Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
690 detections
Filters
Last updated
All Time
Detection languages
264
186
49
46
40
Contributors
172
97
71
63
41
Categories
370
145
94
90
85
Platforms
589
49
20
14
8
Products / Services
197
179
89
34
27
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects files associated with the ClipXDaemon malware campaign based on their SHA256 hashes.
Detects the loading of malicious DLLs (e.g., "propsys.dll", "batmeter.dll") by legitimate Windows binaries ("Fondue.exe", "mblctr.exe", etc.) from non-standard, user-writable locations.
This behavior is a key tactic of the Dohdoor malware campaign, where threat actors copy trusted executables and a malicious payload to a staging directory like "C:\ProgramData\" to perform DLL sideloading.
This behavior is a key tactic of the Dohdoor malware campaign, where threat actors copy trusted executables and a malicious payload to a staging directory like "C:\ProgramData\" to perform DLL sideloading.
Detects svchost.exe spawning a shell process (cmd.exe or powershell.exe) where its parent is not the legitimate services.exe. This behavior is a known technique used by Moonrise RAT to proxy commands and evade detection. The rule further scopes to commands targeting temp or public directories, which are common malware staging areas.
Detects processes on Linux systems that exhibit fileless execution characteristics while masquerading as common shells or interpreters. This behavior is a key TTP of the ShadowHS post-exploitation framework, which uses argv spoofing and in-memory execution to evade detection.
Detects the creation of a Ruby runtime environment in unusual ProgramData subdirectories and the renaming of the Ruby interpreter to masquerade as a USB utility, a technique used by APT37's SNAKEDROPPER malware. Specifically looks for file events in 'C:\ProgramData\usbspeed' or 'C:\ProgramData\ruby3' where the filename is 'usbspeed.exe' or the previous filename was 'rubyw.exe'.
Detects standalone execution of the malicious NCrypt.dll using rundll32.exe with its exported ordinal #1, a behavior observed in sandbox analysis that bypasses standard NuGet loading.
Detects the execution of executables that masquerade as common collaboration tools (e.g., Teams, Zoom, Adobe) but have characteristics of the TrustConnect RAT. TrustConnect uses large (approx. 35MB) .NET Core single-file executables where the internal/original filename is a .dll, which is a mismatch from the .exe process name.
This rule detects the creation or modification of specific files associated with the SHub v2.0 infostealer on macOS. It looks for a fake 'GoogleUpdate' binary within the '~/Library/Application Support/Google/' directory or a LaunchAgent plist file named 'com.google.keystone.agent.plist' in the 'LaunchAgents/' directory. These file paths are indicative of the SHub stealer's persistence mechanism, which impersonates legitimate Google update components.
Detects processes masquerading as legitimate software making HTTP requests to specific API endpoints associated with the TrustConnect/DocConnect RAT C2.
This rule detects the dropping of specific DLL files associated with OysterLoader malware within the 'AppData\Roaming' directory. The detection logic specifically looks for file creation events where the target filename contains 'AppData\Roaming' and one of the following strings: 'COPYING3.dll', 'VisualUpdater', 'AlphaSecurity', or 'DetectorSpywareSecurity'. This activity is indicative of a stage 3 drop by OysterLoader before a scheduled task is created, as detailed in a Sekoia report.
Detects Remcos RAT payload drop - zip archive saved with .pdf extension (2120206.pdf) in user Temp. Requires known SHA256 to avoid false positives from arbitrary .pdf files; use field name your backend provides (e.g. FileHash, Hash, SHA256).
Detects the creation of specific .sys files in the C:\Windows\System32\drivers\ directory. These filenames are used by the BADIIS malware installer to stage malicious DLLs before they are moved to other locations for execution.
Detects the execution of executables that masquerade as common collaboration tools (e.g., Teams, Zoom, Adobe) but have characteristics of the TrustConnect RAT. TrustConnect uses large (approx. 35MB) .NET Core single-file executables where the internal/original filename is a .dll, which is a mismatch from the .exe process name.
This rule detects suspicious `conhost.exe` processes executing with the `--headless` argument and other indicators commonly associated with malware or malicious activity. The presence of `--headless` suggests an attempt to hide the console window, while additional command-line arguments like `svchost.exe`, `certutil -decode`, paths within `Users\Public` or `AppData`, and specific file extensions (`.ico`, `.png`) or keywords (`MRB_`, `DA_NEW_VER_`, `BOT`) further indicate potential compromise. The rule also looks for initiating processes like `cmd.exe`, `powershell.exe`, `curl`, or `start` which are often used to launch malicious payloads.
Detects the creation of files with a .sys extension in the C:\Windows\System32\drivers\ directory that are actually portable executables (DLLs/EXEs). This is a staging technique used by the REF4033 group to deploy the BADIIS malware.
This rule detects suspicious Python script execution masquerading as 'svchost.exe'. Specifically, it looks for 'svchost.exe' processes running from a user's profile directory that execute Python code containing 'import', 'requests', 'exec(', and references to 'http://' or 'https://' in the command line. This pattern is indicative of a Python-based malware or script attempting to download and execute additional code, potentially for command and control or further compromise, while trying to blend in with legitimate system processes.
This rule detects suspicious Python script execution via svchost.exe. Specifically, it looks for svchost.exe processes running from a user's profile directory that execute Python commands containing 'import', 'requests', 'exec(', and a URL (http:// or https://). This pattern is indicative of a Python interpreter being used to download and execute malicious code, potentially masquerading as a legitimate svchost process.
Detects the execution of msiexec.exe to install an MSI package with a naming convention characteristic of the GS7 threat actor. GS7 uses specific, automated naming conventions for their malicious RMM installers, such as 'em_[8 alphanumeric]_installer' or 'Win_[18-20 digits]_installer'.
Detects Notepad++ installer and portable files where the file hash does not match a list of known legitimate hashes. This could indicate a malicious file masquerading as Notepad++.
Detects suspicious child processes spawned by gup.exe, which is the Notepad++ updater. This behavior can indicate an attempt to hijack the update process for malicious purposes, such as executing arbitrary code or installing unwanted software. The rule specifically looks for gup.exe spawning common scripting/execution tools (update.exe, AutoUpdater.exe, curl.exe, cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe) or processes from temporary or user application data directories, while excluding legitimate explorer.exe and Notepad++ installer processes.
Detects the execution of 'AutoUpdater.exe' or 'update.exe' with the '/closeRunningNpp' flag. This specific behavior has been observed in hijacked Notepad++ update flows where a malicious binary masquerades as the legitimate updater. 'AutoUpdater.exe' is not a legitimate Notepad++ file.
Page 28 of 33