Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects various stages of the Armored Likho APT campaign using the BusySnake stealer, including lure archive delivery, NSIS droppers, LNK shortcut abuse, PowerShell-based staging, VBScript persistence, scheduled task creation, reverse SSH tunneling, and exfiltration of browser and communication artifacts.
Detects known malicious files from the Stealth Falcon CURP/DlrtyGames delivery chain by SHA256 hash and by embedded reference to sideloaded/staged module filenames
Detects process creation consistent with CVE-2025-33053 exploitation, where a crafted Internet Shortcut (.url) file sets its target to iediagcmd.exe with a WorkingDirectory pointing to a WebDAV DavWWWRoot UNC path, causing iediagcmd.exe to resolve and launch LOLBins (route.exe, ipconfig.exe, netsh.exe, ping.exe) from the attacker-controlled WebDAV share instead of the legitimate System32 directory.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
Detects the execution of a process named 'Fo-Binary.exe', which is commonly associated with loader activity. This rule monitors process creation events to identify the initialization of this specific binary.
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
Detects the execution of a process named 'Fo-Binary.exe', which is commonly associated with loader activity. This rule monitors process creation events to identify the initialization of this specific binary.
Detects the execution of binaries (exe, dll, msi) or scripts via rundll32/msiexec from the user's Local AppData Temp directory. This behavior is commonly associated with staging and executing secondary payloads by malware such as the Starland RAT, which frequently drops and runs its payloads from these locations to evade detection.
Detects execution/staging of the GodDamn ransomware encrypter binary encrypter-windows-gui-x86.exe from user profile Downloads or Music folders, or matching the known encrypter hash
Detects the execution of binaries (exe, dll, msi) or scripts via rundll32/msiexec from the user's Local AppData Temp directory. This behavior is commonly associated with staging and executing secondary payloads by malware such as the Starland RAT, which frequently drops and runs its payloads from these locations to evade detection.
This rule detects the execution of Java JAR files from suspicious or unconventional directories (such as Temp, AppData, Downloads, or Public folders). It filters out known build tools and CI/CD agents to focus on potentially malicious or unauthorized execution of JAR files that might indicate payload staging or execution in high-risk locations.
Detects the creation of specific file artifacts on disk associated with Stealth Falcon's WebDAV-based delivery and staging infrastructure. The rule looks for filenames characteristic of their simulated 'clickfix' and application update social engineering themes.
This rule detects the abuse of the Windows 'search-ms' URI protocol handler to trigger a search against a remote WebDAV share for '.scr' (screensaver) files. This technique is often used to bypass security controls and trick users into executing malicious binaries hosted on attacker-controlled infrastructure.
Detects process creation consistent with CVE-2025-33053 exploitation, where a crafted Internet Shortcut (.url) file sets its target to iediagcmd.exe with a WorkingDirectory pointing to a WebDAV DavWWWRoot UNC path, causing iediagcmd.exe to resolve and launch LOLBins (route.exe, ipconfig.exe, netsh.exe, ping.exe) from the attacker-controlled WebDAV share instead of the legitimate System32 directory.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. UNC6692 ("Snow Flurries") impersonates IT helpdesk over Teams, lures victims to a fake "Mailbox Repair Utility" page, and delivers a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects the execution of Java processes with a -jar argument where the JAR file is located in a non-standard, user-writable directory (e.g., Temp, Downloads) and the process is initiated by an unexpected parent application (e.g., shell, explorer). This pattern is indicative of the execution of QuimaRAT or similar Java-based malware.
Detects instances where Chrome or Microsoft Edge are launched in headless mode with remote debugging enabled. This configuration exposes the browser's debugging interface, typically on port 9222, which can be leveraged by attackers for browser exploitation, data exfiltration, or persistence within the browser context.
Detects execution of rundll32.exe via shell32.dll,ShellExec_RunDLL that spawns cmd.exe or powershell.exe with command lines containing excessive whitespace (spaces/line breaks). This behavior is characteristic of the exploitation of the CVE-2025-116624 vulnerability in LNK files used to hide the actual malicious command arguments from security monitoring.
Detects the execution of PowerShell commands that attempt to open or process a specific suspicious PDF file named 'Rate_Confirmation_LD-2026-0847.pdf' located in user download directories. This pattern is often indicative of social engineering attempts where a user is tricked into opening a malicious file.
Detects the execution of PowerShell with hidden window or encoded command flags when initiated by common parent processes associated with document editors or scripting hosts, which is a common indicator of malicious macro-based or script-based attack chains.
This rule detects the execution of cmd.exe with a command line argument (/c) spawned directly from common application entry points such as Microsoft Office (Word, Excel, PowerPoint, Outlook) or scripting engines (wscript.exe, cscript.exe). This pattern is a common indicator of malicious macro-based execution, weaponized document exploitation, or script-based secondary payload execution.
Page 45 of 86