prnfldr.dll. This activity is indicative of APT28's Phantom Net Voxel operation, which uses steganography to embed shellcode within these image files.
Detects Windows VBScript (wscript.exe or cscript.exe) processes establishing network connections to AI/LLM API endpoints. This behavior is highly anomalous as VBScript is typically used for local automation and rarely makes HTTPS API calls to external services. This pattern is consistent with PROMPTFLUX malware and jailbroken LLM variants like WormGPT. PROMPTFLUX uses Gemini's API to dynamically rewrite and obfuscate its own VBScript code at runtime. WormGPT variants use jailbroken Grok (xAI) or Mixtral (Mistral AI) APIs with manipulated system prompts to bypass guardrails. The malware queries AI models to generate new obfuscated versions of itself, creating a "just-in-time" metamorphic capability that constantly evolves to bypass static signature-based detection. Sysmon Event ID 3 is the best way to detect this behavior on endpoints.
Detects Windows VBScript processes (wscript.exe or cscript.exe) performing DNS queries for AI/LLM API domains. This behavior is a key indicator of malware like PROMPTFLUX and WormGPT, which leverage these APIs for dynamic code generation and evasion. This activity is highly suspicious as VBScript engines rarely perform external network operations to these types of services. Sysmon event id 22 is the best way to detect this behavior on endpoints.
Detects PowerShell retrieving, decoding, and executing a payload stored inside the Windows registry.
Detects the creation of a mutex with a pattern specific to the PKR_MTSI packer. This packer is often used to obfuscate malware.
Page 61 of 81