Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the execution of PowerShell with execution policy bypass flags that simultaneously attempts to use curl.exe and Copy-Item to interact with suspicious remote domains or obfuscated command line arguments, potentially indicating a malicious payload delivery and staging attempt.
Detects the use of PowerShell to perform a web request to google.com to download a file named Document.pdf, followed by the immediate execution of that downloaded file using Start-Process.
The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines.
Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads.
This activity is uncommon in typical enterprise environments outside of software development contexts.
Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads.
This activity is uncommon in typical enterprise environments outside of software development contexts.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
This rule monitors network, file, and process telemetry for matches against a predefined list of malicious IP addresses, domain names, and file hashes. It flags suspicious network connections to known C2 infrastructure and the presence or execution of known malicious files based on SHA256 and SHA1 indicators.
Detects outbound network traffic from internal hosts directed toward identified Exvicy command-and-control (C2) infrastructure IP addresses. This includes both general beaconing attempts and established TLS handshake sessions potentially linked to post-ClickFix malicious activity.
This rule detects suspicious outbound network connections originating from processes frequently abused in the Exvicy/ErrTraffic ClickFix malware delivery chain, specifically powershell.exe, msiexec.exe, and putty.exe. It also monitors for direct communication to known C2 IP addresses associated with the Exvicy threat actor, providing coverage for both the initial payload delivery and post-compromise C2 phases.
Detects outbound network traffic from internal hosts to a domain associated with the VelvetCake fileless malware variant. The rule specifically looks for HTTP requests to 'p1o2i3u4y5t6r7e8w9q0.medianewsonline.com' using specific login parameters ('Areyou=cake', 'OKey=', 'Who='), which is indicative of command and control activity linked to the Konni actor group.
Detects the GHAPPIER four-stage loader execution chain initiated during npm postinstall processes. This rule monitors for malicious child process spawning (cmd, powershell, curl, wget) by node or npm, as well as the presence of specific markers like the '.git-checker' string or URLs associated with the PolinRider/FAMOUS CHOLLIMA npm supply chain campaign.
Detects outbound network traffic from internal hosts to known PIVOTPIPE-associated infrastructure, including attempts to access open directories for payload distribution and suspected Cobalt Strike command-and-control communications.
Detects network traffic associated with the GHAPPIER campaign using specific Vercel-hosted staging infrastructure. The rule monitors for requests to known malicious Vercel subdomains and identifying URI parameters often used for campaign tagging during beaconing or payload delivery.
Detects network traffic consistent with PIVOTPIPE command-and-control activity and potential Cobalt Strike beaconing to known malicious infrastructure on specific ports.
Detects network traffic associated with PIVOTPIPE Cobalt Strike beacon activity communicating with a known suspicious external IP address on port 8088. This includes generic TCP, HTTP-based beaconing, and TLS-encrypted C2 sessions.
Detects Node.js processes executing suspicious command lines that involve fetching and executing remote JavaScript code. This behavior is indicative of a loader or downloader script commonly used to pull and evaluate malicious payloads at runtime, specifically referencing indicators associated with 'GHAPPIER'.
This rule detects HTTP GET requests to a specific GitHub repository path (raw.githubusercontent.com/omskiwdcvoiuyfd0998/) identified as staging infrastructure associated with Konni/VelvetCake malware operations. This activity is indicative of a compromised host attempting to download malicious payloads or stage tools from actor-controlled infrastructure.
Detects the GHAPPIER loader identified across 65 public npm/GitHub repositories and 22 developer accounts, based on its embedded remote-fetch/eval pattern and campaign markers
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
This rule monitors for network connections to known malicious domains and IP addresses, as well as the presence or execution of files with specific SHA256 hashes known to be associated with threat activity. The indicators focus on Vercel-hosted domains and specific file hashes linked to recent campaign activity.
Detects the execution of PowerShell with hidden window style attempting to download Node.js related files (e.g., .msi or node.exe) from nodejs.org using common download cmdlets or utilities.
Detects the execution of PowerShell with hidden window style attempting to download Node.js related files (e.g., .msi or node.exe) from nodejs.org using common download cmdlets or utilities.
Page 27 of 121