Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects PlugX-style initial-foothold staging: process injection followed within minutes by a dropped file that is then executed, excluding known-benign AV/EDR/updater injectors and targets.
This rule detects potentially malicious PowerShell activity characterized by the co-occurrence of file download indicators (such as Invoke-WebRequest, WebClient, or UserAgent strings) and file execution or staging commands (such as IEX, Expand-Archive, or Copy-Item) within the same command line. It is designed to identify ingress tool transfer and command-line execution patterns often associated with post-exploitation or malware staging, while reducing noise by requiring both download and operational intent.
This rule detects the use of the Windows certutil.exe utility with flags commonly abused by adversaries for file downloads (-urlcache, -urlfetch) or file deobfuscation/decoding (-decode, -decodehex, -encode). It specifically targets LOLBIN (Living Off the Land Binary) behavior by monitoring process command line arguments, while providing allowances for common administrative tasks like PKI maintenance or CRL/OCSP updates to minimize false positives.
Detects encapsulated C2 traffic over non-standard ports and DNS/HTTP tunneling patterns using entropy/volume thresholds and sustained-pattern requirements to avoid matching ordinary long DNS queries, excluding known legitimate tunneling tools/VPN endpoints.
This rule detects potentially malicious activity leveraging the Windows Certutil utility for downloading, decoding, and executing files or payloads. It monitors process command line arguments to identify common download flags, hex/base64 decoding operations, evasion techniques, and interaction with high-risk file types or directories. The rule calculates a severity score based on the combination of these behaviors, such as downloading and decoding a file, or executing content from a temporary directory.
Detects execution of the SimpleChatProxy/'Chat Proxy' tool correlated with outbound traffic to an attacker-hosted image endpoint, used for operator-victim messaging and remote screenshot retrieval.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
Correlates network connections to known OnyxC2 C2/delivery domains and Cloudflare-fronted IPs with the malware's sideloaded-process indicators to detect delivery and command-and-control traffic.
Detects a rapid multi-stage infection chain on macOS, typically associated with the ClickFix campaign. The rule monitors for a sequence of process events starting from a shell, followed by a curl-based download, data decoding via base64 or openssl, execution of the decoded content via shell/python/perl, and finally persistence mechanisms using launchctl or osascript, all occurring within 28 seconds.
Detects StopAndProtect campaign base64-encoded payload files staged in WordPress upload directories, requiring multiple named .b64 filenames or a base64 blob in a wp-content/uploads path context
This KQL detects attack used TCP port 4307 for unauthenticated access and replaced public\js\locale.php with a web shell that provided persistent remote access.
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects HTTP outbound traffic to domains using the .sbs TLD that follow a specific 'file' followed by dictionary words naming convention, associated with the ClickFix campaign. The rule specifically identifies staging requests matching a /curl/<hex-id> URI pattern used to deliver secondary payloads.
Correlates AES-CBC shellcode decryption (EXECURL_AES_HOL/EXECLOCAL_AES_HOL/AESHOL) with a preceding external download and a full VirtualAllocEx-WriteProcessMemory-CreateRemoteThread injection sequence into a named target process within 1 hour.
Detects dropper/staging scripts that curl-fetch a second-stage Mach-O payload to /tmp/helper or /tmp/update, chmod +x it immediately afterward in the same command sequence, ad-hoc/unsigned sign it, and strip quarantine attributes, while excluding scripts that verify a legitimate Developer ID signature
Detects PowerShell command lines that fetch a remote module using methods like DownloadString or Invoke-WebRequest, subsequently executing the downloaded code in-memory via Invoke-Expression (iex), and finally invoking a main() function. This pattern matches the execution chain used by the CountLoader malware (taskType 5).
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
This rule detects the potential replacement of legitimate cryptocurrency wallet applications (Ledger, Trezor, Exodus) by monitoring for the download of zip archives from suspicious paths containing 'zxc' using curl, followed by the creation or modification of files within known wallet application directories. This activity is indicative of a trojanized application delivery mechanism, often associated with info-stealer campaigns.
Detects execution of a Bun binary from a temporary, download-staging or node_modules path
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
Detects file, process, or image-load events in Microsoft Defender XDR where the file hash or initiating-process hash matches known Coinbase Cartel-related hash indicators.
Detects mshta.exe invoked with a remote HTTP(S) URL argument, consistent with CountLoader's taskType 10 command proxying malicious script execution through mshta.exe, excluding local file/HTA paths.
Page 51 of 121