Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
This rule detects potential malicious activity on macOS where a user or script is prompted to open a legitimate-looking application bundle (decoy) while, in close temporal proximity (within 2 minutes), background processes related to hidden .macos payloads or quarantine flag manipulation via 'xattr' are executed. This is a common pattern for malware to appear legitimate to the user while performing malicious setup or persistence in the background.
Detects the abuse of the Windows ftp.exe utility to execute a local script file provided via the -s flag. Adversaries may leverage this behavior, often triggered by malicious LNK files, to proxy the execution of commands or scripts.
Detects MSBuild process execution originating from command shells loading obfuscated scripts or inline projects associated with PavinLoader.
This rule monitors for scenarios where multiple common GUI applications (such as browsers, explorer, or notepad) are executed in rapid succession (within 2 minutes) from suspicious directories commonly associated with malware staging (e.g., Temp, AppData, or Downloads). This pattern is often indicative of an adversary executing a malicious payload, such as a multi-stage dropper or a file-based installer masquerading as legitimate software.
Detects the abuse of Visual Studio Code (and compatible IDEs like Cursor) workspace trust to trigger malicious tasks upon opening a folder. This pattern is associated with the 'Void Dokkaebi' (Famous Chollima) threat group's propagation of the 'DEV#POPPER' RAT. The rule identifies instances where the code editor spawns common scripting or network utilities (like PowerShell, curl, or Node.js) with command-line arguments indicative of file downloads or execution, as defined in a local '.vscode/tasks.json' file.
Detects malicious markdown files (SKILL.md) that impersonate agent instruction files. These files contain hidden-content constructs (like CSS display:none, HTML comments, or invisible Unicode characters) combined with common command execution patterns (like curl, wget, or PowerShell encoded commands), characteristic of infostealer campaigns targeting AI agent platforms.
Detects Microsoft Teams messages containing specific external domains, which may indicate phishing or unauthorized sharing of malicious links within the organization.
Detects the loading of 'SolidPDFCreator.dll' from a specific 'C:\ProgramData\IDM\logs\' directory by specific executables often associated with potential malicious activity or masquerading. This behavior is indicative of potential DLL side-loading or execution of masqueraded binaries.
Detects attempts to install unsigned MSIX/AppX packages using the -AllowUnsigned parameter via AppXDeployment-Server events
Detects Windows Internet Shortcut (.url) files that contain suspicious lures and direct users to Microsoft device code authentication endpoints (devicelogin), characteristic of ARToken phishing campaigns hosted on anonymous SharePoint shares.
Detects PDF documents that impersonate Notion invitation notifications and incorporate multiple redundant/overlapping URI links. This technique is used by the threat actor DOUBLOON DREDGER to facilitate EvilTokens device code harvesting campaigns.
This rule detects the launch of the Terminal application (Terminal.app) on macOS when initiated by a web browser process such as Safari, Chrome, Firefox, or Microsoft Edge. This behavior is indicative of a potential drive-by download attack or a malicious file execution sequence (e.g., ClickLock stealer) where browser-based interactions lead to the execution of system-level command line interfaces.
Detects the execution of child processes from common Microsoft Office applications (Word, Excel, Outlook) where the command line contains keywords associated with 'job offer' themes. This pattern is consistent with known spearphishing lures used by the Lazarus Group to initiate infection chains.
Detects PowerShell or pwsh processes spawned from Teams.exe with command-line arguments indicative of remote download and execution (e.g. Invoke-WebRequest, curl, encoded commands, IEX, Invoke-Expression, Expand-Archive of a zip archive). This pattern matches the TWINLOOT campaign's initial access chain, in which victims are lured via fake Microsoft Teams messages (T1566.004) into launching malicious content that triggers PowerShell execution (T1059.001) from within the Teams process, consistent with user execution of a malicious link or file (T1204.002).
Detects malicious PDF attachments that masquerade as DocuSign remittance advice notifications. These PDFs contain embedded hyperlinks (via /URI or /Link action annotations) designed to redirect users to malicious external sites rather than legitimate DocuSign services, commonly used in phishing campaigns.
Detects inbound emails containing password-protected archives (rar, zip, 7z) from either common freemail providers or domains matching known social engineering themes (e.g., webinar, interview, research). The rule specifically flags emails where the subject or body includes password hints (e.g., 'pwd', 'extract', 'unzip') indicating an attempt to deliver malicious payloads while evading email gateway inspection.
This rule detects the execution of 'cmd.exe' with specific arguments 'start /max' used to open a file named 'TrainingAnnouncement.pdf'. This pattern is associated with Operation QUICSILVER, where attackers use this specific command line invocation to masquerade a malicious process or backdoor installation as a benign document opening event.
Detects a sequence of events where a user extracts a file (e.g., .zip) using common archive utilities in a user-controlled directory (Temp, Downloads), followed shortly by a web browser accessing a file with that same extracted path and web-related extensions (.htm, .xhtml, .svg). This is a known technique used in phishing campaigns (such as Mirage2FA) to lure victims into opening malicious files or phishing pages masquerading as legitimate content.
Detects AutoIt3.exe launched with a .a3x script argument from a %TEMP%\IXP* self-extraction directory, spawned by WEXTRACT.EXE — the ACRStealer first-stage execution chain (setup_patched.exe IExpress self-extractor deploying an encrypted AutoIt payload).
This rule detects the suspicious execution of the native Windows FTP utility ('ftp.exe') initiated by a shortcut file (.lnk). It specifically looks for the '-s' command-line switch, which is used to execute a script file for non-interactive FTP operations. This pattern is commonly observed in malware campaigns where an adversary uses a shortcut file to trigger a secondary stage of the attack by downloading payloads via FTP scripts.
Detects the execution of msiexec.exe to install specific MSI packages (ManageEngine-OpManager.msi or Advanced-IP-Scanner.msi) when initiated by explorer.exe. This pattern is indicative of user-driven execution, which may be part of an initial access or software deployment workflow.
Page 40 of 86