Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
598 detections
Filters
Last updated
All Time
Detection languages
274
151
44
40
37
Contributors
178
108
44
42
30
Categories
404
399
199
85
66
Platforms
574
6
5
5
3
Products / Services
209
176
96
36
29
MITRE Techniques
18,123
15,639
12,580
8,394
6,215
CVEs
3
1
1
1
IDS Classtypes
3
IDS Protocols
2
1
Detects various initial access TTPs associated with the "ClickFix" attack vector, where users are tricked into running malicious commands. This includes behaviors observed in Lumma Stealer, Latrodectus, and NetSupport RAT campaigns.
KQL Query
Generic rule content from file: LOLBAS - Execution - Outbound Traffic to Suspicious TLD
KQL Query from file: Detecting Blind Eagle APT-C-36
KQL Query from file: TA4557 drops More_Eggs
KQL Query from file: Email Campaign - Exploiting SVG Files and trycloudflare.com to Spread Malware
Detects initial execution patterns and stealer activities used by KimJongRAT PE and PowerShell variants, including LNK/HTA execution, certutil decoding, rundll32 execution, and PowerShell-based data collection.
KQL Query from file: Golden Chickens TerraStealerV2 Malware Detection
KQL Query from file: BlueAlpha GammaDrop Detection
Detects the execution of mshta.exe to fetch and run remote scripts, a technique used by TAG-140 for initial access and loading the BroaderAspect loader and DRAT V2. This activity is often initiated via social engineering lures.
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
Adwind RAT / JRAT
Sigma
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Detects wscript/cscript executions of scripts located in user directories
Detects a potentially suspicious parent of "csc.exe", which could be a sign of payload delivery.
'Detects potentially malicious Visual Studio Code (VSCode) extensions installed on a users system, which threat actors might use to control devices and exfiltrate personal information.
Ref: https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/'
Ref: https://blog.checkpoint.com/securing-the-cloud/malicious-vscode-extensions-with-more-than-45k-downloads-steal-pii-and-enable-backdoors/'
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Detects potential process and execution activity related to APT10 Cloud Hopper operation
Detects a suspicious child process of a Microsoft HTML Help (HH.exe)
Detects potential SquiblyTwo attack technique with possible renamed WMIC via Imphash and OriginalFileName fields
Detects a suspicious execution of a Microsoft HTML Help (HH.exe)
Detects javaw.exe in AppData folder as used by Adwind / JRAT
Page 25 of 29