Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the ClickFix-style social engineering technique used in the UNC6692 campaign where a victim, prompted via fake 'Outlook Version Verification' / 'OS Version Verification' buttons on a phishing page, is coerced into pasting a clipboard-copied batch or PowerShell script into the Windows Run dialog for execution.
Detects execution artifacts of the ChainDrop (Shai-Hulud) npm supply-chain campaign on endpoints. The campaign abuses npm `preinstall` lifecycle hooks in compromised packages to run `setup.mjs`, which downloads a Bun runtime and executes the `Math_Symbol.js` / `math_init.js` payload for credential and token theft.
The query matches on two signals:
- **CampaignArtifact (High)** — the filenames `setup.mjs`, `Math_Symbol.js` or `math_init.js` appearing in either the process or parent process command line. Effectively unique to this campaign; `setup.mjs` has occasional legitimate use and is verified via the repository path.
- **BunFromNodeModules (Contextual)** — `bun.exe` spawning child processes from a `node_modules` path. Covers the case where `setup.mjs` downloads and invokes Bun internally, leaving no URL or version string in process telemetry. Also survives a variant renaming the payload files.
Set `IncludeBunBranch = false` to drop the contextual branch; the remaining artifact branches are low-volume and suitable for scheduled execution. Leave it enabled for manual hunts. Baseline Bun usage across the developer estate before scheduling with the branch on.
**Coverage limits:** endpoint execution only. Does not cover the initial package download, GitHub Actions workflow injection, or exfiltration to attacker infrastructure. Pair with the SHA256 file-hash query for pre-execution detection.
The query matches on two signals:
- **CampaignArtifact (High)** — the filenames `setup.mjs`, `Math_Symbol.js` or `math_init.js` appearing in either the process or parent process command line. Effectively unique to this campaign; `setup.mjs` has occasional legitimate use and is verified via the repository path.
- **BunFromNodeModules (Contextual)** — `bun.exe` spawning child processes from a `node_modules` path. Covers the case where `setup.mjs` downloads and invokes Bun internally, leaving no URL or version string in process telemetry. Also survives a variant renaming the payload files.
Set `IncludeBunBranch = false` to drop the contextual branch; the remaining artifact branches are low-volume and suitable for scheduled execution. Leave it enabled for manual hunts. Baseline Bun usage across the developer estate before scheduling with the branch on.
**Coverage limits:** endpoint execution only. Does not cover the initial package download, GitHub Actions workflow injection, or exfiltration to attacker infrastructure. Pair with the SHA256 file-hash query for pre-execution detection.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
This rule detects the execution or presence of known malicious JavaScript loader files identified as part of a banking-lure phishing campaign by matching their SHA256 file hashes.
Detects Shai-Hulud / ChainDrop activity by correlating known malicious hashes, npm/Node/Bun execution, payload artifacts, IDE persistence, credential discovery, cloud metadata access, GitHub exfiltration, C2 domains, Ethereum RPC activity, staging files, persistence artifacts, and known IOC IP connections.
This rule detects the potential replacement of legitimate cryptocurrency wallet applications (Ledger, Trezor, Exodus) by monitoring for the download of zip archives from suspicious paths containing 'zxc' using curl, followed by the creation or modification of files within known wallet application directories. This activity is indicative of a trojanized application delivery mechanism, often associated with info-stealer campaigns.
Detects the execution of unsigned JavaScript (.js) files using the Windows Script Host (wscript.exe). Adversaries often use JavaScript for initial execution or as a secondary payload, and obfuscation is commonly applied to these scripts to evade detection.
This rule detects file creation and process execution events involving strings associated with the Solidity-Pro tool, which is known to be used as a C2 mechanism or malicious component. It specifically triggers on files with these patterns and processes spawned by or related to 'Code.exe' (VS Code) utilizing these malicious strings in their command lines.
Detects file, process, or image-load events in Microsoft Defender XDR where the file hash or initiating-process hash matches known Coinbase Cartel-related hash indicators.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
This rule detects potential multi-stage loader execution chains where a user mounts an ISO file via Windows Explorer, followed by the execution of LOLBAS binaries (rundll32.exe, regsvr32.exe, or mshta.exe) that exhibit suspicious behavior such as reflective loading or memory allocation commands within a 30-minute window of the ISO mount event.
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)
Detects CountLoader's taskType 9 USB-worming behavior: a recently created/modified .lnk file on a non-system drive followed by mshta.exe execution referencing that .lnk with a remote HTTP(S) URL.
Detects known CornFlake and ChocoShell malware binaries by exact full SHA-256 hash of executable files (file-write/process-creation scope), not incidental hash string mentions
Detects DeviceManager RAT stager delivered as a Delphi-compiled Inno Setup installer requiring the /SL5 IPC relaunch flag together with an appended high-entropy overlay, plus optional is-DWA04JDXUI.tmp / MicroUpdaterV1.exe indicators, to reduce false positives from benign Inno Setup installers that also use /SL5
Detects instances where a web browser process creates a new executable file (.exe) in the 'Downloads' folder without a corresponding network connection event recorded by the browser to an executable URL. This pattern is indicative of potential in-browser assembly of a malicious file or an executable being dropped via non-standard browser download pathways, such as through local file system manipulation or hidden secondary processes.
Detects a multi-stage execution chain involving a malicious LNK file that triggers PowerShell. The rule specifically looks for PowerShell commands spawned by explorer.exe or mshta.exe that contain indicators of string deobfuscation (using .Replace), specific job-related keywords (CoreJob), or remote content retrieval (Net.WebClient.DownloadString). The detection correlates these process events with the presence of suspicious LNK files and decoy document files dropped within the temporary directory on the same endpoint.
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects a downloaded archive that does not begin with the standard ZIP local file header 'PK' magic bytes yet still contains valid ZIP central directory or end-of-central-directory signatures alongside Edgecution-specific package content (extension/background.js path, embedded python-3.13.3-embed-amd64-with-pip.zip runtime, or the com.ppeasqabfpxcz.api native messaging host id), consistent with the Edgecution/UNC6692 technique of stripping PK bytes from archives (e.g. patch3265343.a) before an AutoHotkey stager reconstructs bsvqikydknqqk.zip by prepending 0x50 0x4B at runtime
Matches known Larva-24009 (HeptaX) malicious file hashes
Page 42 of 86