Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
This rule detects the execution of msiexec.exe with command-line arguments indicating a silent installation (`/q`, `/i`) and the download of an MSI package from a remote HTTP or HTTPS source. The detection specifically looks for this activity when the parent process is cmd.exe, and the grandparent process is java.exe, which is associated with SolarWinds Web Help Desk exploitation (CVE-2025-26399, CVE-2025-40551). This pattern suggests post-exploitation payload delivery via MSI from a compromised Java process.
This query hunts for the specific "reconnaissance batch" behavior observed in this campaign: a process piping netstat, systeminfo, or tasklist output into a text file (specifically a.txt as seen in the report, though looking for any single-letter text file is a good heuristic).
This rule looks for the GUP.exe process (the legitimate updater) spawning unexpected child processes like cmd.exe or the known malicious AutoUpdater.exe.
Detects creation and/or attempted execution of C:\ProgramData\CertificationKit.ini, a staging path observed in MuddyWater VBA dropper activity. This rule correlates file creation with suspicious execution attempts (cmd.exe referencing the INI path) on the same host within a short window to increase fidelity.
Detects the spawning of a Windows command shell, powershell, or reconnaissance tools by the IIS worker process (w3wp.exe). This behavior is a strong indicator of a successful web application exploit, such as the deserialization vulnerability in WSUS (CVE-2025-59287), where an attacker gains remote code execution. Also detects the WSUS Service as the parent process spawning another process.
This rule detects activity associated with the 'ClawdBot' campaign, which involves dropping the ScreenConnect Remote Access Trojan (RAT) via a fake VS Code extension. It identifies suspicious network connections to known malicious domains or Dropbox (when initiated by Code.exe), known malicious file hashes, outbound connections to ScreenConnect C2 ports, creation or start of ScreenConnect services, file drops in temporary directories related to ScreenConnect or Lightshot, and execution of Code.exe or ScreenConnect binaries from temporary folders. It also looks for initial payload downloads from attacker command and control infrastructure.
Detects the multi-stage DEAD#VAX infection chain by correlating the creation of a specific batch file artifact with subsequent execution, persistence, or process injection activities.
Detects the Notepad++ updater (gup.exe) spawning suspicious child processes such as shells or network tools. Legitimate updates should only spawn explorer.exe or the Notepad++ installer itself. This behavior has been observed in targeted attacks where the update process is hijacked to deliver malware and facilitate hands-on-keyboard activity.
Detects the Quest Desktop Authority agent service spawning suspicious child processes. This activity could be an indication of exploitation of CVE-2025-67813, where an attacker leverages the 'AdminExec' operation to achieve remote code execution as SYSTEM.
Detects the use of the finger.exe utility to download remote data and pipe it directly into a command interpreter for execution. This LOLBin technique is used by threat actors like KongTuke to download and execute subsequent stages.
This rule detects the execution of specific child processes (write.exe, cmd.exe) when initiated by a predefined list of parent processes (Sang.exe, googleupdate.exe, vlc.exe, clreg.exe, Nlasvr.exe, qutppy.exe) and when the parent process command line contains certain keywords ('install', 'work', 'passuac'). This pattern can indicate suspicious activity, potentially related to malware installation, persistence, or command and control.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, etc.) spawns a suspicious child process (like cmd.exe or powershell.exe) from a document located in a configured Office Trusted Location. While trusted locations are meant to bypass macro security warnings, the subsequent spawning of shell processes is a strong indicator of malicious macro execution for post-exploitation activities.
This rule detects behaviors associated with HoneyMyte post-exploitation scripts. Specifically, it looks for `curl.exe` or `curl` being used to download executables or files into 'Libraries' or 'Public' directories. It also identifies executables named `getlogindata.exe` or `getlogindataedge.exe` when their command line arguments contain 'Login Data' or 'Local State', indicating browser credential theft. Additionally, it detects `powershell.exe` or `cmd.exe` command lines that include keywords related to HoneyMyte's exfiltration methods (e.g., 'pixeldrain', 'PIXELDRAIN', '113.23.212', 'log.dat', 'nbtscan').
Detects the IIS worker process (w3wp.exe) spawning a command-line interpreter or reconnaissance tool. This is a common behavior of web shells and in-memory backdoors like IIServerCore, which is part of the NET-STAR malware suite used by the Phantom Taurus APT group.
Detects the SmarterMail service process ('MailService.exe') spawning command-line interpreters to execute reconnaissance commands. This behavior is highly indicative of remote code execution following the exploitation of vulnerabilities like CVE-2026-23760.
Pulsar RAT is a derivative of Quasar RAT with extensive functionality including keylogging, cryptocurrency wallet clipping, credential theft, file management, remote shell execution, and data exfiltration capabilities. As a modular, open-source remote administration tool designed for Windows systems, Pulsar introduces significant enhancements over its predecessor.
This rule detects the creation of a hidden command shell by the 'pdf24.exe' process, a behavior associated with the PDFSIDER malware. Specifically, it looks for 'cmd.exe' being spawned with the '/c' argument by 'pdf24.exe'.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Detects the initial VBScript loader used in Turla's Kazuar v3 campaign. The loader script (8RWRLT.vbs) is executed via wscript.exe and creates a folder structure mimicking HP printer drivers at %LOCALAPPDATA%\Programs\HP\Printer\Driver. The script downloads multiple files from a remote C2 server including hpbprndi.exe (a legitimate signed HP driver), hpbprndiLOC.dll (the actual Kazuar loader), and encrypted payload files (jayb.dadk, kgjlj.sil, pkrfsu.ldy). The loader uses WinHttp.WinHttpRequest.5.1 COM object to download files while ignoring SSL certificate errors, and establishes persistence by creating a registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. This rule specifically looks for wscript.exe processes with command lines containing both the HP printer driver path and hpbprndi references, which are strong indicators of the Kazuar v3 loader execution.
Detects when a Python process spawns a shell or a network utility. This behavior can be indicative of Remote Code Execution (RCE) vulnerabilities being exploited in AI/ML libraries (e.g., CVE-2025-23304, CVE-2026-22584) that allow attackers to execute arbitrary code when a malicious model file is loaded.
Detects suspicious commands written to the Windows RunMRU registry key, which stores the history of commands executed via the Windows Run dialog (Win+R). This activity is often associated with the "ClickFix" social engineering technique, where users are tricked into pasting and running malicious commands. The rule identifies various suspicious indicators, including fake verification messages, PowerShell commands with obfuscation or download cradles, mshta, wscript, curl, wget, rundll32, bitsadmin, ssh proxy abuse, and obfuscated command line arguments.
Page 63 of 74