Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
536 detections
Filters
Last updated
All Time
Detection languages
304
112
24
22
22
Contributors
99
95
78
31
27
Categories
292
129
106
95
67
Platforms
445
61
45
34
21
Products / Services
212
86
43
43
27
MITRE Techniques
18,123
15,639
12,581
8,394
6,215
CVEs
3
2
1
1
1
IDS Classtypes
13
IDS Protocols
7
4
1
1
Mustang Panda conducted a phishing campaign against Myanmar entities using a compromised embassy email. The lure involved a PDF with an embedded URL that delivered a ZIP archive containing a trojanized executable and malicious DLL. The malware disguised itself as a PDF, sideloaded the DLL, established persistence, and executed further payloads. It performed system reconnaissance, data exfiltration via SFTP, and defense evasion.
This detection identifies potential FakeCAPTCHA/ClickFix clipboard hijacking campaigns by looking for PowerShell execution with hidden window parameters and distinctive strings related to fake CAPTCHA verification. These campaigns use social engineering to trick users into pasting malicious PowerShell commands from their clipboard, typically delivering information stealers or remote access trojans.
Detects scenarios where an attacker attemptes to download a payload directly via console.
Detects scenarios where an attacker executes Chrome in headless mode in order to download a payload. Document Object Model (DOM) may also be abused to download obfuscated data from attacker repositary.
No description available.
This rule identifies and analyzes user interactions with URLs embedded in emails, specifically focusing on emails that are either inbound or intra-organizational. It determines which users clicked on URLs within these emails and provides a summary of this activity. This analysis is particularly useful in security contexts, where understanding user behavior regarding potentially risky links can help in identifying phishing attacks or other malicious activities.
This rule detects the installation of potentially unwanted or suspicious applications, specifically looking for a sponsored version of FileZilla. It then correlates this installation with outbound network activity to public IP addresses, which could indicate telemetry, beaconing, data exfiltration, or command and control (C2) behavior.
This detection identifies processes that have executed on a host in the last 7 days but were not observed in the previous 30 days. This is useful for detecting potentially malicious or anomalous activity, such as new software installations, LOLBins, or attacker tools introduced during a compromise.
Detects the mounting of an ISO file, a common technique used by threat actors, including the SLOW#TEMPEST campaign, to deliver malware. ISO files can bypass some security controls and require user interaction (double-clicking) to mount, after which malicious content can be executed.
Detects execution of files from Downloads, Temp, or AppData folders by browsers, indicating potential FileFix attacks where malicious files are downloaded and immediately executed.
Detects Windows Management Instrumentation Command-line (WMIC) execution from browsers, often used in ClickFix attacks for remote process creation or system manipulation.
Detects Windows Script Host execution of suspicious file types from browsers, often used in FileFix attacks to execute malicious VBScript or JScript files.
Identifies processes creating fake error messages with social engineering text, commonly used in ClickFix to convince users they need to “fix” something by running malicious code.
This detection scenario focuses on the abuse of legacy .pif (Program Information File) extensions for malware delivery, execution, and persistence on Windows endpoints. Attackers may use .pif files, sometimes with deceptive double extensions or in user-writable folders, to execute arbitrary code, evade user scrutiny, or persist via the registry, exploiting the fact that .pif files are still natively executable on modern Windows systems.
Algorithm:
- Monitor for .pif file creation in user-writable folders (excluding well-known dev/test tools/processes and paths).
- Detect execution of any .pif file in user-writable folders.
- Detect suspicious child process launch (e.g., scripting engines or LOLBins) from a .pif parent process.
- Detect registry persistence attempts (Run/RunOnce) by .pif processes.
- Suppress false positives by excluding known dev/test folders and processes.
Algorithm:
- Monitor for .pif file creation in user-writable folders (excluding well-known dev/test tools/processes and paths).
- Detect execution of any .pif file in user-writable folders.
- Detect suspicious child process launch (e.g., scripting engines or LOLBins) from a .pif parent process.
- Detect registry persistence attempts (Run/RunOnce) by .pif processes.
- Suppress false positives by excluding known dev/test folders and processes.
KQL Query from file: Detection fake CAPTCHA-based clipboard hijacking
This package searches for evidence of Windows Shortcut (.lnk) files executing code to download a .wsf file from a remote WebDAV share hosted on a trycloudflare[.]com subdomain. This package searches in both web logs and endpoint process logs.
An ongoing malware campaign tracked as SERPENTINE#CLOUD has been identified as leveraging the Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts.
For initial access, the threat actors are luring users to execute malicious .lnk files (shortcut files) disguised as documents to silently fetch and execute remote code.
These payloads use cmd.exe to silently retrieve additional stages over WebDAV (via Cloudflare Tunnel subdomains) and invoke WSF or batch-based droppers.
trycloudflare[.]com allows a threat actor to expose a tunnel to the internet using legitimate infrastructure that will likely blend into benign traffic. trycloudflare dynamically generates subdomains formed of random words and so it's not enough to just look for such connections since they are also used by developers in testing. Therefore this search looks for further procedures attributed to the campaign.
An ongoing malware campaign tracked as SERPENTINE#CLOUD has been identified as leveraging the Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts.
For initial access, the threat actors are luring users to execute malicious .lnk files (shortcut files) disguised as documents to silently fetch and execute remote code.
These payloads use cmd.exe to silently retrieve additional stages over WebDAV (via Cloudflare Tunnel subdomains) and invoke WSF or batch-based droppers.
trycloudflare[.]com allows a threat actor to expose a tunnel to the internet using legitimate infrastructure that will likely blend into benign traffic. trycloudflare dynamically generates subdomains formed of random words and so it's not enough to just look for such connections since they are also used by developers in testing. Therefore this search looks for further procedures attributed to the campaign.
In a ClickFix exploit, a command is silently copied to the clipboard when visiting a compromised web page. The user then pastes it into Windows Run believing it's a captcha or a system fix. The executed command is added to the RunMRU registry key which holds details of Windows Run Most Recently Used. This hunt is intended to identify ClickFix exploits by searching the RunMRU registry key value.
KQL Query
Hunting query to monitor downloads through popular browsers
KQL Query
Detects execution or download of known BERT Ransomware payload hosted at http://185.100.157.74/payload.exe or matching known hash indicators.
Page 21 of 26