Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
This rule detects the execution of known malicious files associated with the FakeGit campaign by matching their SHA256 hashes. Additionally, it identifies suspicious process execution patterns involving 'luau.exe', specifically when it is launched as a standalone process or when initiated by command-line scripts such as .cmd or .bat files.
Detects a sequence of events indicative of an MSI rollback attack, where an attacker triggers an MSI installer error, modifies the associated .rbs (rollback script) file in the C:\Config.Msi folder using a non-msiexec process, and subsequently executes the modified script (poc.cmd) to achieve unauthorized code execution with elevated privileges.
Detects Mach-O ARM64 payloads disguised as legitimate macOS system utilities (CamDriverUpdate.app camera driver updater, Chrome.MediaPatcher) used in the BlueNoroff ClickFix campaign
Detects instances where 7-Zip utility processes (7z.exe, 7zFM.exe, 7zG.exe) or DLLs act as the parent for suspicious child processes such as command interpreters (cmd.exe, powershell.exe) or other binaries running from temporary or download directories. This pattern is commonly associated with the execution of malicious payloads extracted or staged via 7-Zip archives.
Detects instances where the Windows Installer process (msiexec.exe) performs registry modifications (Value Set or Key Creation) within the 'Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages' hive by a non-system user. This activity is indicative of potential malicious installer manipulation or persistence mechanisms involving MSI installers.
Detects instances where the Windows Explorer process (explorer.exe) spawns common script interpreters or command-line tools such as PowerShell, cmd.exe, mshta.exe, wscript.exe, or cscript.exe. This behavior is atypical for normal user activity and is frequently associated with malicious activity, including post-exploitation, code execution, or defense evasion.
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Detects the execution of a specific batch script named 'C:\hello.bat' using the Windows Command Shell (cmd.exe). The presence of this specific script name is considered highly anomalous and potentially indicative of malicious activity or a dropped payload.
Detects high-confidence BoryptGrab-lineage infostealer activity involving fake GitHub delivery indicators, known C2 infrastructure, suspicious gup.exe execution, libcurl.dll side-loading from user-writable paths, and known malicious file hashes.
This rule monitors for file-level artifacts related to the ModHeader browser extension, specifically targeting folder paths and file names that match the extension's unique ID. This is typically used to identify the installation or download of this extension, which has been associated with malicious activity.
Detects process creation consistent with CVE-2025-33053 exploitation, where a crafted Internet Shortcut (.url) file sets its target to iediagcmd.exe with a WorkingDirectory pointing to a WebDAV DavWWWRoot UNC path, causing iediagcmd.exe to resolve and launch LOLBins (route.exe, ipconfig.exe, netsh.exe, ping.exe) from the attacker-controlled WebDAV share instead of the legitimate System32 directory.
Detects file creation, modification, or renaming operations involving .rbs or .rbf files within the 'C:\Config.Msi' directory when the process performing the action is not 'msiexec.exe'. Adversaries may attempt to manipulate MSI rollback or installation files to achieve persistence or execute arbitrary code during the installation process.
Detects network activity associated with BlueNoroff ClickFix campaigns, specifically targeting the download of suspicious Windows PE files from typosquatted CDN/payload URIs. The rule uses session tracking to correlate the initial URI request with the subsequent retrieval of executable content.
YARA signature for the MSI installer's spoofed property data impersonating a legitimate Windows update package, requiring both the spoofed filename and an MSI-internal structural artifact
This rule monitors for the execution of a process with a specific SHA1/MD5 file hash known to be malicious. This is a high-fidelity detection strategy for blocking or alerting on specific threats already identified as malicious in threat intelligence.
Execution of Fo-Binary.exe Loader
Cortex XDR
Detects the execution of a process named 'Fo-Binary.exe', which is commonly associated with loader activity. This rule monitors process creation events to identify the initialization of this specific binary.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
This rule monitors for the execution of a specific process file located within the 'ProgramData' directory that matches a known malicious MD5 hash.
This rule monitors email traffic by aggregating data from email events, attachment information, and URL click interactions. It identifies emails that contain attachments and correlates them with specific file attributes (name, extension, hash, threat type) and any subsequent user interaction with URLs contained within those emails, including blocked or allowed clicks.
This rule monitors process execution events for activity related to known malware families (CryptoLoader, PsStealer, Net.loader, PureRAT) or processes executed from '_MEI' temporary directories. It aggregates events within a 15-minute window per device and user, alerting when two or more distinct processes are identified, which is indicative of malware staging or execution chains.
Detects the execution of binaries (exe, dll, msi) or scripts via rundll32/msiexec from the user's Local AppData Temp directory. This behavior is commonly associated with staging and executing secondary payloads by malware such as the Starland RAT, which frequently drops and runs its payloads from these locations to evade detection.
Page 44 of 86