Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
This rule detects potential multi-stage loader execution chains where a user mounts an ISO file via Windows Explorer, followed by the execution of LOLBAS binaries (rundll32.exe, regsvr32.exe, or mshta.exe) that exhibit suspicious behavior such as reflective loading or memory allocation commands within a 30-minute window of the ISO mount event.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects a browser process (chrome.exe, msedge.exe, firefox.exe, brave.exe) writing a new, previously-unseen executable to a Downloads/Temp/Cache path and then launching that same executable within minutes — the terminal behavior of SourTrade's in-browser malware assembly pipeline, consistent with local execution of the JSCEAL (WeevilProxy) stealer payload.
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
Detects the execution of tar.exe with passphrase-protected extraction flags (-xf and --passphrase) originating from or operating within a Microsoft Edge User Data directory. This behavior aligns with the 'Edgecution' malware deployment technique, where attackers leverage Edge application paths for staging and executing malicious payloads, as observed in UNC6692 campaigns.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects file-system artifacts from JadeProx spearphishing delivery. The nested _CL_###### staging folder path is treated as the primary, high-confidence indicator on its own. Campaign decoy archive names (Estado de Cuenta.zip, Claude-Pro-Relay-Technical-Overview.zip) are generic business-document-style names that could coincide with unrelated legitimate files, so they only trigger the rule when accompanied by evidence of an LNK shortcut in the same drop (the shared JadeProx LNK machine ID desktop-47cf5k7, or a generic .lnk file) staging the TriBack Loader triad and decoy document.
Detects Chrome/Edge launched with remote debugging port and off-screen window position, matching TAG-195's CDP browser automation.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects the execution of AutoHotkey-based Edgecution malware stagers (set36418917.ahk/.exe) and their associated file-drop events in unusual locations like user temp and downloads folders. This activity is associated with the threat actor UNC6692 following hands-on-keyboard access via Quick Assist.
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Detects the use of PowerShell to perform a fileless download-and-execute operation, characterized by the presence of web-based download cmdlets alongside in-memory execution primitives. This pattern is commonly used for staging malicious payloads such as Cobalt Strike, Sliver, or other offensive tooling while avoiding file-based detection.
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Detects the legacy SourTrade Mark-of-the-Web spoofing variant, where a downloaded file's Zone.Identifier data or an observed network request references the jimmywarting.github.io/StreamSaver.js helper path with an embedded attacker domain, date, and installer.exe filename — used to disguise the true download provenance of browser-assembled malware.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects the execution or presence of the TOKYOCORE ransomware binary by matching its known MD5 and SHA256 file hashes, or by identifying the specific filename 'fsociety.exe'.
Detects the creation and immediate execution of an unsigned binary on a system within two minutes of that system establishing an outbound network connection to port 32768, which is the command and control (C2) port associated with the Dolphin X stealer. This rule aims to identify the behavior of a secondary payload being fetched and launched by the initial loader.
Detects the JadeProx VBS stagers (script.vbs, pdf.vbs, Claude.vbs) launched via wscript.exe only when followed by the known suspicious child-process behavior - either the ftp.exe -s:script.dat alternate trigger, or the wscript.exe-spawned launch of the signed ServiceHub.DataWarehouseHost.exe binary used to sideload TriBack Loader. Matching on the VBS filename alone is too broad since wscript.exe executing .vbs scripts is common for legitimate admin/logon scripting; requiring the parent-child correlation to the follow-on suspicious action narrows the detection to the actual attack chain.
Detects file-system artifacts from JadeProx spearphishing delivery. The nested _CL_###### staging folder path is treated as the primary, high-confidence indicator on its own. Campaign decoy archive names (Estado de Cuenta.zip, Claude-Pro-Relay-Technical-Overview.zip) are generic business-document-style names that could coincide with unrelated legitimate files, so they only trigger the rule when accompanied by evidence of an LNK shortcut in the same drop (the shared JadeProx LNK machine ID desktop-47cf5k7, or a generic .lnk file) staging the TriBack Loader triad and decoy document.
Detects file-system artifacts from JadeProx spearphishing delivery. The nested _CL_###### staging folder path is treated as the primary, high-confidence indicator on its own. Campaign decoy archive names (Estado de Cuenta.zip, Claude-Pro-Relay-Technical-Overview.zip) are generic business-document-style names that could coincide with unrelated legitimate files, so they only trigger the rule when accompanied by evidence of an LNK shortcut in the same drop (the shared JadeProx LNK machine ID desktop-47cf5k7, or a generic .lnk file) staging the TriBack Loader triad and decoy document.
Page 43 of 86