Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
Detects indicators associated with the axios npm supply chain compromise by identifying suspicious payload execution (wt.exe in ProgramData) and persistence via the Windows Run registry key (MicrosoftUpdate). The rule triggers when either behavior is observed, providing visibility into potential post-compromise activity on Windows endpoints.
This detection identifies potential persistence and execution activity associated with a supply chain compromise involving a malicious npm package
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
This detection identifies potential persistence and execution activity associated with a supply chain compromise involving a malicious npm package
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
Detects when a process spawned by Microsoft Office or a web browser executes a child process.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
These actions can be indicative of malicious activity such as macro-based malware or drive-by downloads.
This rule correlates the creation of a potentially executable or script file by a browser or Microsoft Office application with its subsequent execution within a short time frame. This pattern is highly indicative of a user being tricked into downloading and running a malicious payload, often associated with initial access techniques like spearphishing with malicious attachments.
Detects the execution of multiple system reconnaissance commands concatenated into a single command line. This behavior is characteristic of the LAMEHUG malware, which uses LLMs to dynamically generate these command strings.
Detects the Cursor IDE process spawning shell interpreters or
network utilities. This behavior is associated with the CursorJack technique,
where a malicious Model Context Protocol (MCP) server configuration executes
commands for initial access or payload staging.
network utilities. This behavior is associated with the CursorJack technique,
where a malicious Model Context Protocol (MCP) server configuration executes
commands for initial access or payload staging.
Detects trojanized VPN processes spawning suspicious child processes (like rundll32, regsvr32, mshta, wscript, powershell, cmd) or writing RunOnce persistence in the registry, or loading malicious DLLs (dwmapi.dll, inspector.dll). The detection specifically targets processes signed by "Taiyuan Lihua Near Information Technology", which has been associated with Storm-2561 activity.
Detects the use of "net.exe" to mount a remote WebDAV share, where the command is recorded in the Explorer RunMRU registry key. This technique was observed in a recent ClickFix campaign for initial access.
Detects a specific script execution pattern where a batch file, often named 'rEgX.cmd', is read by a PowerShell process (or a renamed variant like 'mbs.exe') to extract a hidden, encrypted payload from its own content. This self-parsing technique, used by the Dead#Vax malware, looks for lines starting with a specific marker (e.g., '@') to bypass traditional file-based detection.
Detects the execution of Microsoft Edge via the command shell to open a PDF file. This pattern can be indicative of malicious activity where an attacker attempts to bypass direct execution or leverage a browser vulnerability to open a malicious PDF.
Detects a specific script execution pattern where a batch file, often named 'rEgX.cmd', is read by a PowerShell process (or a renamed variant like 'mbs.exe') to extract a hidden, encrypted payload from its own content. This self-parsing technique, used by the Dead#Vax malware, looks for lines starting with a specific marker (e.g., '@') to bypass traditional file-based detection.
Detects instances where PowerShell is used to read the contents of a batch file (specifically looking for '.cmd' or '.bat' extensions) to extract a payload. This logic focuses on the 'Get-Content' cmdlet being applied to a script file, which is a key component of the campaign's self-parsing and payload extraction mechanism, as seen in the Dead#Vax campaign.
Detects the execution of script interpreters (wscript.exe, cscript.exe, cmd.exe, powershell.exe) where the script file being executed resides on a newly mounted virtual disk volume (VHD, ISO, etc.).
This technique is used by malware, such as in the Dead#Vax campaign, to bypass the Mark-of-the-Web (MotW) security feature, allowing malicious files inside the container to execute without standard untrusted file warnings.
This technique is used by malware, such as in the Dead#Vax campaign, to bypass the Mark-of-the-Web (MotW) security feature, allowing malicious files inside the container to execute without standard untrusted file warnings.
This rule detects suspicious PowerShell activity that involves hidden windows, execution policy bypass, and attempts to download or execute files. It specifically looks for PowerShell processes launched by common parent processes like explorer.exe, cmd.exe, mshta.exe, wscript.exe, cscript.exe, or rundll32.exe, combined with command-line arguments indicative of stealthy execution and payload delivery. The rule identifies two main scenarios: 'Hidden Downloader and Execution' where PowerShell is used with hidden window styles and download commands, and 'Inline Launcher and Payload Delivery' where PowerShell is used with no profile and download/execution commands.
Detects the execution of specific batch scripts (hp.bat, hpp.bat, a.bat) used by the CL-UNK-1068 actor for host reconnaissance and information gathering.
Detects the full FakeGit infection chain: CMD/BAT launcher spawning LuaJIT with malicious payload argument.
Detects the Microsoft SharePoint worker process (w3wp.exe) spawning suspicious child processes often used for post-exploitation activity, such as command shells or scripting engines. This behavior is a strong indicator of a webshell execution, as seen in the ToolShell exploitation campaigns.
Detects the Apache ActiveMQ process (java.exe or wrapper.exe) spawning a command shell or web utility. This behavior is a strong indicator of post-exploitation activity following the exploitation of vulnerabilities like CVE-2023-46604, often used as an entry point for ransomware like LockBit 5.0.
Page 60 of 74