Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
522 detections
Filters
Last updated
All Time
Detection languages
274
88
34
34
26
Contributors
144
82
54
25
22
Categories
350
258
247
69
63
Platforms
404
216
113
16
9
Products / Services
149
114
100
31
30
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
14
4
3
3
3
IDS Classtypes
7
2
1
1
IDS Protocols
11
Detects the execution of specific Python scripts (modes.py, extentions.py, or udp.pyw) using the silent pythonw.exe interpreter. This activity is associated with the ModeloRAT malware, which is used in the CrashFix campaign, indicating potential persistence or execution of malicious payloads.
Detects the execution of Python scripts associated with the ModeloRAT, such as modes.py, extentions.py, or udp.pyw. This activity is part of the CrashFix campaign, where attackers deploy a portable Python environment to ensure payload execution.
Detects the execution of Python scripts with names associated with the ModeloRAT, often launched from user AppData or Temp directories as part of the CrashFix campaign.
Detects a Python process, potentially renamed, injecting code into the InstallUtil.exe utility. This behavior is a known TTP used by a Vietnamese threat actor in PureRAT campaigns, where a Python loader fetches a payload and injects it into a legitimate .NET utility to execute shellcode and evade defenses.
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects the execution of a Python script with a specific command-line pattern used to inject AsyncRAT into memory. The pattern involves an input binary file, a key file argument, and a text file containing the key. This behavior is associated with a multi-stage AsyncRAT campaign.
Detects a Python process executing a binary from an in-memory file descriptor via the /proc filesystem. This technique was observed in the malicious 'sympy-dev' PyPI package, which used it to execute a cryptominer from memory, bypassing some file-based detections.
Detects the execution of a Python interpreter (python.exe or pythonw.exe), potentially renamed, from a non-standard, user-writable location.
This can be an indicator of a threat actor dropping a portable Python environment to execute malicious scripts, as seen in campaigns like AsyncRAT.
This can be an indicator of a threat actor dropping a portable Python environment to execute malicious scripts, as seen in campaigns like AsyncRAT.
This rule detects patterns indicative of cryptomining malware execution, specifically targeting those distributed via impersonated PyPI packages. It looks for Python processes exhibiting characteristics such as: 1. Command lines containing keywords related to mining, cryptocurrency, hashing, and mining pools. 2. Python processes making suspicious network connections to stratum+tcp or mining pools. 3. Python processes engaging in resource-intensive operations like multiprocessing or threading, often utilizing all available CPU cores. 4. Python processes executing obfuscated code, potentially involving base64, zlib, or gzip decoding, combined with network requests. The rule triggers if any of these conditions are met, or if a combination of suspicious network activity and resource-intensive behavior, or obfuscated execution and resource-intensive behavior, is observed.
Detects the execution of a Python script from a non-standard user directory, using command-line parameters consistent with a tool used for Asynchronous Procedure Call (APC) injection. This specific command was observed in an AsyncRAT campaign where a script named 'ne.py' was used to inject a payload ('new.bin') into the explorer.exe process.
Detects AI/ML model configuration files (e.g., config.json, model_config.yaml) containing a suspicious '_target_' value, which could indicate an attempt to exploit a Hydra instantiation vulnerability for remote code execution (RCE).
Detects when a WebKit-based browser process on macOS spawns a shell or script interpreter. This is highly suspicious and can indicate successful exploitation of a browser vulnerability for initial code execution.
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
Detects python.exe executing from an unusual directory (e.g., a user's 'Contacts' folder) and injecting code into a benign process like notepad.exe. This is a specific behavior observed in the SERPENTINE#CLOUD campaign, where a Python-based loader is used to execute shellcode in memory.
Detects the execution of a Python interpreter with suspicious characteristics, such as running from a temporary location or using command-line arguments associated with obfuscation and in-memory execution. This behavior is consistent with Python-based stealers like Xillen Stealer.
Detects Executables in the Downloads folder without FileVersion,Description,Product,Company likely created with py2exe
Detects the LANDFALL Android spyware components, specifically the 'b.so' loader and the 'l.so' SELinux policy manipulator.
This rule detects the execution of Python web servers via the command line interface (CLI) on Linux systems. Adversaries often use Python's built-in HTTP server modules (like `http.server` or `SimpleHTTPServer`) in post-exploitation scenarios to quickly establish a web server without needing to install additional software. This allows them to easily transfer files between a compromised host and attacker-controlled systems, facilitating data exfiltration or further payload delivery.
This detection identifies network connections to external DNS servers over TCP (port 53) initiated by common scripting engines like PowerShell, Python, or WScript. While DNS over TCP is a valid protocol, it is less common for standard queries and is often used by malware for command and control (C2) or data exfiltration through DNS tunneling.
This rule detects HTTP requests containing User-Agent strings associated with the UNC6395 data theft campaign targeting Salesforce instances.
Detects execution of python using the "-c" flag. This could be used as a way to launch a reverse shell or execute live python code. The rule filters out common legitimate uses of `python -c` by Python itself, pip, and VS Code.
Page 23 of 25