Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
257 detections
Filters
Last updated
All Time
Detection languages
113
59
26
14
14
Contributors
78
29
27
23
19
Categories
169
136
66
57
39
Platforms
206
22
19
9
2
Products / Services
96
53
31
25
11
MITRE Techniques
18,108
15,613
12,573
8,384
6,203
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
Detects the use of the living-off-the-land binary (LOLBIN) extrac32.exe to decompress cabinet (.cab) or .vstm files from user-writable locations. This technique is used by loaders like CastleLoader to unpack malicious stages.
Detects the use of certutil.exe to decode a batch script that is referencing itself as the source file. This is a 'fileless' technique used by attackers to hide and extract embedded payloads, as seen in the 'Contagious Interview' campaign.
Detects the execution of a command pattern commonly associated with "ClickFix" social engineering attacks. This technique tricks users into pasting a command into their terminal, which typically uses 'echo' to pass a base64 encoded string to the 'base64' utility for decoding, and then pipes the output to a shell for execution. This method is used to bypass traditional OS-level protections like Gatekeeper and Notarization.
Detects unsigned processes creating directories and dropping multiple suspicious files (DLLs, executables, crypto libraries) in AppData Temp folders which may indicate malware staging behavior
In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence. Microsoft released an out-of-band update to address CVE-2026-21509 on January 26, 2026. ThreatLabz observed active in-the-wild exploitation on January 29, 2026.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
Detects a command line pattern where `curl` is used to download a payload, which is then piped to `base64` for decoding and `gunzip` for decompression. This technique is commonly used by macOS infostealers like DigitStealer and MacSync to execute malware in memory without writing it to disk.
Detects the execution of a PowerShell command characteristic of the DeadVax malware family. The threat actor uses a self-parsing batch script that invokes PowerShell to read its own content (`Get-Content`). It then uses a regular expression to find and extract a payload from a line starting with the '@' symbol. This technique is used to hide the next stage payload from static analysis.
Detects the execution of a piped command chain typical of 'ClickFix' lures used by the MacSync infostealer. The malware tricks users into pasting a command into the terminal which uses curl to download a payload, decodes it with base64, and pipes it directly into a shell (zsh, sh) or osascript for execution, bypassing macOS security controls like Gatekeeper.
Detects the execution of a PowerShell command that reads a file's byte stream and performs a XOR operation on it. This technique is used by the KONNI APT group to decrypt and execute an embedded payload in memory, as seen in their 2026 campaign involving AI-generated backdoors.
Detects a URL containing common redirection or proxy parameters where the value appears to be a ROT13 obfuscated URL, indicated by the presence of 'uggcf' ('https') and common ROT13'd TLDs. This is an evolution of a TTP observed in Kimsuky campaigns.
Detects native decryption library
Detects the use of certutil.exe to decode a payload from a file with a misleading extension (e.g., .png) and save it as a DLL in a suspicious location. This technique was observed in the 'Operation Hanoi Thief' campaign.
Detects extraction of FlexibleFerret malware payload archive to the CDrivers directory on macOS systems.
This rule blocks connections made directly to IP addresses instead of domain names, a technique often used by malware to evade detection, leveraging AWS Network Firewall and Suricata.
Detects FileFix campaigns that use clipboard manipulation functions in web pages to deliver malicious PowerShell commands. These campaigns often trick users into copying and executing payloads, sometimes involving steganography with image files.
Detects the XOR decryption function used in macOS variants of OceanLotus (APT32). This rule targets a specific byte sequence identified in the malware's decryption routine.
Detects usage of expand.exe to extract Microsoft Cabinet (CAB) archives, specifically when extracting into `C:\ProgramData` or similar staging locations. This behavior has been observed in recent APT37 activity where a CAB payload was expanded into ProgramData prior to persistence and execution, indicating ingress tool transfer and payload staging.
Detects the execution of the 'ping.exe' command with a hexadecimal encoded IP address in the command line. This technique is often used by adversaries for defense evasion, specifically to obfuscate network communication or command and control activities, making it harder for security tools to detect the target IP address.
Detects VenomRAT, a variant of QuasarRAT, used by the RevengeHotels group in recent campaigns targeting the hospitality industry. This rule identifies the RAT based on a characteristic list of security and analysis tools it attempts to terminate, along with other unique features.
The following analytic detects the use of CertUtil.exe with the 'decode' argument, which may indicate an attempt to decode a previously encoded file, potentially containing malicious payloads. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on command-line executions involving CertUtil.exe. This activity is significant because attackers often use CertUtil to decode malicious files downloaded from the internet, which are then executed to compromise the system. If confirmed malicious, this activity could lead to unauthorized code execution, further system compromise, and potential data exfiltration.
Page 10 of 13