Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
54 detections
Filters
Last updated
All Time
Detection languages
29
17
4
2
1
Contributors
13
11
10
5
4
Categories
44
14
10
7
5
Platforms
49
6
2
1
Products / Services
15
12
9
3
3
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
2
IDS Protocols
2
Detects the use of certutil.exe to decode files located within directories associated with the MSSQL service account (e.g., AppData, ServiceProfiles). This behavior is characteristic of an attack chain where an adversary uses SQL Server's xp_cmdshell to stage and decode a malicious payload from a base64-encoded file.
TokenGrabber Builder: Nuitka/PyInstaller AV-Evasion Compilation - detects Python builder scripts compiling an embedded stealer.py payload into a native executable via Nuitka or PyInstaller with AV-evasion flags
Detects the use of csc.exe (C# compiler) launched from PowerShell with hidden or bypass flags, as well as the subsequent execution of cvtres.exe. This activity is commonly associated with fileless malware techniques where helper classes or payloads are compiled and executed in-memory at runtime to evade detection.
Detects the invocation of the C# compiler (csc.exe) by PowerShell, where the command line includes specific references to .cmdline files. This pattern is commonly used in fileless execution techniques to compile and execute malicious code in memory after delivery.
Detects the execution of csc.exe (C# compiler) from non-standard directories or when compiling source files located in user-writable paths like Temp or AppData. This behavior is indicative of on-host code compilation used by attackers to bypass static antivirus detection by delivering and compiling malicious payloads on the fly.
Detects instances where PowerShell.exe spawns the .NET C# compiler (csc.exe) with command-line arguments referencing a '.cmdline' file. This pattern is commonly used by adversaries to compile malicious code in-memory, bypassing traditional disk-based file scanning.
Detects instances where PowerShell rapidly cycles through a known list of Microsoft-signed .NET binary utilities (LOLBins) located in .NET framework directories, within a short duration. This behavior is consistent with resiliency-spray techniques, such as those used by Veil#Drop, to find an available binary to host an injected .NET assembly.
Detects obfuscated PowerShell execution (utilizing common bypass and hiding flags) that subsequently spawns the C# compiler (csc.exe) from suspicious locations (AppData, Temp, or tmp directories). This pattern is consistent with fileless payload delivery and runtime compilation, such as that observed in recent NeptuneRAT campaigns leveraging Chrome Native Messaging.
Detects the execution of csc.exe (the C# command-line compiler) with specific command-line arguments (/noconfig, /fullpaths) and a response file (.cmdline) located within a temporary directory. This pattern is commonly associated with fileless malware, such as Banana RAT, which compiles its components at runtime to bypass static file-based detection.
This rule detects suspicious activity associated with the BeepRAT malware loader chain. It monitors for the execution of TCC.exe (a common name for Tiny C Compiler used by some malwares for dynamic compilation) with specific command-line arguments like -nostdlib and -run, as well as the spawning of suspicious child processes (cmd.exe, powershell.exe, or conhost.exe) by TCC.exe or the presence of a temp.bin file in the command line, which is indicative of BeepRAT shellcode loading behavior.
Detects the execution of tcc.exe with specific command-line arguments '-nostdlib', '-run', and a reference to a 'config.ini.c' file. This pattern is indicative of the execution of potentially malicious scripts or payloads, often seen in the context of TCC (Take Command Console) or similar utilities being used to compile or run code after delivery.
This rule detects the execution of PowerShell or AutoHotkey processes that include 'RtkLoggingManifest.man' in their command line. This behavior is indicative of AsyncRAT attempting to reconstruct a hidden .NET executable payload by parsing integers from a fake manifest file.
Detects the execution of node.exe from common user-writable or non-standard directories such as AppData, Downloads, Temp, ProgramData, or Desktop, accompanied by JavaScript file arguments. This behavior is indicative of the TonRAT campaign which uses a portable Node.js runtime to execute malicious JavaScript payloads in a stealthy manner, bypassing standard installation path detection.
This rule detects a suspicious sequence of network connections indicative of information stealer activity, specifically targeting behaviors observed with malware like VVS Stealer. It identifies instances where a non-browser process, originating from common user-writable or temporary directories (AppData, Temp, Downloads, Users\Public), first connects to an external IP discovery service (ipify.org) and then subsequently communicates with Discord services (discord.com or discordapp.com) within a ten-minute window. This pattern suggests that malware is collecting the victim's public IP address before exfiltrating stolen data (e.g., account or browser information) to Discord infrastructure, often used as a command and control or data exfiltration channel by stealers.
Detects the execution of inline C# code compilation, often used by malware like Remcos RAT, when initiated by PowerShell or a process with 'Remcos' in its parent's filename. This rule specifically looks for command-line arguments indicative of C# compilation (csc.exe, csc.compiler, CodeCompile, CompileAssemblyFromSource) in conjunction with suspicious initiating processes.
Detects a process creating both the PyArmor runtime module and Python 3.11 runtime library in user-writable locations. The component pairing is consistent with execution staging for the PyInstaller-packaged, PyArmor-protected VVS sample.
Detects the execution of inline C# code compilation, often used by malware like Remcos RAT, when initiated by PowerShell or a process with 'Remcos' in its parent's filename. This rule specifically looks for command-line arguments indicative of C# compilation (csc.exe, csc.compiler, CodeCompile, CompileAssemblyFromSource) in conjunction with suspicious initiating processes.
Detects PowerShell spawning csc.exe to dynamically compile and drop the uds.exe payload on the endpoint. This rule specifically looks for the creation of 'uds.exe' by a process that was initiated by 'csc.exe', which itself was spawned by 'powershell.exe'.
Detects compilation of delivered source code payloads to evade file-based detection
Detects compilation of delivered source code payloads to evade file-based detection
This rule detects the delivery of source code files (C, C++, C#, Java, Go, Rust) over HTTP to a client, specifically looking for content that includes 'main(' within the file data. This pattern suggests that a source code payload intended for compilation after delivery is being transferred, which could be indicative of malicious activity such as a staged attack where the attacker compiles and executes code on the victim's machine.
Page 1 of 3