Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects instances where specific DLLs known to be abused in malicious contexts (libwebp.dll, mingwm10.dll, libffi-6.dll, libpng15.dll) are loaded by common productivity and scripting processes, such as Microsoft Office applications (Word, Excel, Outlook) or scripting engines (wscript.exe, mshta.exe). This pattern is often indicative of side-loading or exploitation of malicious documents and scripts.
Detects the execution of suspicious binaries spawned by the Windows script hosts (wscript.exe, cscript.exe) from the AppData directory. This pattern is indicative of the Grandoreiro banking trojan, which masquerades as an Adobe Reader update prompt and drops its payload into temporary folders to execute.
Detects a potential exploitation chain where 7-Zip is used to extract files from a RAR5 archive in a way that strips Mark-of-the-Web (MOTW) NTFS alternate data streams. The rule specifically monitors for 7z.exe launching with a .rar archive in the command line followed by the execution of potentially malicious files (executables, scripts, etc.) from user-writable directories shortly after.
Detects file creation events associated with the UAC-0226 campaign, specifically targeting Ukrainian military-themed lures and staging artifacts related to the GIFTEDCROOK malware. This rule monitors for the presence of specific file paths and naming conventions indicative of ongoing espionage operations.
This rule detects activity associated with a known malicious campaign involving 'Photo ZIP' themed lures. It identifies DNS queries to actor-controlled domains, the spawning of PowerShell by Explorer.exe with command lines referencing photo-related filenames or external file-sharing services, and the subsequent downloading of the node.exe runtime to user-accessible directories (consistent with TonRAT delivery).
Detects instances where explorer.exe launches a PowerShell process originating from an LNK file, which then performs a remote download of a Node.js runtime and JavaScript implant (TonRAT) to standard Windows temporary or application data directories. This activity is indicative of the TonRAT campaign targeting hospitality front-desk systems.
Detects the creation or modification of the .amazonq/mcp.json file in a workspace directory. This file is automatically loaded by the Amazon Q VS Code extension and can be leveraged to achieve remote code execution (RCE) via malicious MCP server command definitions as documented in CVE-2026-12957.
Detects the execution of a specific malicious executable (COU_ITR-1_to_4_AY2026-27.exe) identified as part of the Operation DragonReturn spearphishing campaign. The campaign impersonates the Indian Income Tax Department to lure users into executing the file.
This rule detects the execution of potentially malicious commands launched directly from the Windows File Explorer address bar. By analyzing DeviceProcessEvents, it identifies when explorer.exe spawns common command-line utilities (powershell.exe, cmd.exe, etc.) with arguments often associated with malicious activity, such as remote script downloads, encoded commands, or bypass flags.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run JavaScript (.js) or VBScript (.vbs) files located in common user-writable directories such as Temp, AppData, Downloads, or Documents. This pattern is commonly associated with the execution of malicious scripts dropped as part of phishing attacks or initial access vectors.
This rule monitors for processes named 'setup.exe' executing from user-writable directories (e.g., AppData, Downloads, Temp) that load unsigned or non-Microsoft DLLs from the same suspicious directories. This pattern is commonly associated with DLL side-loading or malicious installation attempts where a process attempts to load illegitimate code from local user space.
Detects a self-extracting 7-Zip archive that exhibits characteristics of a downloader, specifically looking for the presence of '7-Zip' strings, WinINet API calls ('WinINet', 'InternetReadFile') for downloading, and 'CreateProcessW' for launching child processes. It also looks for the string 'AppData\Local\Programs', which could indicate an installation path. The rule targets executable files (MZ header).
Detects the creation of an executable file (.exe, .scr, .com, .pif) in user-writable directories (Temp, AppData, ProgramData) followed by the immediate execution of that same file. This is a common pattern for malware droppers where a file is dropped to disk and subsequently executed to initiate the next stage of an attack.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launching common shell or utility processes (cmd, powershell, wscript, cscript, mshta, regsvr32, rundll32). This behavior is a common indicator of macro-based attacks or malicious document execution where Office applications are abused to launch secondary payloads or execute code.
Detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run script files (.vbs, .js, .wsf, .hta) located in commonly abused writable directories such as Temp, AppData, Downloads, or ProgramData. This behavior is indicative of a malicious actor executing scripts that have been dropped onto the system as part of a phishing campaign or other attack vector.
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
This rule detects when the Microsoft Teams process (Teams.exe) creates an executable or installer file (.exe or .msi) in common user-writable directories such as AppData, Temp, or Users/Public. This behavior is indicative of potential malicious activity, as legitimate Teams application updates and add-ins typically reside in specific, protected subdirectories within the Teams folder structure.
This rule monitors for the creation of .exe or .msi files within common user-writable directories (Downloads, Temp, AppData) initiated by web browser processes (Chrome, Edge, Firefox, Brave). This behavior is often indicative of drive-by downloads or users interacting with malicious web content that delivers installers to the host.
Detects the use of 'hdiutil' to mount disk images with the '-nobrowse' flag, initiated by common command-line or scripting interpreters. The '-nobrowse' flag prevents the mounted volume from appearing on the desktop or in Finder, which is a common technique used by attackers to mount malicious disk images stealthily to facilitate execution of payloads while avoiding user detection.
Detects the use of tar.exe to extract archives into common staging directories (Temp, AppData, Public, ProgramData), particularly when the process is initiated by suspicious parent processes such as Office applications, command shells, or download utilities, which is often indicative of malicious payload staging.
Detects potential execution chains related to QR code phishing (Quishing) by monitoring for suspicious process creation or outbound network connections originating from document readers, office applications, and QR scanner utilities. It covers three primary vectors: suspicious process spawning (e.g., Office apps launching cmd or powershell), non-standard network connections from document readers, and malicious URL-based LNK files spawned via explorer.exe.
Page 57 of 86