Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
840 detections
Filters
Last updated
All Time
Detection languages
353
219
61
54
37
Contributors
197
144
98
85
71
Categories
540
142
109
106
99
Platforms
700
78
24
23
18
Products / Services
277
188
102
61
35
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
840
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects suspicious child processes spawned by gup.exe, which is the Notepad++ updater. This behavior can indicate an attempt to hijack the update process for malicious purposes, such as executing arbitrary code or installing unwanted software. The rule specifically looks for gup.exe spawning common scripting/execution tools (update.exe, AutoUpdater.exe, curl.exe, cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe) or processes from temporary or user application data directories, while excluding legitimate explorer.exe and Notepad++ installer processes.
Detects the execution of 'AutoUpdater.exe' or 'update.exe' with the '/closeRunningNpp' flag. This specific behavior has been observed in hijacked Notepad++ update flows where a malicious binary masquerades as the legitimate updater. 'AutoUpdater.exe' is not a legitimate Notepad++ file.
Detects the execution of a Python interpreter that has been renamed to a common system process name, such as 'svchost.exe'. This is a known TTP used by malware like PXA Stealer to evade detection and blend in with normal system activity. The rule also attempts to correlate this activity with network connections to identify potential C2 communication.
Detects creation of hero proxyware files in SysWOW64 directory.
Detection content for the Notepad++ supply-chain compromise and the Chrysalis backdoor, attributed to Lotus Blossom. Detection rules use KQL only.
Detects the download of a file with a double extension (e.g., invoice.pdf.exe). This is a common technique used to disguise malicious files and trick users into executing them.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
This rule detects instances of 'Code.exe' (the executable for Visual Studio Code) running from non-standard or suspicious file system locations. It specifically flags processes originating from temporary directories (like \Temp or \AppData\Local\Temp), the ScreenConnect Client directory, or Program Files (x86) which are not typical installation paths for VS Code. The rule aims to identify potential masquerading or execution of malicious code disguised as VS Code.
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
Detects execution of BADAUDIO malware downloader used by APT24
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns where a .ini file extension is used to disguise an executable, which is then launched via cmd.exe.
Detects malware masquerading as the 'init' process to evade detection. This rule specifically looks for processes named 'init' that do not have an instance ID of '1' and are not located in the standard '/sbin/init' or '/usr/lib/systemd/systemd' paths. It also flags processes in suspicious temporary directories.
Detects processes that masquerade as the 'init' process, a technique used by the GoBruteforcer malware. The rule identifies processes named 'init' while filtering out legitimate system init processes based on their process ID, parent process ID, and executable path.
Detects Windows executable downloads with document or image file extensions, a common malware delivery technique
Detects processes with document file extensions spawning command shells (cmd.exe or powershell.exe), indicating malware execution
This detection aims to identify suspicious popup activity on devices by analyzing process events that launch notifications. The query focuses on detecting referrers that generate multiple unique popup URLs, which could indicate potentially malicious behavior.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
Detects cmd.exe spawning processes with document file extensions, indicating a PE binary masquerading as a document
Detects the PeerBlight Linux backdoor masquerading as the '[ksoftirqd]' kernel thread. This is a defense evasion technique used by the malware to blend in with legitimate system processes.
Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.
Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.
Detects Go runtime executing scripts from temporary directories, indicative of FlexibleFerret backdoor.
Page 32 of 40