Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the execution of PowerShell commands initiated directly from explorer.exe that contain indicators of the 'ClickFix' attack vector, specifically commands designed to extract data from the clipboard (e.g., Get-Clipboard) or download/execute remote content (e.g., iwr, iex). This activity typically occurs when a user is socially engineered into copying and pasting malicious instructions into the Windows Run dialog.
Detects network traffic containing a potentially malicious Microsoft Excel (.xlsx) OOXML file being downloaded. The rule identifies the presence of the 'Content-Disposition' header with an '.xlsx' extension, combined with a file signature matching the ZIP format (often used by OOXML files) and a file size exceeding 500KB, which may indicate an attempt to exploit CVE-2025-60727.
Detects network traffic containing a potentially malicious Microsoft Excel (.xlsx) OOXML file being downloaded. The rule identifies the presence of the 'Content-Disposition' header with an '.xlsx' extension, combined with a file signature matching the ZIP format (often used by OOXML files) and a file size exceeding 500KB, which may indicate an attempt to exploit CVE-2025-60727.
Detects the creation of unsigned executable files (.exe or .dll) larger than 50MB on an endpoint. This activity is often associated with the staging of large, unsigned, or potentially malicious binaries, which may indicate the deployment of tools for further malicious activity or masquerading.
Detects the execution of .crx Edge extension files where the parent process is Microsoft Teams, often indicating social engineering attacks delivering malicious extensions.
This rule detects the presence of files and processes associated with the 'Exploitarium' proof-of-concept (PoC) toolset. It monitors for specific filenames, process names, and path patterns linked to known harnesses, exploit scripts, and malware families commonly associated with the repository.
Detects the presence of a malicious Electron-based backdoor disguised as the Franz messaging application, commonly associated with the 'ClickFix' campaign. The rule identifies indicators such as a specific C2 endpoint, automated persistence via Electron login item settings, arbitrary JavaScript execution through a 'task.e' sink, and the creation of local persistence files like 'readme.txt' and 'setup.txt'.
Detects a multi-stage execution chain associated with the 'Contagious Interview' campaign, where Visual Studio Code (Code.exe) spawns a shell process (cmd, powershell, bash, or sh) that uses network retrieval utilities (curl, wget, or http) to download content from known Lazarus group staging domains within a two-minute window.
Detects instances where explorer.exe (acting as a parent process due to a user executing commands via the Win+R Run dialog) spawns common command-line interpreters or script hosts (powershell.exe, cmd.exe, mshta.exe, wscript.exe) with suspicious command-line arguments indicative of malicious activity, such as encoded commands, downloader patterns, or file execution proxies. This pattern is consistent with ClickFix-style social engineering attacks where users are tricked into copying and pasting malicious payloads from a webpage into the Run dialog.
Detects the execution of PowerShell with hidden window styles originating from a shortcut (.lnk) file. This behavior is commonly associated with malicious LNK files masquerading as PDF documents, often used as an initial access vector to launch stage-one payloads from temporary directories.
Detects suspicious process executions containing specific obfuscated strings or unique identifiers ('phuditimmer', 'instuite25', 'instuite43', 'instuite67') often associated with malicious tools or downloader activity.
Detects the Yuta .NET WPF dropper (SLaunch.exe) executing and subsequently creating a secondary payload (winupdate.exe) within the AppData\Roaming\.cache directory. This pattern is characteristic of the Yuta/Glove Stealer infection chain where a dropper masquerading as a UI component stages a PyInstaller-compiled stealer binary.
Detects the execution of known malware families (Atlas RAT, RomulusLoader, SilentRunLoader) or processes spawned from temporary directories (AppData/Local/Temp, AppData/Roaming/Temp, Windows/Temp) by common email clients, browsers, and file archivers. This behavior is indicative of a user-initiated execution of a malicious payload, typically associated with phishing or drive-by download attacks.
Detects suspicious use of winget.exe and its associated COM API components (ConfigurationRemotingServer.exe and WindowsPackageManagerServer.exe). The rule monitors for unauthorized child process spawning (e.g., cmd.exe, powershell.exe) by the package manager, execution of manual configuration activation via COM, and use of winget to pull external YAML configurations or non-standard file types, which may indicate software supply chain compromise or abuse of system management tools for payload delivery.
Detects Lunar Client spawning suspicious child processes or command lines, which is characteristic of exploit chains like 'lunar-modrinth-chain-poc'. These attacks typically leverage renderer vulnerabilities to execute shell commands, .lnk files, or arbitrary binaries via abused APIs like shell.openExternal or malicious modpack overrides.
Detects arbitrary code execution attempts against Ghidra 12.1.2 by monitoring for suspicious child process spawning from the Ghidra JVM. The rule identifies instances where java.exe, running in a Ghidra-related context, launches unauthorized binary interpreters or tools such as powershell.exe, cmd.exe, or other shell utilities often used as post-exploitation payloads.
Detects instances where VS Code (Code.exe) spawns interpreter processes (node, python, cmd, powershell, sh, bash) after opening a workspace containing a suspicious tasks.json file. This pattern is consistent with the abuse of VS Code task automation features to gain initial code execution, similar to campaigns targeting developers through malicious repository cloning.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
Detects a suspicious sequence where 7-Zip is used to extract a RAR archive, immediately followed by the creation of executable files (.exe, .bat, .cmd, etc.) in common user-writable directories. This chain often indicates an attempt to bypass Mark-of-the-Web (MotW) protections, as files extracted by archive tools may not inherit the MotW zone information, allowing potentially malicious files to execute without security prompts.
This rule detects when users access or download suspicious file types (specifically .xlsm, .docm, or .ics) from Microsoft SharePoint, Teams, or Exchange, where the filenames contain keywords associated with common phishing lures such as credentials, invoices, payroll, or password resets. This monitors for indicators of potential spearphishing attempts involving malicious documents or calendar invites within the M365 environment.
Detects a suspicious sequence of events involving the creation of an .amazonq/mcp.json file shortly after a git clone operation, followed by an AI coding assistant (Amazon Q, VS Code, Cursor, Windsurf) spawning runtime interpreters (node, npx, python). This behavior aligns with potential exploitation attempts against AI-assisted development environments, such as CVE-2026-12957, where malicious configuration files are used to trigger unauthorized code execution.
Page 47 of 86