Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
522 detections
Filters
Last updated
All Time
Detection languages
274
88
34
34
26
Contributors
144
82
54
25
22
Categories
350
258
247
69
63
Platforms
404
216
113
16
9
Products / Services
149
114
100
31
30
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
14
4
3
3
3
IDS Classtypes
7
2
1
1
IDS Protocols
11
Detects the download and staging of an official Python embedded runtime zip file from python.org into suspicious user-writable directories like %TEMP% or %LOCALAPPDATA%, followed by its extraction. This is a key staging technique used by malware like VOID#GEIST to ensure its scripts can execute regardless of the victim's environment.
Detects the creation or modification of Python scripts in the /unitree/etc/programming/ directory on Unitree Go2 robots. This activity is a strong indicator of exploitation of CVE-2026-27509 or CVE-2026-27510, where an attacker uploads a malicious script for remote code execution.
This rule detects the execution of PHP with command-line arguments indicative of web shells like 'aws.php' and 'file_save.php', which have been used in the exploitation of CVE-2026-1731. The detection looks for the use of eval with base64 decoding and specific, non-standard parameters used to pass commands.
This rule detects the execution of install scripts associated with 'OpenClaw' or 'Clawdbot' via various command-line interpreters. It specifically looks for commands involving 'curl', 'wget', 'bash', 'sh', 'zsh', 'pwsh', 'powershell', 'node', or 'npm' that contain specific URLs or package names related to the installation of these tools. This includes shell scripts like 'install.sh', 'install-cli.sh', PowerShell scripts like 'install.ps1', and npm installations like 'npm install -g openclaw'.
Detects a Node.js process spawning a Python windowless interpreter (pythonw.exe) from a temporary directory. This unusual process chain is a key indicator of the 'Contagious Interview' infection chain, where a portable Python runtime is dropped and executed.
Detects Claude Code spawning suspicious child processes, consistent with abuse of project configuration hooks or MCP initialisation commands.
Detects execution of specific Python scripts (modes.py, extentions.py, udp.pyw) using the windowless Python interpreter (pythonw.exe) from user-writable locations. This behavior is a strong indicator of ModeloRAT delivered via the CrashFix/ClickFix campaign using portable WinPython for stealth.
This rule detects the behavioral pattern of the dYdX RAT, which executes Python scripts from temporary directories with suppressed output. It looks for Python processes (identified by original filename) executing from common temporary directories while also suppressing output (e.g., redirecting to /dev/null or using CREATE_NO_WINDOW).
This rule detects Python processes that are executed with command-line arguments indicative of silent execution or output redirection to null devices, combined with execution from a temporary directory. This pattern was observed in the dYdX PyPI package compromise, where a RAT ran undetected using these techniques.
Detects Python executing pip installs for common Arkanix loader dependencies (requests, pycryptodome, psutil) as described in the report.
This rule detects suspicious Python execution patterns that are commonly abused by attackers. It looks for Python interpreters executing commands inline, from user-writable paths (like AppData, Temp, Downloads), or using suspicious modules/functions (requests, socket, subprocess, base64, ctypes, urllib, exec, eval). Additionally, it identifies Python processes that include indicators of downloading or installing tools (pip install, wget, curl, powershell, bitsadmin). The rule filters out common development tools and system accounts to reduce false positives.
This rule detects suspicious Python command-line executions that involve importing the 'requests' library, using 'exec()' for dynamic code execution, and making HTTP/HTTPS requests. This pattern is often observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
This rule detects Python scripts that use base64 decoding and execution, specifically looking for the 'import base64' statement appearing early in the file, followed by 'exec(base64.b64decode(' and ').decode('utf-8'))'. This pattern is indicative of a common method for obfuscating and executing malicious Python payloads, often seen in malware like KongTuke.
This rule detects various activities associated with the 'CrashFix' variant of the 'Clickfix' malware, which deploys a Python-based Remote Access Trojan (RAT). The detection logic covers several stages of the attack:
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects a Python process spawning pip to install multiple libraries (requests, pycryptodome, psutil) in a short time frame, a behavior associated with the Arkanix Stealer's Python loader.
This rule detects suspicious Python script execution masquerading as 'svchost.exe'. Specifically, it looks for 'svchost.exe' processes running from a user's profile directory that execute Python code containing 'import', 'requests', 'exec(', and references to 'http://' or 'https://' in the command line. This pattern is indicative of a Python-based malware or script attempting to download and execute additional code, potentially for command and control or further compromise, while trying to blend in with legitimate system processes.
This rule detects suspicious Python script execution via svchost.exe. Specifically, it looks for svchost.exe processes running from a user's profile directory that execute Python commands containing 'import', 'requests', 'exec(', and a URL (http:// or https://). This pattern is indicative of a Python interpreter being used to download and execute malicious code, potentially masquerading as a legitimate svchost process.
The rule detects the execution of 'run.exe' where its image path contains 'SoftwareProtectionPlatform' and its command line arguments include both 'SoftwareProtectionPlatform' and 'udp.pyw'. This specific combination is indicative of the KongTuke malware establishing persistence through a scheduled task named 'SoftwareProtection'.
Detects the execution of a Python interpreter that has been renamed to a common system process name, such as 'svchost.exe'. This is a known TTP used by malware like PXA Stealer to evade detection and blend in with normal system activity. The rule also attempts to correlate this activity with network connections to identify potential C2 communication.
Detects KongTuke Python payload or launcher from fake SoftwareProtectionPlatform - Image path must contain SoftwareProtectionPlatform and command line must reference udp.pyw or run.pyw. run.pyw SHA256 6afbe1f38351f6bfdd478240a4792e96f7e2789e5aaf02abbbe2c4c9a368f736, udp.pyw SHA256 efed49010d4da096af63c48a36fb4ca61ac05b4e553bdec6ed76b9590725a99c for correlation.
Page 22 of 25