Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects an outbound HTTP GET request containing a .jpg extension in the URI, initiated by a user agent string containing 'PowerShell'. This pattern is commonly associated with attackers downloading images intended to serve as carriers for steganographic payloads, which are then parsed or executed by malicious PowerShell scripts.
Detects communication between suspicious processes (rundll32.exe, svchost.exe, dllhost.exe, install.exe) and the Steam Community website, specifically targeting a known TELEPUZ malware dead-drop profile ID used to resolve XOR-encoded C2 addresses.
This rule detects PowerShell commands initiated by web browsers that exhibit characteristics of the 'ClickFix' social engineering technique. The detection logic looks for high-risk flags (hidden window, bypass execution policy) associated with common ClickFix artifacts such as references to temporary directories, domain-specific indicators like 'memshowblob.forum', and the removal of Zone.Identifier alternate data streams which are often used to bypass security warnings.
This rule detects outbound HTTP requests using the WebDAV protocol that target specific directory paths associated with the Stealth Falcon campaign staging activity. Such traffic may indicate a compromised host attempting to download tools or payloads from an adversary-controlled infrastructure.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
Detects suspicious delivery and execution chains characteristic of the Blind Eagle (APT-C-36) group. The rule monitors for WScript, CScript, or CMD processes spawning PowerShell with evasive flags (hidden, bypass, encoded, etc.) accessing suspicious file paths, or the execution of a renamed AutoIt3 binary from non-standard locations like Temp or AppData, which are common indicators of stage-two downloader activity.
Detects the execution of binaries (exe, dll, msi) or scripts via rundll32/msiexec from the user's Local AppData Temp directory. This behavior is commonly associated with staging and executing secondary payloads by malware such as the Starland RAT, which frequently drops and runs its payloads from these locations to evade detection.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
Detects network traffic originating from the internal network directed towards a specific IP range associated with known PureRAT command and control infrastructure.
Detects the execution of binaries (exe, dll, msi) or scripts via rundll32/msiexec from the user's Local AppData Temp directory. This behavior is commonly associated with staging and executing secondary payloads by malware such as the Starland RAT, which frequently drops and runs its payloads from these locations to evade detection.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects the execution of rundll32.exe attempting to load a DLL from a remote WebDAV share by monitoring for the '@ssl' notation in the command line. This technique is often used to execute malicious code or load DLLs from attacker-controlled remote infrastructure, bypassing local security controls.
Detects the use of shell interpreters (sh, bash, zsh) to download content from GitHub using curl (specifically using the -s silent flag) and subsequent base64 decoding of potentially obfuscated payloads using the base64 command with the -D flag.
Detects the execution of binaries (exe, dll, msi) or scripts via rundll32/msiexec from the user's Local AppData Temp directory. This behavior is commonly associated with staging and executing secondary payloads by malware such as the Starland RAT, which frequently drops and runs its payloads from these locations to evade detection.
Detects malicious downloader activity where mshta.exe or a spawned runexe.bat script utilizes PowerShell's Net.WebClient to download and execute secondary payloads. This is a common pattern for stage-two malware delivery.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
Detects instances where the 'Werkbit' process initiates either 'curl' or 'bash' to download files from GitHub-related domains. This behavior is indicative of a living-off-the-land technique used to fetch secondary payloads or scripts during a post-exploitation phase.
This rule monitors for a high volume of WebDAV PROPFIND HTTP requests directed toward a specific domain associated with malware staging activities. The detection threshold is set to 50 requests within a 300-second window, which is indicative of automated attempts to enumerate or download malicious content using the WebDAV protocol.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
Page 55 of 121