Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,465 detections
Filters
Last updated
All Time
Detection languages
1,884
1,282
329
251
239
Contributors
1,186
586
532
507
347
Categories
2,846
2,670
2,392
1,718
312
Platforms
4,410
153
89
34
21
Products / Services
1,183
1,146
1,042
668
277
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
4,465
CVEs
12
6
6
6
6
IDS Classtypes
20
7
2
1
1
IDS Protocols
22
5
3
1
This rule detects the execution of specific download utilities (curl, wget, aria2c, fetch, PowerShell, certutil, bitsadmin, mshta) attempting to download 'install.sh' from either 'clawd.bot' or 'openclaw.ai'. This activity is indicative of potential malware or unauthorized script downloads, possibly bypassing network security controls.
Detects a combination of suspicious registry persistence under the Microsoft TIP AggregateResults key and PowerShell launched with ExecutionPolicy Unrestricted referencing LunarApplication. Based on publicly described artefacts and intended for tuning and validation.
Detects ClickFix PowerShell payloads
Using a variety of known Command Patterns and Fake Messages
Using a variety of known Command Patterns and Fake Messages
Detects the use of a specific PowerShell command pattern using the '[adsiSearcher]' type accelerator to enumerate and count computer objects in Active Directory. This technique was observed being used for discovery in campaigns following the exploitation of CVE-2026-1731 (BeyondTrust).
Detects a specific obfuscated PowerShell command-line pattern used by the LunarApplication malware to execute scripts from the %TEMP% directory while bypassing execution policies. This rule looks for PowerShell processes with specific flags to bypass execution policy and accept piped input, combined with distinctive randomized script extensions (.yiz.ps1 or .unx.ps1) typically used by this malware.
Detects suspicious Windows process execution that may indicate post-exploitation activity, lateral movement, or privilege escalation. This is a generic detection rule for uncommon or high-risk commands and tools.
Detects a BeyondTrust (Bomgar) process spawning shell or system administration child processes. This activity is highly indicative of OS command injection, potentially related to the exploitation of CVE-2026-1731.
Detects the execution of 'cmd.exe' initiated by common Microsoft Office applications, scripting engines, or msiexec.exe, where the command line includes 'curl' for downloading a '.pdf' file and also attempts to delete files using 'del /s /q'. This behavior is often associated with initial access, download of malicious payloads, and cleanup activities by adversaries. The rule specifically looks for command lines that interact with 'Users\Public', 'conhost.exe', or use the '--headless' flag, which can indicate automated or background execution.
Detects suspicious child processes spawned by sqlservr.exe, potentially associated with Trigona threat actor activity.
This rule detects the execution of PowerShell, pwsh, mshta, or curl initiated by explorer.exe (specifically from the Run dialog) when the command line contains indicators of web requests, expression invocation, or encoded commands. This behavior is often associated with the 'ClickFix' social engineering technique, where users are tricked into running malicious one-liners from the Windows Run dialog. The rule looks for common PowerShell commandlets like 'Invoke-WebRequest', 'Invoke-Expression', or their aliases, as well as '-EncodedCommand' or methods like 'DownloadString' and 'FromBase64String', indicating an attempt to fetch and execute remote content or obfuscated commands.
This rule set detects attempts to download an 'install.sh' script from the domains 'clawd.bot' or 'openclaw.ai' using various methods. The first rule, 'openclaw_curl_install_script', specifically targets command-line tools like curl, wget, aria2c, and fetch. The 'openclaw_powershell_download' rule focuses on PowerShell commands (Invoke-WebRequest, iwr, Invoke-RestMethod, irm) used for downloading. The 'openclaw_aria2c_fetch_download' rule is redundant with the first rule, as it also targets aria2c and fetch. The 'openclaw_lolbin_download' rule identifies the use of Living Off The Land Binaries (LOLBins) such as certutil, bitsadmin, and mshta for the same download activity. Finally, the 'openclaw_http_install_sh' rule detects direct HTTP network requests to the 'install.sh' path on these domains. Collectively, these rules aim to identify potential initial access or execution attempts involving a suspicious installation script from specific domains.
This rule detects the execution of a specific command-line pattern associated with the KongTuke second-stage loader. It looks for 'conhost.exe' being run with '--headless', 'powershell', '-ep bypass', 'AzureRemove-NetNatStaticMapping.ps1', and 'AppActions' all present in the command line. This combination suggests the execution of a malicious PowerShell script, likely initiated via a scheduled task, as part of the KongTuke malware's persistence or execution mechanism.
This rule detects suspicious `conhost.exe` processes executing with the `--headless` argument and other indicators commonly associated with malware or malicious activity. The presence of `--headless` suggests an attempt to hide the console window, while additional command-line arguments like `svchost.exe`, `certutil -decode`, paths within `Users\Public` or `AppData`, and specific file extensions (`.ico`, `.png`) or keywords (`MRB_`, `DA_NEW_VER_`, `BOT`) further indicate potential compromise. The rule also looks for initiating processes like `cmd.exe`, `powershell.exe`, `curl`, or `start` which are often used to launch malicious payloads.
This rule detects the KongTuke second-stage PowerShell loader. It specifically looks for PowerShell scripts that attempt to read a payload from a file named 'Remove-NetNatStaticMapping.log', decrypt it using DPAPI (Data Protection API) via 'ProtectedData]::Unprotect' and 'DataProtectionScope]::Localmachine', and then execute the decrypted content using an 'iex' alias. The script also includes references to 'Add-Type -AssemblyName System.Security' and 'AppActions', indicating advanced PowerShell capabilities and potential interaction with application-related data. The use of 'ReadAllBytes' and 'UTF8.GetString' suggests the payload is read as raw bytes and then converted to a string for execution.
Detects instances where the Windows 11 Notepad process (Notepad.exe) spawns unexpected child processes. This behavior is a primary indicator of the CVE-2026-20841 exploitation via malicious Markdown links, which allows for remote code execution.
Detects XWorm V6 infection chain where wscript.exe spawns powershell.exe executing a .ps1 with Start-Process powershell
Detects PowerShell command lines that exceed a certain length of characters or more, which may indicate obfuscated or automated malicious activity. It also specifically looks for common PowerShell download and execution patterns within the command line.
Detects PowerShell command lines that exceed a certain length of characters or more, which may indicate obfuscated or automated malicious activity. It also specifically looks for common PowerShell download and execution patterns within the command line.
Detects ClickFix-style PowerShell payloads based on command-line patterns and fake error prompts.
Detects suspicious process execution patterns indicative of the ClickFix / CrashFix Python RAT. This rule specifically looks for 'finger.exe' or 'powershell.exe' with encoded or obfuscated commands, especially when initiated by common browser processes or explorer.exe, which aligns with social engineering techniques involving malicious copy-pasting.
This detection identifies a pattern associated with the 'ClickFix' social engineering technique, where a user is tricked into copying a malicious command and pasting it into a PowerShell terminal. The query correlates a recent clipboard operation with a subsequent suspicious PowerShell execution by the same user on the same device.
Page 151 of 213