Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
Detects HTTP requests to domains masquerading as Google Play ('playgoogle.') that are attempting to serve Android application packages (.apk). This is a common indicator of malicious sideloading campaigns using typosquatting to deceive users into downloading fake applications.
This rule detects HTTP GET requests resulting in the download of an Android Package (.apk) file where the host is not a known official Google Play or reputable third-party application distribution source. It further validates the detection by inspecting the HTTP response headers for the specific Android application package MIME type and the response body for indicators commonly associated with fake branded application portals.
Detects the execution of LNK files that use a double extension (e.g., .pdf.lnk) to masquerade as PDF documents. This behavior is indicative of spear-phishing campaigns where malicious shortcuts are delivered via ZIP archives to execute hidden PowerShell commands for secondary stage downloader or persistence mechanisms.
This rule identifies the execution or presence of files matching a known list of MD5 hashes associated with malicious activity. By monitoring file metadata, this rule flags instances where specific identified threat files are present on the system.
This rule monitors endpoint telemetry for known indicators of compromise associated with the Casbaneiro/Ousaban banking trojan. It identifies activity across network connections (IPs and domain patterns), DNS queries for specific C2 domains, and the presence or execution of known malicious file hashes (e.g., PDF lures, HTA, AutoIt scripts, and payload binaries).
This rule detects potential malicious activity by monitoring for known indicators of compromise, including specific SHA256 file hashes, a known malicious IP address, and URLs associated with identified threats. The detection spans file creation/execution, network connections, and URL visits to block or alert on interactions with suspicious infrastructure.
Detects execution chains associated with the SideCopy threat group's ReverseRAT payload. The detection looks for mshta.exe being spawned by common shell processes (explorer, wscript, cmd, powershell) to execute remote HTA content or access 'docsportal.in'. It also monitors for subsequent reflective DLL loading via rundll32.exe or regsvr32.exe, which is indicative of the final ReverseRAT payload activation.
Detects incoming emails containing specific file extensions (.r01, .js) or subject lines/attachments related to a known supply chain lure campaign, where authentication protocols (SPF/DMARC) have failed. This combination of indicators is indicative of LausivLoader malspam delivery.
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
Detects the malicious OIC_Invitation_General_Official.lnk sample used as the entrypoint for PlugX infection chain
Detects the execution or file activity associated with the 'OrionQuests-Setup.exe' installer. This rule monitors both process creation and file system activity to track the presence and usage of this specific installer executable, which may indicate the installation of potentially unauthorized or untrusted software.
Detects the execution of PowerShell with encoded commands or Base64 decoding attempts initiated by common Windows shell applications (explorer, mshta, wscript, cscript) launched from an LNK file. This pattern is commonly associated with malicious LNK shortcuts used as initial access vectors or stage-two downloaders.
This rule detects instances where Adobe Acrobat (Acrobat.exe) is launched by an unusual or potentially obfuscated process (GRrte.exe), specifically when loading a PDF file from a temporary user directory. This pattern is indicative of potential malicious document execution where a PDF is used as a delivery mechanism for malware.
This rule detects the opening of a specific PDF file named 'OIC_Invitation_General_Official.pdf' by Adobe Acrobat. The detection logic triggers either when Acrobat processes this file or when the file itself is identified on the system. This pattern has been associated with the delivery of the PlugX remote access tool, often used in targeted spearphishing campaigns.
Detects the execution of command-line tools (cmd.exe or wscript.exe) spawned by Windows Explorer (explorer.exe) where the command line contains references to .lnk files or specific batch filenames (doxc.bat, config.bat). This behavior is often indicative of malicious shortcut files used to trigger secondary stage payloads.
Detects the suspected RUSTYMOVE activity by identifying the creation of specific malicious files (ZIP and LNK) on the root directory of removable drives, followed by reconnaissance commands targeting removable media volumes.
Detects known malicious SilverFox trojan payloads by matching their SHA256 file hashes. This rule operates on file hashing metadata to identify specific binary artifacts associated with the SilverFox threat actor, regardless of the delivery mechanism or download source.
Detects evidence of the RUSTYMOVE USB-propagation tool, associated with APT36 (Transparent Tribe). The rule identifies the creation of specific staged files (DriverInstaller.zip, DocScanner-11-Aug-2026-5-37pm.pdf.LNK) at the root of removable drives, as well as the creation of a 'log.txt' file on removable media that contains markers indicating successful file copying operations.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
Page 23 of 86