Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
This rule detects the creation of specific mutexes, 'Little further', which are known to be associated with the D3F@ck loader. The detection is based on monitoring process creation events on Windows systems for these particular mutex names. The rule aims to identify the presence and activity of the D3F@ck loader by flagging these unique mutexes.
Detects known mutexes associated with Cyst loader activity. The rule specifically looks for mutex names matching the pattern 'syst' followed by exactly 10 digits.
Detects known mutexes associated with CastleLoader activity. The rule specifically looks for the mutex name '10KCnWHtIoABhkL2Cl3u' during process creation events.
Detects known mutexes associated with BBTok loader activity. The rule specifically looks for the mutex names 'TiiSbtvhvbCMW' and 'KOKKIIKKKOOOO' during process creation events on Windows systems.
This rule detects the presence of specific mutex names that are known to be associated with BazarLoader malware activity. The rule looks for two distinct mutex names: '{b837ef4f-10ee-4821-ac76-2331eb32a23f}' and '{0caa6ebb-cf78-4b01-9b0b-51032c9120ce}'. The detection is triggered when a process creates or attempts to create a mutex with either of these names. This activity is indicative of BazarLoader execution on a Windows system.
This rule detects the creation of specific mutex names associated with the Matanbuchus loader. The rule looks for mutexes matching the pattern 'sync<UniqueID>', where <UniqueID> is a variable string. This activity is indicative of Matanbuchus loader execution.
The rule detects the creation of processes that utilize specific mutex names associated with MagnetLoader malware. It specifically looks for the mutex name 'SM0:220:304:WilStaging_02_p1h'. Detection of this mutex name indicates potential MagnetLoader activity on the system.
Archive or browser/Office recently opened then child process is executable from user temp or downloads. AI/crypto social engineering campaigns often use ZIP with double-extension executables.
This rule detects the execution of PowerShell, pwsh, mshta, or curl initiated by explorer.exe (specifically from the Run dialog) when the command line contains indicators of web requests, expression invocation, or encoded commands. This behavior is often associated with the 'ClickFix' social engineering technique, where users are tricked into running malicious one-liners from the Windows Run dialog. The rule looks for common PowerShell commandlets like 'Invoke-WebRequest', 'Invoke-Expression', or their aliases, as well as '-EncodedCommand' or methods like 'DownloadString' and 'FromBase64String', indicating an attempt to fetch and execute remote content or obfuscated commands.
This rule detects the execution of script hosts (PowerShell, wscript, cscript) that are launched by either the Windows Run dialog (rundll32, dllhost) or common web browsers (Chrome, Microsoft Edge, Firefox). The script host execution is further narrowed down by looking for command-line arguments indicative of script execution, such as encoded commands or invocation of functions like 'Invoke-' or 'IEX('. This pattern is often associated with the 'ClickFix' social engineering technique where users are tricked into pasting malicious commands into the Run dialog or clicking links that trigger script execution from a browser.
This rule detects the execution of 'notepad.exe' specifically when it is launched from the WindowsApps directory (excluding version '11.2510') and its command line arguments include the string '.md'. This combination suggests an attempt to open or process Markdown files using a specific, potentially non-standard, version of Notepad. This could indicate unusual user activity, a misconfigured application, or potentially malicious activity involving Markdown files, such as data exfiltration or execution of embedded content.
Detects execution of renamed instances of Microsoft Word from the Downloads directory, which may indicate masquerading or malicious delivery.
CrowdStrike Query – Potential Notepad Abuse via WindowsApps
Detects execution of notepad.exe from the Windows Apps directory (excluding version 11.2510) with command-line arguments containing “.md”. This behavior may indicate invocation of a non-standard Notepad build for Markdown file handling, potentially linked to application misconfiguration or malicious activity.
Detects execution of notepad.exe from the Windows Apps directory (excluding version 11.2510) with command-line arguments containing “.md”. This behavior may indicate invocation of a non-standard Notepad build for Markdown file handling, potentially linked to application misconfiguration or malicious activity.
Detects instances where the Windows 11 Notepad process (Notepad.exe) spawns unexpected child processes. This behavior is a primary indicator of the CVE-2026-20841 exploitation via malicious Markdown links, which allows for remote code execution.
This detection identifies a pattern associated with the 'ClickFix' social engineering technique, where a user is tricked into copying a malicious command and pasting it into a PowerShell terminal. The query correlates a recent clipboard operation with a subsequent suspicious PowerShell execution by the same user on the same device.
This rule detects potential exploitation of CVE-2026-21509, a Microsoft Office security bypass vulnerability. It specifically looks for Microsoft Office applications (Word, Excel, Outlook) spawning 'reg.exe', 'regsvr32.exe', 'cscript.exe', or 'wscript.exe' with command-line arguments indicative of COM object registration or manipulation, such as 'CLSID', 'InProcServer32', 'prnfldr', or 'DllInstall'.
Detects the creation or modification of a `.vscode/tasks.json` file that is configured to automatically run a task when a folder is opened.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Detects file creation or process execution events where the observed SHA256 matches known EchoGather backdoor or associated XLL loader samples linked to the Paper Werewolf (GOFFEE) threat group. This is a high-confidence IOC-based detection. Use it for rapid triage and scoping; follow up with behavioral detections for durable coverage.
The rule detects the execution of a suspicious executable named 'sohuva_update_*.exe' from user-writable or download paths (Temp, Downloads, AppData, or ProgramData\Microsoft\MF). This execution is considered suspicious if its parent process is typically a web browser or explorer.exe, or if the parent process itself originates from one of these suspicious paths. The rule explicitly excludes legitimate executions of 'sohuva_update_*.exe' from standard 'Program Files' directories associated with Sohu installations.
The goal of this detection is to alert on activity associated with the ClickFix social engineering technique, where a user is coerced into manually executing attacker-controlled commands via the Windows Run dialog after interacting with a malicious website reached through a phishing email. More details can be found in the reference URL linked below
Detects execution of the VIMC UNITY campaign trojan/loader. The malware is delivered via phishing email with subject "VIMC UNITY --LUMUT PORT LAYTIME" and attachment VIMC UNITY.gz (gzip containing the PE). The binary masquerades as or abuses Java Control Panel (javacpl.exe).
Page 19 of 26