Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
Detects suspicious command-line execution patterns where 'cmd.exe' is spawned by 'explorer.exe' (often indicative of .lnk file execution) and the command line contains specific arguments associated with malicious shortcut files. The rule looks for '/c start' and indicators of payload staging in Public Documents or removable drives, while excluding known benign system paths.
Detects the anomalous execution or loading of files named "Subtitles" which actually contain decrypted .NET assemblies, specifically looking for command lines containing "Packages\Microsoft.WindowsSoundDiagnostics\Subtitles". This pattern is associated with AsyncRAT malware.
This rule detects a multi-stage attack chain on macOS involving a browser or mail client spawning a shell to download a file (DMG) via curl/wget, followed by the mounting of that disk image, execution of an application bundle from the mounted volume, and a subsequent outbound network connection from that application. This behavior is indicative of a user-initiated malware execution chain.
Detects network activity and DNS lookups associated with the domain 'loopedin.io', which has been identified as a second-hop open-redirect service used in forged healthcare-themed phishing campaigns. The rule specifically monitors connections from common web browsers to facilitate the identification of redirected user traffic.
This rule detects potential engagement with known phishing infrastructure by monitoring common email clients and browsers for DNS resolutions to specific malicious domains (holabrief.com, loopedin.io) or network connections to suspicious IP addresses associated with a healthcare-themed phishing campaign.
This rule detects potentially malicious behavior where a PDF reader or command-line utility (executing a PDF) spawns msiexec.exe shortly after, when the parent process is running from a suspicious directory (e.g., AppData, ProgramData, or other temp locations). This pattern is commonly associated with dropper activity where a malicious PDF is opened and subsequently triggers an MSI installer to deploy malware.
Detects a potential multi-stage attack sequence where a file (archive or browser-related) is executed, followed by a script interpreter (wscript/cscript), and finally followed by a remote connection to common remote access ports (RDP, FTP, SMB, SSH). The rule correlates these events within a specific timeframe per device to identify likely lateral movement or remote command and control initialization.
Detects a .zip or .rar archive being dropped in a downloads folder, followed immediately (within 10 minutes) by the execution of a suspicious installer executable from that same path. The installer executable names are indicative of fake AI-related software (e.g., deepseek, gpt, kimi). This pattern suggests a social engineering attack where users are tricked into downloading and executing malicious software disguised as legitimate AI applications.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
This rule detects the execution of the Windows 'timeout.exe' utility with a specific 10-second delay parameter, initiated by common command-line interpreters (cmd.exe, powershell.exe, setup.cmd) or from directories containing '7ZipSfx'. This pattern is frequently used by installers and self-extracting archives to pause execution during malicious software deployment or to delay the cleanup of artifacts.
Correlates local LLM execution engines (Ollama, LM Studio) unexpectedly spawning command shells, a strong indicator of successful prompt execution payloads.
Tracks the process tree where a Fake AI installer (deepseek*, ProFluxeFlowAi*, etc.) executes and writes pythonw.exe to disk. This activity is indicative of social engineering attacks leveraging the popularity of AI tools to deliver malicious Python-based loaders.
This rule detects the execution of potentially unwanted programs (PUPs) from common temporary or user-specific download directories. It specifically looks for processes with filenames indicative of PUPs (e.g., 'pua.exe', 'adware.exe', 'pup.exe', 'unwanted.exe') originating from 'Temp', 'AppData', or 'Downloads' folders. The rule aggregates these events per device per hour and alerts if one or more such executions occur, indicating potential user-initiated installation or drive-by download of unwanted software.
This rule detects the execution of self-extracting (SFX) archives that launch both a visible decoy and a hidden second executable from the temporary directory. It specifically looks for process command lines containing patterns indicative of 7-zip or generic SFX archive execution, combined with an actor process image name suggesting an archive utility or installer. The rule aims to identify malicious SFX archives used in multi-stage attacks, providing causality fields for investigation.
This rule detects instances where common productivity applications (like Office suite) or web browsers spawn child processes that create system mutexes. This is a common indicator of malicious activity where a benign-looking document or web-based threat launches secondary payloads or persistence mechanisms.
This rule detects instances where common productivity applications (like Office suite) or web browsers spawn child processes that create system mutexes. This is a common indicator of malicious activity where a benign-looking document or web-based threat launches secondary payloads or persistence mechanisms.
Detects when a web browser (Chrome, Edge, Firefox, Brave) spawns `cmd.exe` with a command line that includes a temporary directory path and specific command separators, indicating potential malicious copy-paste activity or drive-by compromise. The rule looks for a long command containing `&&`, `& rem`, `tar -xf`, or `rundll32` within the temporary directory.
Detects the Steam application wallpaper (wallpaper32.exe or wallpaper64.exe) launching a hidden executable named ._cache_GAME1.exe. This behavior is indicative of malicious wallpapers found on the Steam Workshop that use this method to execute malware.
Detects the creation of executable files (.exe, .com, .scr, .vbs, .js) that contain financial-themed keywords (e.g., GST, NEFT, RTGS, IMPS, Banking) in their filename. This pattern is commonly used in social engineering and phishing attacks to trick users into executing malicious payloads disguised as legitimate banking or financial documents.
Detects if multiple different fake AI installers (e.g., DeepSeek and Kimi) are executed on the same machine, indicating a concentrated phishing delivery.
Page 15 of 26