Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
24 detections
Filters
Last updated
All Time
Detection languages
9
4
3
3
2
Contributors
6
3
3
3
3
Categories
13
10
8
4
4
Platforms
15
7
3
1
1
Products / Services
8
5
3
3
3
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
IDS Classtypes
2
IDS Protocols
1
1
Detects Python or Pip processes that download an image file from the network and subsequently write a native extension module (.pyd or .so) to the disk within a 10-minute window. This behavior is consistent with the extraction of a hidden malicious payload embedded within an image file using steganography.
Detects unsigned or non-standard Python processes loading core Windows system modules like kernel32.dll or ntdll.dll. This behavior is consistent with NarwhalRAT's fileless execution technique, which utilizes ctypes to interact with low-level Windows APIs (VirtualAlloc, RtlMoveMemory, CFUNCTYPE) for in-memory payload allocation and execution, bypassing traditional disk-based detection.
Detects the execution of PowerShell with encoded commands that include signs of web-based downloads or unusually long payloads, which are often used to hide malicious scripts or execute stagers. The rule filters out trusted signers and common administrative management tools to reduce noise.
This rule detects the execution of processes where the image path or parent process path originates from anonymous memory file descriptors ('/memfd:') or file descriptor links ('/proc/self/fd/'). These patterns are frequently associated with fileless malware execution where binaries are executed directly from memory to avoid disk-based detection.
Detects Log4Shell JNDI injection attempts
Detects a multi-stage in-memory .NET DLL loader chain where an executable from AppData\Roaming mimics legitimate software (TuglaInsaatci) to load malicious DLLs ('Optimax.dll' and 'System Optimizer Ultimate.dll') entirely in memory. This behavior is indicative of the FortiBleed steganographic loader campaign, which aims to evade disk-based security controls.
Detects Pay2Key ransomware's polyglot technique where a Batch script (e.g., setup.cmd) invokes PowerShell to read its own content and execute it in-memory via Invoke-Expression (IEX). This includes detection of 64-bit PowerShell invocation from 32-bit processes using Sysnative and command-line patterns indicative of self-referencing fileless execution.
Detects the in-memory execution of the MYRA RAT on Linux systems. The rule identifies suspicious process activity where a process masquerades as the legitimate 'systemd-userdbd' service, while utilizing memfd_create or related file descriptor paths (e.g., /proc/self/fd/ or /memfd:) to load and execute malicious code directly from memory, thereby avoiding traditional file-based detection.
Detects the execution of PowerShell with encoded commands that include signs of web-based downloads or unusually long payloads, which are often used to hide malicious scripts or execute stagers. The rule filters out trusted signers and common administrative management tools to reduce noise.
Detects suspicious fileless execution of PowerShell through a cmd.exe wrapper, specifically leveraging the sysnative path and targeting patterns associated with the Pay2Key ransomware's IEX loader, including specific command-line arguments like 'readalltext' and environment variable usage.
Detects the execution of a binary from the Linux shared memory directory /dev/shm.
This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.
This directory is a tmpfs mount backed entirely by RAM and is abused by attackers for fileless malware staging because files written there never touch physical disk and may evade disk-based detection.
Detects MYRA Linux RAT establishing cron-based persistence by scheduling /usr/local/lib/.cache-update.sh to execute every 13 minutes with a fileless fallback chain using memfd_loader and agent_launcher. Indicative of the apintergrationpost npm supply chain attack by threat actor kimijohn01.
Detects MYRA RAT fileless execution where memfd_loader or memfd_exec loads the Node.js binary and JavaScript agent bundle into anonymous memory file descriptors via memfd_create and executes via fexecve. Resulting processes show /proc/PID/exe pointing to '/memfd:.node (deleted)' or '/memfd:.bundle' with no files on disk.
Description: Detects the Stage 2 C2 tasking loop from the malicious Next.js developer-targeting campaign.Stage 2 spawns a child Node.js process and executes attacker-supplied JavaScript via STDIN ('-') or eval ('-e'), sourced from a parent Node process that previously beaconed to Vercel staging infrastructure. Trojanized assets involved include jquery.min.js and env-setup.js loaded from
known malicious repo structures.
known malicious repo structures.
This rule detects DNS queries for TXT records that contain a long, base64-encoded string, which could indicate a fileless payload being stored or retrieved via DNS. The rule specifically looks for TXT records with content matching a regular expression for base64-encoded strings of at least 80 characters.
This rule detects HTTP C2 traffic attempting to store a fileless payload in the Windows Registry. It specifically looks for HTTP responses (flow:to_client) containing the strings 'HKCU' (likely indicating a registry key path), 'powershell', and 'IEX' (Invoke-Expression), which are common indicators of PowerShell-based fileless malware using the registry for persistence or execution.
Detects phishing emails containing QR codes rendered using HTML tables. This technique is used to evade image-based scanning and OCR security controls by representing the QR code as a grid of small, colored table cells (<td>) instead of a traditional image file.
Detects the use of curl.exe to download content from a remote source and pipe it directly into PowerShell for execution. This is a fileless execution technique used by adversaries like Storm-0249 to bypass traditional file-based defenses.
This advanced hunting query detects CISA Alert (AA22-117A) 2021 Top Routinely Exploited Vulnerabilities https://www.cisa.gov/uscert/ncas/alerts/aa22-117a
'Looks for file uploads actions to Azure File and Blob Storage from known VPS provider network ranges.
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
This is not an exhaustive list of VPS provider ranges but covers some of the most prevalent providers observed.'
Finding base64 encoded PE files header seen in the command line parameters.
Tags: #fileLess #powershell.
Tags: #fileLess #powershell.
Page 1 of 2