Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
This rule detects HTTP GET requests for specific file paths associated with known malicious lure archives (e.g., YEPlayer.rar, Pis2rayVPN.zip, YEMPlayer.msi). These files are typically used in social engineering campaigns to trick users into downloading and executing malware.
Detects the execution of a malicious MSI installer masquerading as a legitimate Microsoft FIXMAPI utility. The rule flags suspicious MSI command lines or the presence of the AICustAct.dll component (associated with Advanced Installer) within paths containing the misspelled publisher 'Microsoft Coporation' or the 'Microsoft FIXMAPI' utility string.
Detects execution of JavaScript files using a deceptive .pdf.js double-extension via Windows Script Host (wscript.exe/cscript.exe) that subsequently launch PowerShell. This activity is indicative of the initial stage of the VEIL#DROP attack chain used to deliver payloads like PureLog Stealer.
Detects the execution of executable files from user-specific directories (Downloads, Desktop, Temp) that match common naming patterns associated with illicit software, such as cracks, keygens, or pirated tools. This is often an indicator of users attempting to run unauthorized software, which may carry secondary malware.
Detects instances where common productivity (e.g., Office) or web browser applications spawn PowerShell.exe with suspicious command-line arguments often associated with malicious script execution or obfuscated code downloaders, such as '-w hidden', '-nop', or '-enc'.
Detects instances where PowerShell is executed via the Windows Run dialog (explorer.exe), utilizing common download-cradle patterns (IEX/Invoke-Expression and Invoke-RestMethod) typically associated with ClickFix clipboard-hijacking social engineering campaigns.
Detects the execution of an executable file that was immediately launched by 7-Zip (7z.exe or 7zG.exe) after processing a file, characteristic of a Mark-of-the-Web (MOTW) bypass exploit involving RAR5 archives. By extracting files from these archives, the 7-Zip process can inadvertently strip or prevent the assignment of the Zone.Identifier Alternate Data Stream, allowing the payload to bypass SmartScreen security prompts.
Detects a malicious HTA lure disguised as a military pay calculator. The attack involves a JScript routine that renames an embedded data file ('styles.dat') to an executable ('styles.dat.exe') and triggers its execution, characteristic of a spearphishing attachment delivering malware.
Detects the execution of Microsoft Quick Assist (or related Remote Desktop clients) shortly after activity from Microsoft Teams. This pattern is consistent with social engineering tactics where an attacker impersonates IT personnel over a Teams call to persuade a victim to provide remote access to their workstation.
Detects the creation of specific shortcut files (.lnk) or the use of WScript.Shell and CreateShortcut methods within PowerShell, associated with the VILE ransomware's fake decryptor lure technique.
Detects the extraction of executable, script, or macro-enabled files from archives using 7-Zip utilities. This behavior is notable because 7-Zip often fails to propagate the Mark-of-the-Web (MotW) Zone.Identifier Alternate Data Stream (ADS) to extracted files, which can bypass Windows SmartScreen and security zone protections upon subsequent execution of the extracted files.
Detects the ClickFix kill chain where a web browser process (e.g., Chrome, Edge, Firefox) spawns a command shell or utility (cmd.exe, powershell.exe, mshta.exe) to execute a download cradle or deploy known payloads like NetSupport RAT. This behavior is typically associated with malicious CAPTCHA prompts that deceive users into pasting and executing commands via the Windows Run dialog.
This rule detects scenarios where Microsoft Office applications (Word, Excel, Outlook, PowerPoint, OneNote) spawn known suspicious child processes (LOLBAS) that exhibit command-line flags indicative of remote content retrieval or script execution (e.g., download strings, encoded commands) and subsequently initiate network connections to public IP addresses or URLs within a 15-minute window.
Detects the creation or modification of a .vscode/tasks.json file, followed by the execution of a process (specifically node.exe) that targets a script file without a standard JavaScript extension (.js, .mjs, .cjs). This behavior is consistent with an adversary configuring a hidden VS Code task (e.g., using 'hide:true' and 'runOn:folderOpen') to silently execute arbitrary code or assets when a project folder is opened.
Detects the presence, file creation, or execution of known proof-of-concept (PoC) scripts, binaries, and directories associated with the exploitation of the libssh2 CVE-2026-55200 vulnerability.
Detects the execution of 'client32.exe', which is the executable for NetSupport Manager remote control software, when it is located outside of its standard installation directory. This can be indicative of a portable or unauthorized remote access tool being deployed by an adversary for persistence or command-and-control.
Detects the spawning of cmd.exe from common user-facing applications (e.g., Microsoft Office, web browsers, PDF readers) with command line arguments containing '/c'. This behavior is frequently associated with malicious document execution, drive-by downloads, or other initial access techniques where an attacker attempts to break out of the application sandbox to execute secondary payloads or perform reconnaissance.
Detects the execution of command-line utilities (cmd.exe, powershell.exe, wscript.exe, curl.exe) when launched directly from a web browser or associated web-related processes (e.g., chrome.exe, msedge.exe). This pattern is often indicative of drive-by downloads or malicious web content attempting to execute code on the endpoint.
Detects artifacts, execution patterns, and post-exploitation behaviors associated with the exploitation of the libssh2 heap out-of-bounds write vulnerability (CVE-2026-55200). The rule monitors for the presence of known proof-of-concept files, malicious SSH server orchestration via Python, outbound network traffic to the PoC's default non-standard port (2222) from SSH-capable applications, and post-exploitation shell or calculator spawns.
Detects Bumblebee loader delivery via trojanized MSI installers. The rule identifies suspicious process chains originating from common web browsers, identifies DLL side-loading or loader execution from msiexec.exe child processes in temporary directories, and flags network connections to known Bumblebee delivery domains.
This rule detects the extraction of files from RAR5 archives using 7-Zip (7z.exe/7zG.exe), followed closely by the execution of a file from a user-writable directory (e.g., Downloads, Temp, AppData). This behavior is characteristic of an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted from certain container formats may not inherit the original MotW Zone.Identifier alternate data stream, potentially allowing malicious files to execute without standard Windows security warnings.
Page 46 of 86