Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
76 detections
Filters
Last updated
All Time
Detection languages
33
13
11
5
4
Contributors
23
13
7
7
6
Categories
45
38
14
12
10
Platforms
72
4
Products / Services
39
18
5
4
3
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
IDS Classtypes
4
IDS Protocols
2
1
1
Detects the execution of shortcut (.lnk) files located on removable media (USB) that spawn common Windows binaries (powershell.exe, cmd.exe, mshta.exe) with hidden window flags. This behavior is indicative of initial access or lateral movement techniques used by Mustang Panda (Earth Preta) for USB-based malware propagation and DLL side-loading.
Detects rapid creation of numerous .lnk shortcut files on removable media volumes, specifically targeting filenames that mimic common installers (e.g., ChromeSetup, AnyDesk). This behavior is characteristic of worm-like malware attempting to use removable drives for persistence and lateral movement by masquerading as legitimate software.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
Detects the two-stage execution chain associated with Raspberry Robin (Gamarue) propagation via removable media. The rule correlates the initiation of suspicious processes (msiexec.exe, rundll32.exe, or explorer.exe) from removable drive paths containing disguised DLLs or LNK files with subsequent obfuscated rundll32.exe execution command lines within a 30-minute window.
This rule detects the execution of RUSTYMOVE, a tool associated with the Transparent Tribe (APT36) threat group, which is used for propagation via removable media. It monitors for the specific executable 'Automata-20.exe', the presence of specific task-related command line arguments, the dropping of suspicious file paths, and PowerShell-based enumeration of connected USB/removable drives.
Detects the suspected RUSTYMOVE activity by identifying the creation of specific malicious files (ZIP and LNK) on the root directory of removable drives, followed by reconnaissance commands targeting removable media volumes.
Detects evidence of the RUSTYMOVE USB-propagation tool, associated with APT36 (Transparent Tribe). The rule identifies the creation of specific staged files (DriverInstaller.zip, DocScanner-11-Aug-2026-5-37pm.pdf.LNK) at the root of removable drives, as well as the creation of a 'log.txt' file on removable media that contains markers indicating successful file copying operations.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
Detects file creation on a removable drive followed by process execution from that drive shortly after mounting.
Detects file creation on a removable drive followed by process execution from that drive shortly after mounting.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
Page 1 of 4