Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
78 detections
Filters
Last updated
All Time
Detection languages
30
24
11
8
3
Contributors
19
15
14
5
4
Categories
33
22
22
22
21
Platforms
57
10
9
7
4
Products / Services
13
11
9
6
6
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
3
IDS Protocols
3
This rule detects specific JavaScript obfuscation patterns used by the Coruna exploit kit framework. The kit was observed being used by multiple threat actors, including UNC6353 and UNC6691. The rule looks for two distinct patterns in process command lines: a map/join/fromCharCode obfuscation pattern and an integer XOR obfuscation pattern, typically executed by JavaScript-enabled processes like web browsers or scripting hosts.
Detects the JavaScript XOR-based string reconstruction pattern used by the Coruna iOS exploit kit. This pattern maps an array of integers through String.fromCharCode with XOR to reconstruct code at runtime. Coruna contained 23 iOS exploits targeting iOS 13.0 through 17.2.1 and was used by UNC6353 (Russian espionage) and UNC6691 (Chinese financially motivated).
Detects the creation or modification of specific registry values (UXMP, UFID, UCID) in known Havoc C2 fallback registry paths (e.g., \SOFTWARE\Classes\Local Settings\Software\Microsoft\ and \SOFTWARE\Microsoft\SQMClient\) used by a modified Havoc Demon agent for C2 fallback and configuration.
Detects the execution of a shell command that decodes a base64 string and pipes the output directly into another shell for execution. This is a common obfuscation technique used by malware, including the AMOS stealer dropper delivered via malicious OpenClaw skills, to hide the initial payload.
Detects the execution of a PowerShell one-liner with obfuscation techniques characteristic of the MIMICRAT ClickFix campaign. This campaign tricks users into pasting a command that uses string manipulation and arithmetic to reconstruct and execute a malicious payload.
Detects the execution of a PowerShell command that reads a file's byte stream and performs a XOR operation on it. This technique is used by the KONNI APT group to decrypt and execute an embedded payload in memory, as seen in their 2026 campaign involving AI-generated backdoors.
Detects cscript.exe executing a JScript file using a legacy NTFS 8.3 shortname. This is a known technique used by Gootloader during its persistence phase to obfuscate the script's path and name.
Detection based on: https://malwaretech.com/2025/10/exif-smuggling.html
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
This rule detects suspicious PowerShell execution patterns that might indicate an 'Exif smuggling FileFix Technique' or similar obfuscated command execution. It specifically looks for 'conhost.exe' launching PowerShell ('powershell.exe', 'pwsh.exe', 'pwsh.dll') with an encoded command ('-e' or '-EncodedCommand'), containing more than 5 spaces, and including a UNC path. This combination of indicators suggests an attempt to execute obfuscated PowerShell code, potentially from a remote source.
The following analytic detects the creation of RAR Self-Extracting (SFX) files by monitoring the generation of file related to rar sfx .tmp file creation during sfx installation. This method leverages a heuristic to identify RAR SFX archives based on specific markers that indicate a combination of executable code and compressed RAR data. By tracking such activity, the analytic helps pinpoint potentially unauthorized or suspicious file creation events, which are often associated with malware packaging or data exfiltration. Legitimate usage may include custom installers or compressed file delivery.
KQL Query from file: PowerShell Self-Pwn
Finding base64 encoded PE files header seen in the command line parameters.
Tags: #fileLess #powershell.
Tags: #fileLess #powershell.
This query will detect encoded powershell based on the parameters passed during process creation. This query will also work if the PowerShell executable is renamed or tampered with since detection is based solely on a regex of the launch string.
'The query below identifies powershell commands used by the threat actor Mango Sandstorm.
Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/'
Reference: https://www.microsoft.com/security/blog/2022/08/25/mercury-leveraging-log4j-2-vulnerabilities-in-unpatched-systems-to-target-israeli-organizations/'
Detects suspicious PowerShell invocations using partial parameter names for common obfuscation techniques. This rule specifically looks for truncated forms of parameters like '-windowstyle hidden', '-NoProfile', '-NonInteractive', '-EncodedCommand', and '-ExecutionPolicy Bypass', which are frequently used by adversaries to hide their activity or bypass security measures.
This rule detects the Encoded01 ransomware based on specific byte patterns found within the malware's executable. The patterns correspond to functions involved in file enumeration, file encryption, and remote connection activities, which are characteristic behaviors of ransomware.
Page 4 of 4