Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects network communication to domains and specific file paths associated with the MacSync macOS stealer, which is used for malware dropper delivery and command-and-control (C2) operations. The rule monitors DeviceNetworkEvents for indicators such as specific malicious URLs, iCloud path abuse, and C2 infrastructure interaction.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects the execution of the Lightlife RAT via a PowerShell script named 'lightlife.ps1'. The rule monitors for processes running from the LOCALAPPDATA directory, the use of PowerShell with execution policy bypass and hidden window style, or execution triggered via common scripting hosts like wscript.exe or mshta.exe combined with PowerShell download cmdlets.
Detects outbound network traffic and subsequent inbound responses associated with AsyncRAT command and control (C2) communication. This rule monitors connections directed toward a specific hardcoded IP address known to be associated with AsyncRAT activity.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects PowerShell or PowerShell ISE spawned directly from Windows Explorer (explorer.exe, covering both Start-menu launches and the Run dialog abused by ClickFix) whose command line carries a genuine obfuscation/evasion signal - true -EncodedCommand/-e usage, a hidden/minimized window flag, or a remote download cradle (IEX, Invoke-WebRequest, DownloadString, certutil, mshta, etc.) - while excluding invocations that point at an on-disk script file under a standard install path, since ClickFix payloads are inline one-liners rather than references to a local .ps1. Bare -NoProfile/-NoLogo flags no longer trigger alone, since they are common in legitimate automation.
This rule detects potentially malicious child processes spawned by processes associated with Microsoft Semantic Kernel agents. These agents may be exploited to execute administrative tools, living-off-the-land binaries (LOLBins), or networking utilities commonly used in post-exploitation activities, such as credential dumping, discovery, or command execution.
This rule detects the execution of suspicious command lines involving 'evilsocket/nyx' and the use of 'iex' (Invoke-Expression) within PowerShell or common download utilities (curl, wget). It also correlates this with network connections to 'raw.githubusercontent.com' fetching 'nyx.ps1', which is a common pattern for downloading and executing malicious scripts in memory.
Detects the execution of PowerShell commands that reference the 'nyx' script from 'raw.githubusercontent.com', combined with common download and execution patterns such as 'Invoke-Expression' or 'Invoke-WebRequest'. This activity is consistent with retrieving and executing remote post-exploitation scripts.
Detects the execution of PowerShell commands that reference the 'nyx' script from 'raw.githubusercontent.com', combined with common download and execution patterns such as 'Invoke-Expression' or 'Invoke-WebRequest'. This activity is consistent with retrieving and executing remote post-exploitation scripts.
Detects network traffic initiated by the WeaselBiscuit loader targeting api.npoint.io, a known free JSON storage service often abused by adversaries as a dead drop resolver for Command and Control (C2) configurations or secondary payloads.
Detects the abuse of the Windows built-in utility 'certutil.exe' to download files or decode obfuscated payloads. Attackers frequently use certutil as a Living off the Land Binary (LOLBin) to bypass security controls by leveraging its native capabilities for file transfer (via URL cache) and base64 or hexadecimal decoding.
Detects the use of PowerShell to download content from an external URL and immediately execute it in memory using common download cradles (e.g., Net.WebClient, IWR) combined with execution commands like IEX (Invoke-Expression). This is a common pattern for fileless malware delivery and post-exploitation activity.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
This rule detects potentially malicious behavior involving the Python interpreter spawning command-line shells (cmd.exe or powershell.exe), or interactions (creation/modification) with a specific file at 'C:\ProgramData\ur.txt'. This behavior is often associated with post-exploitation activities, staging, or script-based execution of malicious payloads.
Detects the use of PowerShell's 'WriteAllBytes' method to write a file to the user's Local AppData Temp directory, immediately followed by the creation of a known or suspicious executable file in that same location. This pattern is commonly indicative of a stage in a fileless-style malware attack or automated payload delivery.
Detects the use of command-line utilities (cmd.exe, curl.exe, tar.exe) to download or interact with specific suspicious zip archives (python-3.10.0-embed-amd64.zip, temp012.zip, MusicLibrariesPackage) from known staging directories or external sources often associated with malicious staging or persistence.
Detects the use of command-line utilities (cmd.exe, curl.exe, tar.exe) to download or interact with specific suspicious zip archives (python-3.10.0-embed-amd64.zip, temp012.zip, MusicLibrariesPackage) from known staging directories or external sources often associated with malicious staging or persistence.
This rule detects the execution of the Windows FTP client (ftp.exe) using a command script file (via the -s: parameter). It monitors for process creation of ftp.exe with this flag, excluding known legitimate paths. It then correlates this with any child processes initiated by the FTP client to identify potential data exfiltration or automated file transfers.
Detects the abuse of the legitimate Windows utility 'certutil.exe' to download files from external sources or to decode/deobfuscate files on the host, commonly used as a LOLBIN for malicious activities.
Detects network traffic associated with Hannibal Stealer, including communication with known hardcoded C2 infrastructure, suspicious URI patterns for data exfiltration, and the use of the Telegram Bot API for potential C2 or exfiltration.
Page 32 of 121