Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
690 detections
Filters
Last updated
All Time
Detection languages
264
186
49
46
40
Contributors
172
97
71
63
41
Categories
370
145
94
90
85
Platforms
589
49
20
14
8
Products / Services
197
179
89
34
27
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects the execution of suspicious binaries (update.exe, AutoUpdater.exe) from a temporary directory, where the parent process is the Notepad++ updater (gup.exe). Notepad++ does not use these filenames for legitimate updates, and this behavior is indicative of a hijacked update process.
Detects the execution of a process named 'code.exe' or 'lightshot.exe' from a temporary directory.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
Detects the creation of executable files (.exe, .dll) in the `%TEMP%\Lightshot` directory. This directory is used as a staging area by the malicious fake Clawdbot VS Code extension to drop its payloads, including a weaponized ScreenConnect client.
Detects VIMC UNITY campaign trojan/loader: PE with Java Control Panel (javacpl.exe) abuse context, OpenJDK build path (javacplexec/javacpl.pdb), and behavioral strings (logs.txt, XClient.exe, shost.exe). Delivered via email lure VIMC UNITY --LUMUT PORT LAYTIME with attachment VIMC UNITY.gz.
Identifies Windows executable files signed by Hong Kong-based entities associated with IPIDEA's trojanized software distribution (e.g., masquerading as OneDriveSync or Windows Update).
This rule detects suspicious command-line activity involving 'conhost.exe' running in headless mode, combined with specific keywords often associated with malware or malicious scripts. The presence of '--headless' with other suspicious strings like 'svchost.exe', 'certutil -decode', common temporary directories, or specific file extensions/initiating processes (cmd.exe, powershell.exe, curl) suggests an attempt to execute hidden or obfuscated malicious code. This pattern is frequently observed in various stages of an attack, including execution, persistence, and defense evasion.
Detects the execution of a VBScript file named 'windows_api.vbs' from common public or appdata directories, a characteristic behavior of the GOGITTER malware as part of the Gopher Strike campaign.
Detects the execution of executables with names like 'Updater.exe' from suspicious paths in the AppData\Local directory, which are associated with fake PDF converter malware families like PDFClick, Easy2Convert, and ConvertMate.
Detects the use of a renamed Rclone binary to exfiltrate data via FTP. This technique was observed in a Lunar Spider intrusion where the actor used 'sihosts.exe' (a renamed rclone.exe) to copy files to an actor-controlled FTP server.
Detects the creation of abnormally large Windows shortcut (.lnk) files. This is a known TTP of APT36 (Transparent Tribe), who embed PDF content within LNK files to inflate their size and masquerade as legitimate documents to deceive users. The rule specifically looks for .lnk files with a size greater than 1MB.
Detects when legitimate .NET utilities, often abused for process hollowing, make outbound network connections. This is anomalous behavior and may indicate that the process has been injected with malicious code to bypass defenses.
This rule detects suspicious network connections to known malicious URLs associated with a Docker Desktop malware campaign. It also identifies instances where 'DockerDesktop.exe' is executed or present in unusual file paths, suggesting potential masquerading or unauthorized deployment outside of its standard installation directory. The rule is broken into three parts: network events, file events, and process events. The network part looks for connections to specific malicious domains. The file and process parts look for 'DockerDesktop.exe' in folders other than the assumed legitimate installation path, indicating potential malicious activity.
Detects the PeerBlight Linux backdoor masquerading as the '[ksoftirqd]' kernel thread. This is a defense evasion technique used by the malware to blend in with legitimate system processes.
Detects process execution from a deeply nested path containing a long sequence of underscores, a technique used by the ValleyRAT campaign to hide malicious components.
Detects a process executing from a temporary directory that masquerades as the legitimate 'systemd-logind' service. This behavior is characteristic of the V3G4 Mirai-derived botnet, which uses this technique to evade detection.
Detects the FormBook RAT persistence mechanism where it copies itself to a disguised location (%APPDATA%\Roaming\word\word.exe) and creates a registry run key named 'svchost.exe' to ensure execution at user login. The rule correlates the file creation and registry modification events on the same device within a short time window.
Detects persistence and execution artifacts associated with the Latrodectus malware. This includes the creation of a misspelled registry run key ('sentinelssheduler') and the execution of a payload masquerading as SentinelOne from a non-standard AppData path.
Detects malformed DNG/TIFF image files used to deliver the LANDFALL Android spyware. These files contain an appended ZIP archive which holds the malicious components.
Detects the creation of a scheduled task using the "-XML" flag with a file that does not have the '.xml' extension. This behavior is suspicious because it attempts to masquerade the XML configuration file, potentially as a defense evasion technique during persistence establishment. Adversaries might use this to hide their scheduled tasks from casual inspection.
Detects the creation of scheduled tasks using `schtasks.exe` where the command line arguments include names of common Windows system processes. This behavior can indicate an adversary attempting to masquerade a malicious scheduled task as a legitimate system process for persistence or privilege escalation.
Detects a PowerShell command line pattern used by Snake Keylogger to download and execute a payload. This pattern involves using Invoke-WebRequest to fetch a file and Start-Process to run it, often with parameters to hide the execution window. The rule also looks for execution from a temporary directory, a common malware technique.
Page 29 of 33