Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
This rule detects suspicious executable downloads from email-related referers. It specifically looks for HTTP traffic where the referer header contains keywords like 'mail.', 'webmail.', 'outlook.', 'gmail.', or 'yahoo.com', indicating the download originated from an email client or webmail interface. The rule further narrows down the detection to files containing the 'MZ' header (characteristic of Windows executables) with a size greater than 10000 bytes, suggesting a potential malicious executable being delivered via email.
This detection identifies suspicious child process execution spawned from Notepad++ (notepad++.exe), which may indicate exploitation attempts related to CVE-2026-48778 and CVE-2026-48800. These vulnerabilities involve potential arbitrary code execution through malicious manipulation of Notepad++ configuration (config.xml) and shortcut (shortcuts.xml) files.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
The rule detects abnormal execution of system binaries such as PowerShell, CMD, MSHTA, Rundll32, and Regsvr32 launched from Notepad++, which is not expected in normal user activity. Such behavior may indicate successful exploitation, plugin abuse, or post-exploitation execution triggered via malicious configuration or user interaction.
This detection is intended for identifying early indicators of code execution chains originating from Notepad++.
Detects the execution of known typo-squatted npm packages linked to TeamPCP copycats (Shai-Hulud clones and DDoS botnets). The rule specifically looks for process creation events involving npm, node, or yarn, and then filters for command lines containing specific malicious package names identified in threat intelligence.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
On April 29, 2026, attackers compromised four SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/sqlite, @cap-js/postgres) with a Bun-based credential stealer branded “Mini Shai-Hulud.” The malware harvested developer secrets, created GitHub dead-drop repos, and introduced novel persistence mechanisms in IDE and CI pipelines.
On April 29, 2026, attackers compromised four SAP-related npm packages (mbt, @cap-js/db-service, @cap-js/sqlite, @cap-js/postgres) with a Bun-based credential stealer branded “Mini Shai-Hulud.” The malware harvested developer secrets, created GitHub dead-drop repos, and introduced novel persistence mechanisms in IDE and CI pipelines.
Detects the execution of common browser executables in headless mode with command-line arguments indicative of data exfiltration, malicious rendering (dump-dom), or external requests (http/data:text/html;base64,). This activity, especially when initiated by non-standard parent processes, can be a sign of automated web scraping, vulnerability scanning, or other malicious automated browser activity.
RedSun Detection
Ref: https://www.cyderes.com/howler-cell/redsun-zero-day
Ref: https://www.cyderes.com/howler-cell/redsun-zero-day
Detects the execution of processes from common user-writable directories such as Desktop, Downloads, AppData, Documents, and the Public folder. Adversaries often place and execute malicious payloads in these locations to evade detection and leverage user permissions. This rule helps identify potentially unauthorized or malicious software execution.
This rule detects the execution of specific suspicious executables (ProShow.exe, BluetoothService.exe, Bitdefender Submission Wizard.exe) when they are launched from user-writable directories such as 'Users' or 'AppData'. This pattern can indicate malware execution or persistence, as adversaries often drop and execute malicious payloads in these locations to evade detection and leverage user permissions.
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Rule looking for explorer and the user activity Reg Key indicating interactive commands, along with several malicious indicators around "clickfix" campaigns
Detects when the macOS Script Editor utility spawns an unusual child process.
This alert detects a two stage behaviour associated with ClickFix style social engineering attacks, where a victim is tricked into manually executing a malicious command via the Windows Run dialog (WIN + R).
The first stage monitors the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU), which stores a history of commands entered through the Run dialog. A write to this key containing suspicious strings such as iwr, irm, iex, http, bypass, webdav, or net use indicates a potentially malicious command was executed directly by the user, commonly as a result of being instructed to do so via a fake CAPTCHA, browser prompt, or web page.
The second stage correlates this registry event with outbound network connections initiated by known LOLBINs (Living Off the Land Binaries) such as powershell.exe, cmd.exe, mshta.exe, rundll32.exe, certutil.exe, and others within a 60 minute window. This correlation suggests the Run dialog command successfully spawned a process that attempted to reach out to an attacker controlled infrastructure, potentially for payload staging, C2 establishment, or further tool download.
Alerts firing on the registry write alone (no network match) should be treated as potential initial access attempts and triaged accordingly. Alerts with a correlated network event represent a higher-severity execution chain and should be escalated.
The first stage monitors the RunMRU registry key (HKCU\Software\Microsoft\Windows\CurrentVersion\Explorer\RunMRU), which stores a history of commands entered through the Run dialog. A write to this key containing suspicious strings such as iwr, irm, iex, http, bypass, webdav, or net use indicates a potentially malicious command was executed directly by the user, commonly as a result of being instructed to do so via a fake CAPTCHA, browser prompt, or web page.
The second stage correlates this registry event with outbound network connections initiated by known LOLBINs (Living Off the Land Binaries) such as powershell.exe, cmd.exe, mshta.exe, rundll32.exe, certutil.exe, and others within a 60 minute window. This correlation suggests the Run dialog command successfully spawned a process that attempted to reach out to an attacker controlled infrastructure, potentially for payload staging, C2 establishment, or further tool download.
Alerts firing on the registry write alone (no network match) should be treated as potential initial access attempts and triaged accordingly. Alerts with a correlated network event represent a higher-severity execution chain and should be escalated.
Detects installation and post-installation activity associated with OpenClaw and its known variants — an open-source AI agent family classified as a Potentially Unwanted Application (PUA). Monitors for npm global install commands, execution of shell installer scripts, OpenClaw-related binary or package files written to disk, and outbound network activity originating from known OpenClaw agent processes. Covers 33 known variants of the OpenClaw family including Clawdbot, Moltbot, Ironclaw, MalClaw, and others.
Identifies execution of rundll32.exe with WebDAV functionality (davclnt.dll, DavSetCookie) and UNC paths using @port syntax. This behavior is indicative of remote DLL retrieval over HTTP and may be associated with ClickFix variants abusing LOLBins for payload delivery and execution.
Attackers take advantage of the emojis because they help the content stand out and gets more attention than plain text. It not apply just to Email Subject if not that it also applies to Attachment Files which based on my experience, legitime file not use to have icons in their file names.For example:
📄Invoice.pdf
🔐Reset_Password.html
📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on emails
- Files downloaded from phishing emails
- User-downloaded /opening scam files
- Payloads with social engineering names
📄Invoice.pdf
🔐Reset_Password.html
📦Delivery_Document.zip
This can help find:
- Suspicious files dropped on emails
- Files downloaded from phishing emails
- User-downloaded /opening scam files
- Payloads with social engineering names
Detects known malicious invoice PDFs and email samples used in Crimson Kingsnake campaigns.
Detects execution of a binary from common staging directories shortly after
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
This rule detects processes where an executable file (.exe) attempts to masquerade as a common document, image, or archive file type by including extensions like .pdf, .doc, .zip, .jpg, etc., within its filename, followed by the .exe extension. It specifically excludes executables originating from Microsoft Office root directories to reduce false positives.
This query provides a 360-degree view of a phishing campaign's impact. Starting from a reported email's indicators (sender, subject), it finds all similar emails and correlates them with user actions like URL clicks, attachment interactions on endpoints, replies, and if the emails were zapped by Microsoft. This allows an analyst to quickly scope an incident and determine the extent of compromise.
Page 17 of 26