Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This rule detects the execution of PowerShell or Command Prompt processes that attempt to bypass execution policies while performing file downloads from suspicious domains (mnl.ac) or IP addresses (149.255.35.135). It also flags the use of common web-request cmdlets (Invoke-WebRequest, IWR, DownloadString, DownloadFile) to fetch scripts named 'configuration.ps1'. The rule includes detection for obfuscated commands using caret (^) symbols often used to evade keyword-based security filters.
This rule detects the execution of PowerShell or Command Prompt processes that attempt to bypass execution policies while performing file downloads from suspicious domains (mnl.ac) or IP addresses (149.255.35.135). It also flags the use of common web-request cmdlets (Invoke-WebRequest, IWR, DownloadString, DownloadFile) to fetch scripts named 'configuration.ps1'. The rule includes detection for obfuscated commands using caret (^) symbols often used to evade keyword-based security filters.
Detects the use of cmd.exe to execute copy commands involving specific batch files (doxc.bat or config.bat) or suspicious file paths, which may indicate malicious file staging or automated data collection behavior.
Detects a suspicious sequence of network downloads initiated by bash, sh, or zsh using curl or wget where the command-line includes the 'force=1' parameter. This behavior is indicative of the ClickFix macOS dropper chain often associated with the Macfinger campaign, where multiple payloads (shell scripts and Mach-O binaries) are retrieved from a common C2 infrastructure.
Detects a suspicious sequence of network downloads initiated by bash, sh, or zsh using curl or wget where the command-line includes the 'force=1' parameter. This behavior is indicative of the ClickFix macOS dropper chain often associated with the Macfinger campaign, where multiple payloads (shell scripts and Mach-O binaries) are retrieved from a common C2 infrastructure.
Detects a multi-stage malware execution pattern consistent with VelvetCake activity. This includes staging text-based files in C:\Users\Public, downloading PowerShell scripts to temporary directories, executing the script via PowerShell, and subsequently deleting both the staged text files (except for specific allowed filenames) and the payload script.
Detects the execution of PowerShell commands that reference the 'nyx' script from 'raw.githubusercontent.com', combined with common download and execution patterns such as 'Invoke-Expression' or 'Invoke-WebRequest'. This activity is consistent with retrieving and executing remote post-exploitation scripts.
Detects network traffic consistent with the download of XMRig cryptocurrency miner release tarballs from GitHub, typically used in malicious deployment scenarios including automated cron-triggered installations.
Detects instances where a Redis server process, or its child process, writes a file named 'verify.html' into the web root directory '/var/www/html/'. This behavior is characteristic of adversaries abusing compromised Redis instances to deploy web shells or command-and-control beacons for persistent access.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
Detects network communication with known malicious domains and IP addresses, as well as the presence of known malicious file hashes on the system. The rule correlates network connection events, file creation events, and process creation events against predefined lists of C2 infrastructure and malware indicators.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects malicious activities associated with the SilkParasite campaign targeting Redis servers. The rules identify the initiation of a 'SLAVEOF' command to a rogue replication host, subsequent handshake (PSYNC/REPLCONF) with an external attacker-controlled node, and the modification of server configuration ('CONFIG SET dbfilename') to potentially facilitate unauthorized file persistence or data exfiltration through the Redis replication mechanism.
Detects PowerShell or PowerShell ISE spawned directly from Windows Explorer (explorer.exe, covering both Start-menu launches and the Run dialog abused by ClickFix) whose command line carries a genuine obfuscation/evasion signal - true -EncodedCommand/-e usage, a hidden/minimized window flag, or a remote download cradle (IEX, Invoke-WebRequest, DownloadString, certutil, mshta, etc.) - while excluding invocations that point at an on-disk script file under a standard install path, since ClickFix payloads are inline one-liners rather than references to a local .ps1. Bare -NoProfile/-NoLogo flags no longer trigger alone, since they are common in legitimate automation.
Detects the BlueMoon exploit kit's post-exploitation activity, specifically identifying when a Chromium-based browser process (chrome.exe or msedge.exe) initiates command-line tools such as cmd.exe, powershell.exe, or curl.exe to download and execute a secondary payload named 'msgbox.exe' within the user's temporary directory.
Detects the use of PowerShell to download files from Vultr Object Storage, specifically targeting patterns associated with the HEAVYGRAM malware distribution. The rule monitors for PowerShell cradles (WebClient, DownloadFile), archive extraction commands, or the execution of a specific payload name (RuntimeSSH.exe) often linked to the Handala Hack threat activity.
This rule detects potentially unauthorized network communication with AI platforms (OpenAI, Anthropic, Gemini) or Telegram from hosts executing suspicious processes or tools, such as 'frpc' (Fast Reverse Proxy), 'liblocal-service.so', or processes interacting with Android Debug Bridge (adb) utilities. This behavior often suggests the use of automated tools, remote tunneling, or interaction with AI models for post-exploitation tasks, such as code generation for malicious scripts or C2 activity.
Detects a suspicious execution chain where wscript.exe spawns an encoded PowerShell process to download files from Vultr Object Storage. The rule specifically monitors for the download of decoy files (e.g., .pptx, .zip) followed by the execution of a file named RuntimeSSH.exe, which is associated with the HEAVYGRAM malware implant.
IOC hunt for the HEAVYGRAM/CRUDEEXCLUDE campaign: matches known SHA256 file hashes (first-stage malware, implant, RAR/ZIP artefacts) via DeviceFileEvents and DeviceProcessEvents, plus known-malicious domains/staging infrastructure by parsed hostname across network connections, process command lines, and file origin URLs.
Detects the execution of PowerShell encoded commands that result in the installation of known remote monitoring and management (RMM) software. This pattern is indicative of attackers, specifically those associated with Ransom Busters or similar affiliates, establishing persistent remote access to compromised systems.
Detects HTTP GET requests characteristic of SilverFox malware final-stage payload delivery. The rule monitors for requests to known C2 domains or domains using a specific naming pattern (www.[5-10 chars].com) with specific URI paths (down, load, or insdw followed by 2-4 digits), indicating the retrieval of a malicious payload.
Page 35 of 121