Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects the modular ChonkyChicken plugin sequence: module_request/module_load C2 exchange, temp-file write, and LoadLibraryA load.
Detects a suspicious PowerShell execution sequence initiated by explorer.exe that exhibits multiple indicators of malicious behavior within a short timeframe. The detection logic correlates PowerShell process creation (using obfuscated arguments or common attack flags) with subsequent network connections (C2), file writes to temporary directories, and execution of child processes from those same directories. This pattern is characteristic of multi-stage malware loaders, such as Vidar Stealer, staging payloads and executing them.
Detects HTTP GET requests to a known malicious endpoint attempting to download a file named 'update_ms.msi', associated with the Chaos msaRAT trojan.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
Detects network traffic consistent with the SleeperGem loader communicating with a Forgejo instance hosted on git.disroot.org. The detection looks for GET requests containing specific path patterns (e.g., '/git-ecosystem/', '/raw/branch/main/') and file extensions (deploy.sh or git-credential-manager), along with a 'Git' user-agent, which is characteristic of the loader's C2 retrieval activity.
Detects the use of curl.exe to download a specific file named 'update_ms.msi' from a known malicious IP address. This behavior is indicative of a stager for msaRAT being downloaded onto a Windows host, potentially disguised to mimic a legitimate Windows update file.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
Detects the execution of rundll32.exe attempting to load a DLL from a remote WebDAV share by monitoring for the '@ssl' notation in the command line. This technique is often used to execute malicious code or load DLLs from attacker-controlled remote infrastructure, bypassing local security controls.
Detects HTTP GET requests associated with the Blind Eagle (APT-C-36) campaign JC-46, specifically targeting GitHub for payload delivery and fetching dropper files (such as .vbs, .bat, .js, or .pif) from known command-and-control staging infrastructure.
Detects the use of PowerShell commands 'irm' (Invoke-RestMethod) or 'iwr' (Invoke-WebRequest) to download content from a direct IP address. This pattern is commonly used by attackers to stage malicious payloads or tools directly from external infrastructure, bypassing domain-based reputation filters.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detection of network communications associated with the TAG-195 campaign, specifically targeting the 'ClickFix' social engineering lure. The rules identify TLS SNI, DNS queries, and HTTP requests involving known C2/staging domains 'screenly.cam' and 'xtrafftrck.net', as well as specific payload retrieval patterns for OCX files and 'curl' usage involving the infrastructure IP 70.34.205.43.
Detects network indicators related to the BlueNoroff ClickFix Kit, specifically targeting malicious TURN relay domains (edensun.xyz) used for WebRTC-based webcam exfiltration and Command and Control (C2) traffic involving Socket.IO signals that trigger malicious UI modals.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
Detects the execution of rundll32.exe attempting to load a DLL from a remote WebDAV share by monitoring for the '@ssl' notation in the command line. This technique is often used to execute malicious code or load DLLs from attacker-controlled remote infrastructure, bypassing local security controls.
PowerShell Downloading JPEG Image Possible Steganographic Payload Carrier
Detects the installation of Python on Windows systems using various package managers (WinGet, Chocolatey, Scoop), MSI installers, or direct download methods via command-line utilities like PowerShell, curl, or wget.
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.
Page 54 of 121