Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
78 detections
Filters
Last updated
All Time
Detection languages
30
24
11
8
3
Contributors
19
15
14
5
4
Categories
33
22
22
22
21
Platforms
57
10
9
7
4
Products / Services
13
11
9
6
6
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
IDS Classtypes
3
IDS Protocols
3
Detects DLLs potentially associated with the 'Lorem Ipsum Loader' malware family. These DLLs are designed to sideload into legitimate applications and contain embedded shellcode that is encoded as a sequence of English words to bypass entropy-based detection. The rule looks for the presence of the word-encoded blob alongside specific filenames commonly used in this sideloading technique.
For years, when hunting phishing emails, I have mainly focused on what the user sees inside of it. But I think AI agents are going to change this.
An email may soon have two audiences: Human + AI Agent. And they may not always see exactly the same thing.
In this new KQL, I explore a simple example: invisible Unicode characters. Microsoft and Micro<U+200B>soft may look the same to us, but not necessarily to a detection, filter, parser or AI agent. For attackers, this difference can be interesting as a way to obfuscate content and potentially evade keyword-based detections or other systems processing the text.
I hunt these patterns in email and add context around them. Because attackers will not only write emails for us. They will(are) start writing emails for our agents too.
An email may soon have two audiences: Human + AI Agent. And they may not always see exactly the same thing.
In this new KQL, I explore a simple example: invisible Unicode characters. Microsoft and Micro<U+200B>soft may look the same to us, but not necessarily to a detection, filter, parser or AI agent. For attackers, this difference can be interesting as a way to obfuscate content and potentially evade keyword-based detections or other systems processing the text.
I hunt these patterns in email and add context around them. Because attackers will not only write emails for us. They will(are) start writing emails for our agents too.
This rule detects potential HTML smuggling activity by identifying a browser process writing an executable file named 'config.exe' to the user's Downloads folder without a traditional network download event, followed immediately by Microsoft Defender SmartScreen or Antivirus reporting a warning or scan failure on the file. This behavior is indicative of a payload being reconstructed on the client-side via JavaScript blobs or data URLs, which is a common characteristic of HTML smuggling delivery chains.
This rule detects potential HTML smuggling activity by identifying a browser process writing an executable file named 'config.exe' to the user's Downloads folder without a traditional network download event, followed immediately by Microsoft Defender SmartScreen or Antivirus reporting a warning or scan failure on the file. This behavior is indicative of a payload being reconstructed on the client-side via JavaScript blobs or data URLs, which is a common characteristic of HTML smuggling delivery chains.
Detects attempts to bypass AI agent safety guardrails by using obfuscated payloads (Base64/hex) or known jailbreak/roleplay trigger phrases. The rule specifically monitors sequences where an initial prompt is blocked by safety filters and is immediately followed by a structurally similar, potentially re-encoded prompt that is subsequently allowed, indicating an active filter evasion attempt.
Detects the reflectively-loaded SectopRAT .NET payload by its combination of heavy calli (indirect call) opcode usage for control-flow flattening and its characteristic runtime string-decryption helper method used to resolve the C2 IP/port and other obfuscated strings
This rule detects the execution of a file named 'setup.exe' that is spawned by common interpreters (explorer.exe, msiexec.exe, powershell.exe, cmd.exe) where the command line arguments reference archiving or compression utilities like 'foobar2000', '7z', or '7zip'. This is a common pattern for self-extracting (SFX) installers or malicious droppers attempting to execute payload components.
Detects the reflectively-loaded SectopRAT .NET payload by its combination of heavy calli (indirect call) opcode usage for control-flow flattening and its characteristic runtime string-decryption helper method used to resolve the C2 IP/port and other obfuscated strings
Detects the reflectively-loaded SectopRAT .NET payload by its combination of heavy calli (indirect call) opcode usage for control-flow flattening and its characteristic runtime string-decryption helper method used to resolve the C2 IP/port and other obfuscated strings
Detects the reflectively-loaded SectopRAT .NET payload by its combination of heavy calli (indirect call) opcode usage for control-flow flattening and its characteristic runtime string-decryption helper method used to resolve the C2 IP/port and other obfuscated strings
Detects the PIVOTPIPE .NET loader, which identifies and extracts a 'core.pak' file containing the RAT payload. The loader performs XOR-decoding and GZIP-decompression to reflectively load the malicious payload into memory using .NET reflection methods, bypassing traditional file-based execution.
Detects HTML smuggling files identified as 'FlipBook' lures, commonly used in device-code phishing campaigns. These lures utilize client-side JavaScript for AES-GCM decryption, extensive comment-based obfuscation, and specific junk-padding techniques to bypass security controls and trick users into providing credentials.
Detects the execution of command-line sequences associated with the second stage of ClickFix-style malware (often linked to AMOS or fake-Xcode campaigns). This rule looks for the concatenation of hex decoding (xxd), AES decryption (openssl), decompression (gunzip), and subsequent evaluation (eval) of a shell variable, which is a signature pattern for decrypting and executing malicious payloads in memory.
Detects malicious JavaScript/npm payloads that attempt to evade static analysis and string-based detection signatures by dynamically reconstructing sensitive strings at runtime using V8 string-object construction or obfuscated string tables.
Detects the execution of PowerShell scripts that utilize a multi-stage deobfuscation and loading technique. The script decrypts a staged payload using AesManaged (with specific hardcoded byte constants), decompresses the result via GZipStream, and uses [System.Reflection.Assembly]::Load to reflectively execute the resulting .NET assembly in memory. This pattern is characteristic of advanced malware loader chains, such as those used by the 'LausivLoader'.
Detects the execution of command-line sequences associated with the second stage of ClickFix-style malware (often linked to AMOS or fake-Xcode campaigns). This rule looks for the concatenation of hex decoding (xxd), AES decryption (openssl), decompression (gunzip), and subsequent evaluation (eval) of a shell variable, which is a signature pattern for decrypting and executing malicious payloads in memory.
Detects the execution of command-line sequences associated with the second stage of ClickFix-style malware (often linked to AMOS or fake-Xcode campaigns). This rule looks for the concatenation of hex decoding (xxd), AES decryption (openssl), decompression (gunzip), and subsequent evaluation (eval) of a shell variable, which is a signature pattern for decrypting and executing malicious payloads in memory.
Detects the execution of command-line sequences associated with the second stage of ClickFix-style malware (often linked to AMOS or fake-Xcode campaigns). This rule looks for the concatenation of hex decoding (xxd), AES decryption (openssl), decompression (gunzip), and subsequent evaluation (eval) of a shell variable, which is a signature pattern for decrypting and executing malicious payloads in memory.
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
Detection of specific indicators associated with the GhostCode phishing kit, including scripts utilizing PBKDF2/AES-GCM for redirection decryption and a characteristic URL path pattern (/scanna/).
Detects Koktevrat Stage 2 Android RAT component (com.kowo.ciligeci) that unpacks the RC4-encrypted uoN.css/uoN.apk payload using the RC4 key iOZ
Page 1 of 4