Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
CaptiveCrunch ChocoShell disguised C2 URI pattern to known Storm-2945 C2 IP (/t/event, /t/pixel.gif, polyfill payload)
Detects PowerShell staging commands that download an executable with Invoke-WebRequest to $env:APPDATA\sekv<random>.exe, unblock it, and launch it via Start-Process, consistent with GoGRPC backdoor delivery following a Quick Assist vishing session.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects network activity associated with the Dolphin X malware, including DNS queries, TLS SNI requests, and direct TCP traffic to known C2 infrastructure patterns on specific ports.
Detects TOKYOCORE ransomware artifacts referencing the fsociety.exe binary being dropped to Downloads and copied to System32, alongside the WindowsUpdate.exe persistence copy
Summarizes Zscaler NSSWeblog transactions where DeviceAction was Allowed but Zscaler still recorded a malware/threat verdict (ClickFix, MalURL, Trojan.Gen families), broken down by user, threat name, and malware category for triage.
Detects osascript executed with -e combined with a curl subprocess or parent process, matching XCSSET's fileless AppleScript execution pattern that fetches and runs code in memory without touching disk.
Dolphin X DNS query for thedolphinx.top C2 domain
Detects the use of built-in Windows Living-off-the-Land binaries (LOLBins) to initiate outbound network connections to public infrastructure for file downloads. The rule correlates process execution, network connections, and subsequent file creation to identify potentially malicious ingress tool transfer. It includes risk-based scoring to prioritize events where files are dropped in user-writable paths or subsequently executed.
Detects curl.exe writing an MSI package into the ProgramData
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
directory. Chaos ransomware stages a trojanized installer this way, fetching
update_ms.msi from an attacker-controlled host over plain HTTP on port 443 so
the traffic reads as TLS to port-based inspection. The match is on the
behaviour rather than on that filename: curl is a signed in-box binary and has
no legitimate reason to drop an installer package into ProgramData.
Detects the legacy SourTrade Mark-of-the-Web spoofing variant, where a downloaded file's Zone.Identifier data or an observed network request references the jimmywarting.github.io/StreamSaver.js helper path with an embedded attacker domain, date, and installer.exe filename — used to disguise the true download provenance of browser-assembled malware.
Detects the macOS ClickFix dropper chain where curl fetches a disguised Mach-O payload (winapp.bin/ZoomSDK.bin) within a process chain that also shows an osascript decoy dialog or a self-deleting shell script, consistent with BlueNoroff's fake meeting-app installer delivery.
Detects a specific attack chain where users are tricked into copying and pasting a malicious command (ClickFix) that downloads and executes a secondary stager named winPatch.zip via curl or wscript.exe, commonly associated with recent social engineering campaigns.
This rule detects a suspicious pattern on Linux systems where a process creates a file in the /tmp directory with a name consisting of a long hexadecimal string (indicative of a hash, often used by Rust-based loaders for Sliver or similar implants), followed immediately by the execution of that same file by the initiating process.
Detects the XCSSET bash stager downloading and executing a second-stage payload via curl to /tmp/ap from the amzndev.in C2 domain to begin host reconnaissance.
Repeated TLS beacon activity to external host preceding possible CornFlake RAT C2 sync
STAC4749 DNS Query to Known C2 Domain or Cloudflare Workers.dev C2 Subdomain
Detects the BlueNoroff VBScript implant's C2-tasked execution engine — dual wscript.exe invocations with campaign-specific numeric arguments, or a curl-fetched secondary payload chained into cmd/WScript.Shell execution — excluding legitimate installer deployment tooling.
Detects an obfuscated, hidden-window PowerShell loader chaining campaign-specific SET environment-variable assignments to stage a payload path and download a next-stage payload from cdn.zoom-videos infrastructure, consistent with BlueNoroff's ClickFix PowerShell staging technique.
Detects the creation and immediate execution of an unsigned binary on a system within two minutes of that system establishing an outbound network connection to port 32768, which is the command and control (C2) port associated with the Dolphin X stealer. This rule aims to identify the behavior of a secondary payload being fetched and launched by the initial loader.
Page 53 of 121