Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
This YARA rule set detects various artifacts associated with the Remcos RAT 'ClickFix' campaign. The rules identify persistence mechanisms (registry run keys or scripts involving 'Shotcut video editor', '2120206', and 'shotcut.exe' for DLL sideloading), archive or path indicators ('2120206' and 'shotcut.exe'), clipboard scripts used for dropping malware related to the Shotcut DLL sideloading technique.
Detects a Microsoft Office application creating script files with GUID-like names in the user's profile directory. This is the primary method used by the "Operation MacroMaze" macro to drop its initial set of malicious scripts onto the victim's machine.
Detects instances where the Windows 11 Notepad process (Notepad.exe) spawns unexpected child processes. This behavior is a primary indicator of the CVE-2026-20841 exploitation via malicious Markdown links, which allows for remote code execution.
Detects cmd.exe execution using /c or /k with input redirection ("<") from a file, which is commonly abused to execute staged payloads, scripts, or configuration files without directly invoking them.
Detects suspicious child processes spawned by the SolarWinds Web Help Desk (WHD) service. This behavior was observed during the active exploitation of vulnerable WHD instances as reported by Microsoft.
This rule detects the execution of msiexec.exe from cmd.exe with command-line arguments indicating a silent installation of a remote MSI package over HTTP or HTTPS. This behavior is indicative of post-exploitation activity, specifically observed in the context of SolarWinds Web Help Desk (WHD) exploitation where attackers use msiexec to download and install malicious payloads.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key Living Off The Land Binary (LoLBin) technique used in the CrashFix campaign. The detection specifically looks for 'ct.exe' in the command line, the unique 'confirm@' argument indicating a C2 address, and the piping of output to 'cmd' often launched via 'start'.
This rule detects suspicious process creation patterns where a Java or Tomcat process (common in Ivanti EPMM) spawns a command shell (cmd.exe, bash, sh) or a process containing 'sliver' or 'implant' in its command line. This behavior is indicative of potential Remote Code Execution (RCE) abuse, particularly in the context of Ivanti EPMM vulnerabilities.
Detects the abuse of the Windows 'finger.exe' utility to download and execute commands, a technique observed in the CrashFix campaign. The rule looks for finger.exe (or its renamed variant 'ct.exe') piping output to cmd.exe.
This rule detects various activities associated with the ClawdBot campaign, which uses a fake VS Code extension to drop the ScreenConnect RAT. Detection logic includes suspicious network activity fetching malicious payloads (config.json, lightshot files, zoomupdate.msi) from known malicious domains or Dropbox, identification of known malicious file hashes, outbound connections to ScreenConnect C2 servers on port 8041, creation or start of ScreenConnect services, file dropping/staging in temporary directories, and execution of Code.exe or ScreenConnect binaries from temporary paths.
Detects the abuse of finger.exe as a download cradle, a technique used by the CrashFix campaign. This involves cmd.exe launching finger.exe (or a renamed copy) to retrieve a payload from a remote server and pipe it directly into cmd.exe for execution.
Detects HTTP POST requests to n8n webhook endpoints containing patterns associated with CVE-2026-25049, a type confusion vulnerability leading to Remote Code Execution. The detection looks for specific JavaScript destructuring or property access patterns used to bypass sanitization.
This rule detects a highly suspicious activity where the Notepad++ updater process (GUP.exe) spawns the Windows Command Shell (cmd.exe) to execute various reconnaissance commands. This behavior is specifically linked to the Chrysalis backdoor, which was involved in a supply chain attack targeting Notepad++. The presence of commands like 'whoami', 'tasklist', 'systeminfo', 'ipconfig', and 'net' (with user, view, or group arguments) indicates an adversary attempting to gather information about the compromised system and network.
Detects suspicious child processes spawned by Notepad++ updater (gup.exe) including cmd.exe with reconnaissance commands or scripting engines.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
Detects the SolarWinds Web Help Desk service process (java.exe or wrapper.exe) spawning shell processes or the MSI installer to download and execute remote payloads. This behavior is a key indicator of post-exploitation activity related to CVE-2025-26399.
Detects the execution of a command shell by the Java Runtime to run a batch file from a typical malware staging directory. This behavior is a core TTP of the Stan Ghouls group, used to execute their malicious Java-based loaders which in turn drop and run the NetSupport RAT.
Detects the legitimate Notepad++ updater (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was abused to download and execute malicious installers and command interpreters.
When a user opens a fake document in this attack, the document runs a script in the background. That script creates a batch file in a hidden temp folder. The folder structure is unusual: a temp folder inside another temp folder. The batch file has a random-looking name. Normal programs rarely create batch files in this way. Legitimate installers might use temp folders, but they do not typically create nested temp paths with batch files. The script that creates this file is started by the document, not by the user. Security teams should look for batch files being written to this specific path by a script process. This rule helps catch that staging step before the malware runs.
The malware used the legitimate curl.exe to upload data to temp[.]sh. This is a high-fidelity indicator as legitimate business processes rarely upload data to ephemeral pastebins via command line.
Detects the execution of a command shell by the Java Runtime to run a batch file from a typical malware staging directory. This behavior is a core TTP of the Stan Ghouls group, used to execute their malicious Java-based loaders which in turn drop and run the NetSupport RAT.
Page 62 of 74