Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the execution of ClickOnce applications (via dfsvc.exe, rundll32.exe with dfshim.dll, or by opening .application/.appref-ms files) that are being launched from a remote web or file share source. This behavior is a common technique for proxying malicious code execution.
Detects the creation of .ics calendar invitation files in common user download and temporary directories when originated by web browsers or Microsoft Outlook. This pattern is often indicative of spearphishing campaigns where attackers use weaponized calendar files to deliver malicious payloads or links, attempting to exploit users through social engineering.
Detects the execution of the AdaptixC2 agent (AdgNsy.exe) from AppData\Local directories and its subsequent internal network scanning activity against sensitive ports (445, 3389, 5985). The rule also monitors for potential dropper patterns associated with the Bumblebee loader, specifically involving processes like consent.exe or msiexec.exe dropping the binary.
Detects potential BaoLoader drive-by compromise attempts by monitoring two stages: first, the creation of executable files in temporary or application data directories by browser processes; and second, the execution of command-line shells by processes running from those same directories where the browser acted as the grandparent.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects the use of the native Windows tar.exe utility to silently extract ZIP archives into the AppData directory. This behavior is associated with the Potemkin Loader, which often uses this technique to stage malicious payloads after downloading them.
Detects the execution of suspicious files that exhibit characteristics of finance-themed malware droppers. This includes files with known malicious MD5 hashes, specific internal file metadata (original filename, file description, product name), or filenames masquerading as financial documents (e.g., 'GST Debit Note', 'RTGS_IMPS') with an executable extension like '.com'.
This rule detects potentially unauthorized installation of extensions in Visual Studio Code (VSIX) or plugins in JetBrains IDEs (IntelliJ, PyCharm, WebStorm). It flags installations that do not originate from verified official marketplaces, which may indicate the manual installation of malicious or supply-chain compromised development environment extensions.
Detects the execution of common command-line utilities (cmd, powershell, wscript, cscript, mshta, certutil) directly spawned by Microsoft Office applications (Word, Excel, PowerPoint, Outlook). This is a common indicator of macro-based attacks or other exploit delivery chains where Office documents are used to execute malicious payloads.
Detects the execution of msiexec.exe spawned by WinRAR or unrar processes, specifically targeting the installation of STOCKSTAY payloads. This activity is indicative of exploitation of the WinRAR path traversal vulnerability (CVE-2025-8088), where attackers extract malicious MSI files to unauthorized locations to bypass security controls and achieve code execution.
This rule detects a multi-stage attack chain on macOS involving a browser or mail client spawning a shell to download a file (DMG) via curl/wget, followed by the mounting of that disk image, execution of an application bundle from the mounted volume, and a subsequent outbound network connection from that application. This behavior is indicative of a user-initiated malware execution chain.
Detects the creation of an executable file (.exe, .scr, .com, .pif) in user-writable directories (Temp, AppData, ProgramData) followed by the immediate execution of that same file. This is a common pattern for malware droppers where a file is dropped to disk and subsequently executed to initiate the next stage of an attack.
This rule monitors for the creation of .exe or .msi files within common user-writable directories (Downloads, Temp, AppData) initiated by web browser processes (Chrome, Edge, Firefox, Brave). This behavior is often indicative of drive-by downloads or users interacting with malicious web content that delivers installers to the host.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
This rule detects a sequence of suspicious activities on macOS: downloading a file from a potentially malicious source using curl, mounting a disk image using hdiutil, and subsequently opening files from the mounted volume. This pattern is commonly associated with the delivery and execution of malicious payloads, such as trojanized software or malware installers.
Detects suspicious reconnaissance activity involving multiple common Windows discovery tools (nltest, net, dsquery, ipconfig, whoami, systeminfo) executed within a short time window (5 minutes) that was preceded (within 30 minutes) by a command shell (powershell.exe or cmd.exe) spawned by a web browser or common script-based execution engine (e.g., mshta.exe). This pattern is indicative of a post-exploitation phase where an attacker, having gained execution via a browser-based delivery method, performs environment discovery.
This rule detects the creation of .lnk files in common suspicious directories (such as startup folders, Temp, or Downloads) followed by the execution of common scripting or command interpreters (powershell.exe, mshta.exe, wscript.exe, cmd.exe) with long command lines within a 10-minute window. This behavior is often indicative of an adversary attempting to achieve persistence or execute malicious payloads via user interaction.
Detects instances where PowerShell is spawned directly from Microsoft Teams processes or via explorer.exe shortly after receiving an external chat message in Teams. This pattern is often associated with social engineering lures, such as the 'paste-and-run' attack chain used to facilitate malicious activity.
This rule detects a multi-stage attack chain where a WinRAR or UnRAR process, spawned by an email client (Outlook or Thunderbird), extracts files directly into the Windows startup directory. It then correlates this with the execution of common scripting or command-line tools (such as mshta, wscript, powershell, or cmd) from that same startup location within 30 seconds of the extraction event.
Detects instances where the WinRAR process (winrar.exe) spawns common script interpreters or command-line shells, including mshta.exe, wscript.exe, cscript.exe, powershell.exe, or pwsh.exe. This behavior is often indicative of an adversary attempting to execute malicious code embedded in or extracted from a compressed archive.
Detects execution patterns associated with the Gamaredon group's spearphishing chains, specifically where PowerShell is invoked by common document or scripting applications (Winword, Excel, mshta, etc.) containing typical downloader flags (IEX, EncodedCommand). Additionally, it monitors for network connections from PowerShell to known dead-drop resolvers (e.g., telegra.ph, cloudflare workers) used by PteroOdd/Kazuar loaders.
Page 53 of 86