Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects outbound TCP network traffic originating from internal assets to known hardcoded IP addresses and ports associated with PureRAT and DlrtyGames RAT malware families, indicating active command and control (C2) communication.
Detects the download and execution of the malicious v7.msi installer from the domain camorreado.click. This file acts as a loader for the EtherRAT Node.js RAT, often delivered in the context of fake IT support phishing campaigns. The rule monitors both network connection events to the malicious domain and process creation events involving msiexec.exe execution of the specific MSI payload.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects node.exe processes fetching remote content from specific IPFS dead-drop domains where the executing process does not write a corresponding script file to disk. This behavior is indicative of a fileless execution pattern where a 'caller.js' script fetches a payload and executes it directly in memory using the JavaScript Function constructor, bypassing traditional on-disk detection mechanisms.
Detects the execution of PowerShell with the '-enc' parameter, indicating base64 encoded input, coupled with either hidden window execution flags or known network download cmdlets. This pattern is commonly used by adversaries to execute obfuscated, second-stage malicious payloads while minimizing visibility on the endpoint. Legitimate administrative activities (e.g., those performed by SCCM or MSIExec) are excluded to reduce false positives.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Detects file write operations performed by 'nvidia-sysruntime.exe', a known masquerading binary used by LabubaRAT. This activity signifies the RAT's operator-directed tasking where attacker-controlled data is written to the file system.
This rule detects PowerShell commands that exhibit characteristic patterns of downloading and executing remote scripts in memory. It specifically looks for the combination of 'Invoke-Expression' (IEX) with web-fetching cmdlets like 'Invoke-RestMethod' or 'irm', combined with specific argument indicators like 'checkservice.php', 'idx=5', or 'logaction' which are often associated with stage-delivery or dropper scripts.
Detects the use of PowerShell's .NET WebClient class to download and execute potentially malicious files. The rule monitors for common indicators of in-memory or on-disk file downloading, such as Headers.Add being used to set a User-Agent, and the DownloadData method being invoked. It specifically flags common filenames associated with stage, update, or privilege escalation payloads.
This rule monitors proxy and network detection and response (NDR) logs for outbound HTTPS requests to Cloudflare R2 (*.r2.dev) and Cloudflare Pages (*.pages.dev) domains. These platforms are frequently abused by adversaries for hosting malicious payloads, particularly in ClickFix-style social engineering campaigns. The rule specifically flags connections that involve the download of common executable, script, or archive file extensions, as well as recurring traffic patterns to these domains.
Detects the use of living-off-the-land binaries (mshta.exe, regsvr32.exe, certutil.exe, or wmic.exe) when executing with network-related or decoding command-line arguments. The rule specifically flags these invocations when they originate from parent processes not typically associated with legitimate system administration or software deployment workflows, targeting potential command-chain abuse or payload staging.
Detects instances where 'db.dll' is loaded by a process, followed closely by outbound network activity from processes typically associated with disk analysis tools like WinDirStat or suspected DLL hijacking patterns using uxtheme.dll. This behavior often suggests the presence of a malicious payload or credential harvesting module being used to interact with remote databases.
Detects network activity (DNS queries, HTTP requests, and TLS SNI) associated with the PamStealer malware communicating with its known command and control domain maccyapp.com.
Detects network connection events where the requested URL contains 'dogleash' and includes common architecture suffixes (mips, arm, x64) or shell script extensions (.sh), often indicative of downloading stage payloads associated with the Dogleash malware family.
Detects the download of a Mach-O executable file over unencrypted HTTP. The rule identifies the Mach-O magic byte header ('CF FA ED FE') within the first few bytes of the HTTP response body, indicating a file download originating from an external network source.
Detects instances where a PowerShell process makes an outbound network connection shortly after its initial launch. This behavior is consistent with ClickFix campaigns or other malicious activity where PowerShell is utilized to download secondary payloads, such as stealers or loaders, directly from the internet.
This rule detects potentially malicious behavior involving the abuse of legitimate Windows binaries 'certutil.exe' and 'wscript.exe'. It flags specific command-line patterns often associated with deobfuscating, decoding, or staging payloads, such as using certutil to decode files or interact with web caches, and using wscript to execute vbscript from suspicious files like 'Link.ini' or 'Link.dat'.
Detects the use of a common PowerShell download cradle (Invoke-Expression with Invoke-RestMethod) targeting a direct IP address. This pattern is frequently observed in 'ClickFix' style attacks where users are tricked into copying and pasting malicious commands into their terminal, which then pull secondary payloads from adversary-controlled infrastructure.
Detects HTTP GET requests to signindat.com for suspected malicious payloads, including executables (.exe) and scripts (.ps1), as well as a decoy PDF document. The rule identifies communication with an external host using generic User-Agent strings, characteristic of the CrySome RAT multi-stage download process.
Page 56 of 121