Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects a multi-stage attack chain beginning with the execution of suspicious processes (mstsc.exe, mshta.exe) from email clients or download directories, followed by WinRAR or unrar.exe writing files containing path traversal sequences, and concluding with the execution of a child process from a suspicious directory. This behavior aligns with exploitation attempts targeting vulnerabilities like CVE-2025-8088.
Detects outbound HTTP requests to a known phishing infrastructure panel associated with the Montana Empire malware campaign, specifically targeting the /mentalite.php endpoint on pttvm.com.
Detects the execution of command-line interfaces (cmd.exe, powershell.exe, wscript.exe, mshta.exe) when spawned by common browser processes or Windows Explorer. This is a common pattern for drive-by downloads or malicious scripts executed via the browser, characterized by command lines containing download indicators (e.g., Invoke-Expression, curl, certutil, encoded commands).
This rule monitors email gateway and EDR telemetry for indicators associated with the CastleLoader malware and the EvilTokens phishing campaign. It flags specific keywords in email subjects, filenames, sender domains, and URLs, as well as suspicious binary execution patterns and child processes spawning from common office applications or web browsers.
Detects Microsoft Office applications (Word, Excel, PowerPoint, OneNote) launching command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This pattern is often associated with macro-based malicious code execution.
Detects the creation of potentially malicious executable or script files (.exe, .lnk, .vbs, .ps1, .hta) or autorun.inf files on removable drives (D-Z) initiated by common script interpreters or suspicious processes. This activity is then correlated with prior detections of Gamaredon (ACTINIUM/Primitive Bear) implant activity, such as Ptero-family malware, specific obfuscated PowerShell patterns, or HTML smuggling delivery via mail/Office clients on the same host within a 24-hour window.
Detects the creation of a file named 'bootTel.dat' directly in the root of the C: drive. This file name is historically associated with various malware families and potentially unwanted programs, and its creation in a system-protected directory root is often indicative of persistence mechanisms or suspicious stage-one dropper activity.
Detects the TONResolver RAT infection chain, where PowerShell is used to download the Node.js runtime to a non-standard directory under AppData\Local\Nodejs, followed by the execution of a JavaScript payload. This behavior is associated with campaigns utilizing Cloudflare-proxied (.cfd) domains to distribute malicious components.
Detects instances where a browser or email client spawns a PowerShell process containing common obfuscated command-line arguments (e.g., -enc, IEX, bypass), which then subsequently executes node.exe or wscript.exe. This pattern is characteristic of the TONResolver infection chain, where a phishing lure triggers initial code execution via browser or email client to deploy a JavaScript-based RAT.
Detects ClickFix social engineering lures where a web browser spawns script interpreters (cmd.exe, powershell.exe, or mshta.exe) with command-line arguments indicative of malicious activity, such as base64-encoded payloads, remote download cradles, or execution with hidden window flags.
This rule detects potentially unauthorized installation of extensions in Visual Studio Code (VSIX) or plugins in JetBrains IDEs (IntelliJ, PyCharm, WebStorm). It flags installations that do not originate from verified official marketplaces, which may indicate the manual installation of malicious or supply-chain compromised development environment extensions.
This rule detects potential credential harvesting or malware delivery by identifying an email client (e.g., Outlook) launching a PDF reader, which subsequently executes a web browser. This sequence is a common indicator of a user interacting with a malicious link or 'Sign' button inside a PDF attachment opened directly from an email.
Detects the creation of Model Context Protocol (MCP) server configuration files (e.g., mcp.json) in workspace directories triggered by process executions typically associated with package installation tools such as npm, npx, pip, or python. This behavior can indicate the installation of a malicious or typosquatted package designed to register a malicious MCP server and facilitate credential theft or unauthorized access.
Detects a multi-stage attack where an adversary uses a fake job interview theme to lure a user into cloning a malicious repository. The repository contains a Model Context Protocol (MCP) configuration file that, when opened in an IDE like VS Code, Cursor, or Windsurf, leads to the execution of unauthorized or suspicious child processes.
Detects Visual Studio Code or Cursor IDE spawning interpreter processes like node.exe or python.exe. This behavior is indicative of a malicious .vscode/tasks.json configuration leveraging the 'runOn': 'folderOpen' feature to achieve automatic execution of code upon opening a workspace, a technique associated with the Lazarus Group 'Contagious Interview' campaign.
Detects potential execution chains related to QR code phishing (Quishing) by monitoring for suspicious process creation or outbound network connections originating from document readers, office applications, and QR scanner utilities. It covers three primary vectors: suspicious process spawning (e.g., Office apps launching cmd or powershell), non-standard network connections from document readers, and malicious URL-based LNK files spawned via explorer.exe.
Detects the execution of known living-off-the-land binaries (LOLBins) such as mshta.exe, certutil.exe, bitsadmin.exe, wscript.exe, or cscript.exe directly by explorer.exe. This pattern is indicative of a user-initiated execution, potentially triggered by social engineering lures like the 'ClickFix' technique, where a user is tricked into pasting and running malicious commands in the Windows Run dialog or a command prompt context.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
Detects the creation or modification of specific suspicious .pyd files (Python extension modules) within temporary directory paths, excluding legitimate processes or publishers associated with Python Software Foundation or Microsoft Corporation. This behavior is indicative of potential side-loading or persistence mechanisms involving malicious Python extensions.
Detects the creation of .ics calendar invitation files in common user download and temporary directories when originated by web browsers or Microsoft Outlook. This pattern is often indicative of spearphishing campaigns where attackers use weaponized calendar files to deliver malicious payloads or links, attempting to exploit users through social engineering.
Page 50 of 86