Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
This rule detects the extraction of a file from an archive (RAR) using 7-Zip utilities, followed by the execution of a file (exe, dll, js, etc.) from the Temp or Downloads directory within 120 seconds. This pattern is commonly observed during the execution phase of a malicious payload delivered via archives.
Detects the execution of known analysis or command-line tools by AnyDesk, a legitimate remote access tool. This pattern is often observed during post-exploitation activities where an attacker uses authorized remote access tools to execute further commands or deploy diagnostic tools on the compromised host.
This rule detects network activity associated with a known malicious domain 'facture-in.pages.dev' or suspicious HTTP response patterns often observed in phishing kits or web-based redirection, such as 'BOT BLOCKED', 'no_mouse', 'wrong_timezone', or specific language-localized error messages.
Detects ClickFix social engineering attacks where users are tricked into pasting and executing a malicious script from a fake CAPTCHA page. The technique results in a browser process spawning powershell.exe, cmd.exe, wscript.exe, or mshta.exe as a child process to launch the first-stage loader.
Detects the execution of known AI/LLM command-line interface tools (such as Ollama, OpenAI, or Claude) when spawned by command shells (cmd.exe, powershell.exe) or executed from suspicious locations like user profiles or temporary directories. This pattern is indicative of potential use of LLMs for generating malicious code, analyzing data, or assisting in post-exploitation activities within a compromised environment.
Detects the execution of known AI/LLM command-line interface tools (such as Ollama, OpenAI, or Claude) when spawned by command shells (cmd.exe, powershell.exe) or executed from suspicious locations like user profiles or temporary directories. This pattern is indicative of potential use of LLMs for generating malicious code, analyzing data, or assisting in post-exploitation activities within a compromised environment.
Detects the creation of executable files (exe, dll, bat, ps1, vbs, msi, lnk) by common web browsers (Chrome, Firefox, Edge, Internet Explorer) or email clients (Outlook). This activity can indicate a user downloading or receiving a potentially malicious file, which could lead to initial access or further compromise.
Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.
Detects the creation of executable files (.exe, .com, .scr, .vbs, .js) that contain financial-themed keywords (e.g., GST, NEFT, RTGS, IMPS, Banking) in their filename. This pattern is commonly used in social engineering and phishing attacks to trick users into executing malicious payloads disguised as legitimate banking or financial documents.
Detects known malicious invoice PDFs and email samples used in Crimson Kingsnake campaigns.
Detects network connections from common web browser processes (Chrome, Edge, Brave, Electron) to loopback addresses (127.0.0.1 or Localhost) where the URL path contains sensitive keywords like /code, /textbox, /credentials, or /secrets. This behavior is often associated with browser-based exploitation attempts, such as targeting local development servers or internal browser automation interfaces to extract sensitive information.
Detects the creation or download of 'injection-obf.js', an obfuscated JavaScript payload associated with VVS Stealer for Discord injection. The rule captures details like source URL, referrer, and responsible process to aid in containment and scoping.
Detects the creation of archive files (ZIP, RAR, 7Z) or executables with specific naming conventions (GST_, Debit_, Invoice_, NEFT_, RTGS_) often associated with Remcos RAT loaders. This rule focuses on the initial file creation event on a device.
This rule monitors for processes that start after a delay (between 30 and 600 seconds) following the launch of common web browsers (Chrome, Edge) or PDF readers (Acrobat, Foxit). The rule excludes common background processes associated with these applications, focusing on potential delayed execution of malicious payloads or secondary stage activity after a user has opened a document or navigated a malicious site.
Detects the execution of files with .exe, .msi, or .bat extensions located within the user AppData Roaming directory. This path is frequently abused by malware, droppers, and persistence mechanisms to execute code in a directory that is typically writable by the user without requiring elevated administrative privileges.
This rule detects web browser processes (Chrome, Edge, Brave, Chromium) or potential browser extension files interacting with the 'perplexity-ai.online' domain. This is often associated with malicious browser extensions or phishing campaigns attempting to lure users to fraudulent sites.
Detects the execution of financial-themed executable files (masquerading as .com or .scr) that are launched directly from common email client processes. This rule aims to identify phishing attempts where users are tricked into opening malicious attachments disguised with financial keywords.
Detects instances where the RustDesk remote control application spawns suspicious child processes, such as command interpreters or scripting utilities. This behavior is indicative of a permission bypass exploit, where an attacker leverages an existing authorized remote session to gain interactive command-line access or execute unauthorized commands on the target host.
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Detects the creation of files with extensions (.scf, .url, .lnk) commonly used for shortcut-based exploitation or social engineering within sensitive user or system directories (e.g., Desktop, Downloads, Temp, NETLOGON, SYSVOL). The rule excludes file creations performed by known reputable software publishers to reduce noise.
Detects the creation of files with extensions (.scf, .url, .lnk) commonly used for shortcut-based exploitation or social engineering within sensitive user or system directories (e.g., Desktop, Downloads, Temp, NETLOGON, SYSVOL). The rule excludes file creations performed by known reputable software publishers to reduce noise.
Page 14 of 26