Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,551 detections
Filters
Last updated
All Time
Detection languages
774
293
112
103
93
Contributors
493
267
209
73
60
Categories
1,319
1,227
492
174
155
Platforms
1,529
116
56
10
7
Products / Services
545
446
229
102
91
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
1,551
CVEs
8
6
4
4
4
IDS Classtypes
1
1
IDS Protocols
1
1
This detection monitors the execution of 7zG.exe—the 7-Zip GUI executable—specifically when launched from the Traiolx Custom Utils or Kilo Verfair Tools directory under the user’s Roaming profile (\\AppData\\Roaming\\Traiolx Custom Utils). It identifies suspicious command-line activity where 7zG.exe is used to decrypt or extract a file named drata.dat, used to load second payload.
Detects the addition of a member to a sensitive Active Directory group related to VMware administration (e.g., 'vSphere Admins', 'ESX Admins') using net.exe executed via WinRM (wsmprovhost.exe). This behavior is a key TTP used by threat groups like UNC3944 to escalate privileges and gain control over the vSphere environment after an initial compromise.
Identifies command prompt execution from browsers with suspicious parameters, indicating potential ClickFix attacks where users are tricked into running malicious commands.
Detects suspicious Windows Shortcut (LNK) files that exhibit characteristics of malicious activity, including execution of system binaries with suspicious arguments, in-argument script execution, or overlay content execution.
Analytic detect abnormal pattern of command and scripting interpreter followed by USB mount
This rule detects the execution of 'csc.exe' (C# compiler) when it attempts to create or interact with a file named 'App_Web_spinstall0.aspx'. This specific file name is often associated with web shell activity or malicious code compilation on web servers, particularly in the context of .NET applications. The rule aims to identify potential malicious compilation and execution of web-based backdoors or implants.
This rule detects exploitation attempts against SharePoint servers, specifically targeting CVE-2025-53770 (ToolShell). It has two parts: one for suspicious process creation (cmd.exe spawning powershell.exe from w3wp.exe) and another for malicious web request patterns in IIS logs (POST requests to /_layouts/15/ToolPane.aspx with specific query parameters and referrer).
Detects post-exploitation techniques used by the GoldMelody Initial Access Broker (also tracked as TGR-CRI-0045 and UNC961). This activity includes the use of a specific staging directory 'C:\Windows\Temp\111t' for custom tooling like 'updf.exe' for privilege escalation and 'txp.exe'/'txpm.exe' for port scanning.
KQL Query
Detects potential misuse of TryCloudflare tunnels for malware delivery or C2 communication by monitoring command-line arguments of common scripting and download tools. Adversaries leverage legitimate services like TryCloudflare to host malicious payloads and evade detection.
KQL Query
Detects the execution of the NightEagle APT group's Chisel-based malware, SynologyUpdate.exe, with specific command-line arguments indicating C2 communication and proxy functionality. This malware is used for internal network penetration and data exfiltration.
KQL Query from file: ClickFix_Registry_Related_Artefacts
KQL Query
KQL Query from file: Detecting External Microsoft Teams Spray
KQL Query from file: ANY.RUN Obfuscated BAT Dropper Delivers NetSupport RAT post
Detects the initial execution of FakeUpdates/SocGholish malware. This rule identifies scenarios where 'wscript.exe' is used as a parent process to execute a JavaScript file from the 'AppData\Local\Temp' directory, often containing 'update' and '.zip' in its command line, and subsequently spawns 'cmd.exe' or 'powershell.exe'. The presence of browser names in the parent command line further indicates a drive-by download infection vector.
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query
Detects the use of the "SET" internal command of Cmd.EXE with the /p flag followed directly by an "=" sign, often used with an append redirection operator ">>" to update file content indirectly. This technique can be used by attackers to append data to files, as demonstrated by the example: `cmd /c >> example.txt set /p="test data"` which appends "test data" to "example.txt". The rule specifically looks for `cmd.exe` executions containing `/c set /p=` or `"set /p=` or `>>*set /p=` in the command line.
Detects the execution of a malicious conhost.exe variant used by Havoc to inject its payload into cmd.exe, as described by Fortinet. This variant is typically found in the 'drivers' directory and launched with specific command-line arguments.
Page 67 of 74