Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
6 detections
Filters
Last updated
All Time
Detection languages
3
1
1
1
Contributors
2
1
1
1
1
Categories
3
1
1
1
1
Platforms
3
2
1
Products / Services
3
1
1
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the parsing of Mach-O headers for files with specific, potentially anomalous extensions. This is often used to identify masqueraded executables, unsigned binaries, or files with suspicious RPath configurations that may indicate malicious activity.
Detects the creation or modification of a file named 'maisum.dat' on endpoint devices. This filename is often associated with malicious activity, including malware persistence or configuration staging, and warrants investigation to determine the nature of the file and the process that created it.
This rule detects the delivery of an executable file over HTTP where the filename in the URI contains a space character immediately before the file extension '.exe'. This technique is often used by attackers to obfuscate the true file type or to bypass basic file type checks, making the file appear as a non-executable or a different file type to a casual observer or some automated systems. The rule specifically looks for the pattern '.exe ' (dot, exe, space) in the HTTP URI, case-insensitive.
Detects attempts to masquerade as legitimate files by adding a space to the end of the filename.
Detects the creation of a directory with a trailing space in its name (e.g., "C:\Windows \") using the NT path prefix `\\?\`. This technique was observed in a Remcos malware campaign in June 2025 to masquerade as a legitimate system directory like `C:\Windows\SysWOW64` to evade detection.
This rule detects attempts to masquerade as legitimate files on macOS by appending a space to the end of a filename. This technique can trick users and the operating system into executing a malicious file, despite a seemingly benign file extension. The rule specifically looks for process creation events where the command line or the image path ends with a space character.