Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,693 detections
Filters
Last updated
All Time
Detection languages
546
534
293
77
61
Contributors
401
223
219
189
154
Categories
726
560
461
367
323
Platforms
1,476
157
136
87
8
Products / Services
334
331
222
195
56
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
1,693
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects the execution of mshta.exe spawning a command shell (cmd.exe) to download a remote file. This behavior is indicative of malicious HTA files used to deliver malware, as seen in campaigns distributing Epsilon Red ransomware.
Detects the execution of an HTA file (via mshta.exe) that spawns a command prompt to silently download and execute a remote payload using curl. This behavior is consistent with the Epsilon Red ransomware campaign that uses malicious HTA files with embedded JScript to run shell commands.
Detects possible prompt injection or abuse of AI models like LLMs via unusual process and API call patterns
This detection monitors the execution of 7zG.exeโthe 7-Zip GUI executableโspecifically when launched from the Traiolx Custom Utils or Kilo Verfair Tools directory under the userโs Roaming profile (\\AppData\\Roaming\\Traiolx Custom Utils). It identifies suspicious command-line activity where 7zG.exe is used to decrypt or extract a file named drata.dat, used to load second payload.
Detects the Chaos ransomware encryptor based on unique command-line arguments and embedded strings.
Detects the use of curl to silently download a file from a remote server, often initiated by a command-line interpreter. This technique is used by adversaries, such as in the Epsilon Red ransomware campaign, to fetch payloads without user interaction.
Detects DEVMAN ransomware, a variant of DragonForce, based on unique strings related to its mutex, deterministic file renaming, and internal functionalities observed in analysis.
Detects components of the KimJongRAT PE variant, including the orchestrator (NetworkService.dll), loader (sys.dll/baby.dll), and stealer (dwm.dll), based on unique strings, PDB paths, and network communication artifacts.
Detects the use of encoded or obfuscated IP addresses (hex, octal, etc.) within a URL in conjunction with common download commands. This technique is often used by adversaries to evade simple network-based detections or to obscure their infrastructure.
Detects suspicious Windows Shortcut (LNK) files that exhibit characteristics of malicious activity, including execution of system binaries with suspicious arguments, in-argument script execution, or overlay content execution.
This rule detects the execution of DLLs that exhibit signs of advanced code obfuscation, such as dynamic jumps (e.g., JMP RAX) or indirect function calls (e.g., CALL RAX). This technique is used by malware like SLOW#TEMPEST to hinder static and dynamic analysis. The rule specifically looks for indicators from an advanced EDR, sandbox, or memory analysis tool.
This rule detects PowerShell command lines that contain non-English (Unicode) characters, excluding the en-dash character. This behavior is often indicative of obfuscation techniques used by adversaries to evade detection, as legitimate PowerShell commands typically do not contain such characters in their command line arguments.
This query identifies when a suspicious SVG file, linked to known threat intelligence, is downloaded via a browser. This technique is often used for SVG smuggling, where attackers embed malicious JavaScript or links within the SVG's structure to bypass traditional content filters or sandboxing. Once rendered in the browser, the embedded content may redirect the victim to a malicious site or initiate further malicious activity.
Detects PowerShell commands using string reversal techniques and specific numeric padding, methods observed in Kimsuky's "ClickFix" campaigns to obfuscate malicious code. The rule looks for a combination of PowerShell string manipulation functions and a unique numeric string.
Detects the "ClickFix" tactic used by the Kimsuky group, where users are tricked into executing malicious PowerShell commands. This includes techniques like reverse-string obfuscation and the use of specific junk strings to evade detection.
This detection identifies attempts to execute PowerShell commands that have been obfuscated using Base64 encoding. Attackers frequently employ Base64 encoding to conceal malicious scripts, evade signature-based antivirus solutions, and make it more difficult for security analysts to quickly understand their true intent.
KQL Query from file: Suspicious CLI Obfuscation
KQL Query
KQL Query from file: Detecting BYOVDLL Abuse
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
Page 66 of 81