Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,232
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects a script interpreter wscript/cscript opening a network connection to a non-local network. Adversaries may use script to download malicious payloads.
Detects the execution of Certutil.exe with specific command-line arguments (-decode, -urlcache, -split) or references to suspicious file patterns (Link.dat, Link.ini) which are often indicative of malicious activity such as downloading remote payloads, decoding obfuscated binaries, or staging files for lateral movement.
Detects HTTP traffic containing a User-Agent string associated with the NetSupport Manager remote access tool. This activity is indicative of the tool being used for unauthorized remote access or as a C2 channel, often seen in the context of the ClickFix campaign.
Detects package manager lifecycle scripts (npm, yarn, pnpm, composer, go) spawning child processes that perform suspicious activities, including network connectivity (curl, wget) or execution of obfuscated JavaScript (base64/fromCharCode/eval), often indicative of supply chain attacks like the PolinRider campaign.
Detects the second-stage Rust-based Mach-O binary downloaded and executed by the PamStealer JXA stager, identified via embedded C2 domain strings
Detects the execution of curl.exe to download an executable payload directly into the C:\ProgramData\ directory.
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
Detects network activity initiated by wscript.exe or DNS queries related to the Kimsuky downloader infrastructure, specifically identifying callbacks to the domain 'acnms.dmdoc.dynv6.net' and associated malicious bootservice.php script retrieval behavior.
Detects the creation of unrecognized Go-compiled binaries by common developer tools (e.g., node.exe, code.exe) in user-writable or temporary directories, followed shortly by outbound network connections to known C2 infrastructure (e.g., vercel.app, jsonkeeper.com). This behavior is consistent with the 'Contagious Interview' campaign attributed to the Lazarus Group.
This rule detects potentially malicious command execution patterns where shell interpreters (bash, sh, zsh, dash) are invoked to process data piped from suspicious sources. This includes patterns like piping DNS query output (dig) directly into a shell—a technique often used in C2 communication—and base64-encoded payloads executed by shells that originate from or are associated with AI agent tooling (e.g., Claude, Cursor, Cody, Copilot). This behavior is indicative of unauthorized code execution or command and control activity.
Detects outbound network connections from common package managers (pip, npm) or utility tools (node, wget, curl) to destinations that are not related to official package repositories or local network ranges. This behavior may indicate an adversary using legitimate tools to download malicious payloads or establish command and control channels.
Detects the download of potential second-stage malicious payloads disguised as JPEG files to the C:\Windows\ directory using the URLDownloadToFile method. This activity is associated with Operation DragonReturn, where attackers save payloads as background.jpg for later decryption and execution.
This rule detects network communication (DNS, connection, or traffic) with known infrastructure and specific URI paths associated with the SpectralViper threat actor. It enriches these findings by identifying if the communication originated from processes commonly associated with SpectralViper, such as OneDrive Sync services or specific Intel audio service files.
Detects the use of BITSAdmin or the PowerShell Start-BitsTransfer cmdlet for downloading files from the internet or local network, often used by attackers to perform ingress tool transfer or to maintain persistence via BITS jobs.
Detects the execution of PowerShell commands targeting a specific staging directory 'ProgramData\Zooms', typically associated with the ClickFix malware campaign. The rule flags processes invoking secondary payload retrieval via '.r2.dev' or 'dl-callback' patterns, which are indicative of staged second-stage download activities.
Detects malicious PowerShell command-line execution associated with the Gamaredon (Shuckworm/ACTINIUM) threat group's Ptero-family of tools. This rule flags PowerShell processes utilizing encoded commands (-enc, -EncodedCommand), hidden windows (-nop, -w hidden), and downloader cmdlets (DownloadString, DownloadFile, IEX) that include specific strings linked to the Ptero malware suite (e.g., PteroPaste, PteroVDoor, PteroPSDoor).
Detects a PowerShell download cradle that retrieves a payload archive from a Cloudflare R2 bucket (pub-*.r2.dev/*.zip) and reports success via an out-of-band HTTP GET to a /dl-callback/ endpoint containing a GUID, consistent with ClickFix loader behavior.
Detects the download of potential steganographic image files (specifically .jpg extensions) from known malicious IP addresses, followed by the creation of a non-Microsoft-signed image file in the C:\Windows directory by the same process storyline. This behavior suggests the download and extraction of an embedded malicious payload.
Detects the execution of curl.exe to download an executable payload directly into the C:\ProgramData\ directory.
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
This behavior was observed in MuddyWater campaigns utilizing the Chaos ransomware false flag to retrieve their initial dropper (ms_upd.exe).
Detects potentially malicious use of the Windows Package Manager (WinGet) to configure system environments, specifically targeting flags that bypass user interactivity or agreements, as well as the spawning of the ConfigurationRemotingServer by WinGet or related package management processes, which could indicate the deployment of unauthorized or malicious configurations.
Detects the abuse of the CertUtil.exe Windows utility to download, decode, encode, or split files. This behavior is considered suspicious when initiated by common command-line shells or Office applications, which are frequently used as entry points for malicious scripts or macro-based attacks.
Detects the use of living-off-the-land binaries (LOLBins) such as PowerShell, curl, certutil, bitsadmin, or mshta to download potential secondary payloads from self-hosted GitLab instances. This behavior is indicative of the Amadey loader chain, where compromised GitLab infrastructure is used as a repository to stage and distribute StealC or other malicious payloads.
Page 57 of 121