Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
22 detections
Filters
Last updated
All Time
Detection languages
13
7
1
1
Contributors
7
6
3
1
1
Categories
12
5
3
2
2
Platforms
17
3
2
1
1
Products / Services
3
3
3
2
1
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the loading or execution of known SloppyRAT DLL samples. This malware is identified for its implementation of Hell's Gate-style indirect syscalls, utilizing techniques such as DJB2 API hashing and NTDLL stub parsing to evade EDR hooks. The rule monitors for specific file hashes and potential masquerading behaviors (e.g., hostfxr.dll) across image loading, file, and process events.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. Specifically, it looks for PowerShell command or script block execution events containing the string patterns "-bxor[int][char]$" and "[convert]::ToInt32", which are indicative of the custom XOR decryption and type conversion methods employed by this malware distribution framework.
Detects the unique PowerShell de-obfuscation sequence used by ErrTraffic ClickFix lures to drop follow-on payloads. This rule specifically looks for the combination of '-bxor[int][char]$' and '[convert]::ToInt32' within PowerShell command or script block execution events, which is characteristic of the ErrTraffic ClickFix malware distribution framework.
This rule detects the delivery of a stripped binary, specifically an executable (indicated by 'MZ' header) that has been packed or compressed using UPX (indicated by 'UPX' string). The rule triggers on HTTP traffic flowing to the client, suggesting a download or delivery of such a file. The 'Stripped Binary Delivered with Debug Info Removed' message implies an attempt to evade detection or analysis by removing debugging information, often associated with malware or unwanted applications.
This rule detects the execution of the 'strip' utility on Linux systems, when it is used on a file located in common temporary directories or user home directories. Adversaries may use 'strip' to remove symbols from compiled binaries, making reverse engineering more difficult and potentially reducing file size, which can aid in obfuscation or evasion.
Detects files that have extensions commonly seen while SDelete is used to wipe files.
The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.
Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
KQL Query from file: DefenderXDR Weekly OSINT Indicators Scan 10032025
Detects files that have extensions commonly seen while SDelete is used to wipe files.
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.
The CrachMapExec pentesting framework implements a PowerShell obfuscation with some static strings detected by this rule.
Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.
Looks for multiple users that had their admin role removed by a single user within a certain period.
Detects the use of rcedit to potentially alter executable PE metadata properties, which could conceal efforts to rename system utilities for defense evasion.
Detects the use of DefenderCheck, a tool to evaluate the signatures used in Microsoft Defender. It can be used to figure out the strings / byte chains used in Microsoft Defender to detect a tool and thus used for AV evasion.
'Looks for multiple users that had their admin role removed by a single user within a certain period.
The default threshold is 5 removals, this can be edited in the query.'
The default threshold is 5 removals, this can be edited in the query.'
This query visualises total emails with Malware detections over time summarizing the data daily by Delivery Location.
Detects the execution of DefenderCheck, a tool used to analyze Microsoft Defender signatures. This tool can be leveraged by adversaries to identify detection patterns and develop evasion techniques for their malware.
Page 1 of 2