Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects instances where DllHost.exe creates potentially malicious executable or script files in sensitive Windows system directories (e.g., \Users\Public\, \ProgramData\). This is often an indicator of WSL2 filesystem proxying, where a Linux process running within a WSL2 distribution performs file operations on the Windows filesystem that are attributed to the DllHost.exe process on the Windows host, potentially allowing for evasion of local security controls.
Detects instances where the Windows process DllHost.exe creates executable or script files in suspicious user-writable directories (e.g., Temp, Public, ProgramData). This behavior is often indicative of WSL2 (Windows Subsystem for Linux) interacting with the Windows host filesystem, where a Linux-based process may attempt to stage payloads on the Windows partition via the WSL2 interop mechanism.
Correlates the user interacting with a browser in kiosk mode (potentially indicating a fake tech support page) and immediately downloading an executable file into the Downloads folder. This behavior is indicative of the Havoc Demon loader being delivered via social engineering tactics.
Detects instances where the DllHost.exe process writes new executable files (e.g., .exe, .dll) or script files (e.g., .ps1, .vbs) to common staging locations such as C:\Users\Public, C:\Windows\Temp, or C:\ProgramData. This behavior is indicative of potential malware delivery or stage-two payload execution.
Detects instances where the DllHost process (COM Surrogate) writes executable files, scripts, or library files to common temporary or user-writable directories. This behavior is often associated with fileless or masqueraded execution techniques where attackers use legitimate system binaries to drop malicious payloads.
Detects instances where the DllHost.exe process creates files with executable-like extensions (exe, dll, ps1, bat, cmd, vbs, hta, scr) within high-risk, world-writable directories such as C:\Users\Public, C:\Windows\Temp, C:\ProgramData, C:\Users\Default, or AppData\Local\Temp. This behavior is often indicative of malicious activity, such as file drops for further execution or persistence, as legitimate COM surrogate activity rarely results in file creation in these specific locations.
Detects execution and staging activity associated with the NUKESPED (zlrenu8.exe) backdoor. The rule monitors for direct process execution from ProgramData, malicious DLL registration using rundll32, the creation of staged payload files in ProgramData, and suspicious memory operations (VirtualProtect) by the backdoor process, which are indicative of reflective loading or shellcode execution.
Detects malicious activity associated with the Kimsuky NUKESPED campaign, specifically the execution of .jse droppers from the Downloads directory using Windows Script Host (wscript.exe/cscript.exe), execution of known malicious files by SHA256 hash, and the presence or creation of the associated zlrenu8.exe payload.
Detects instances where Windows NearShare or QuickShare utilities spawn child processes that are not part of their standard operational or helper suite (e.g., conhost.exe, WerFault.exe, svchost.exe). This pattern is often indicative of process injection, living-off-the-land techniques, or unauthorized activity masquerading as legitimate Windows sharing services.
Detects a multi-stage infection chain associated with HijackLoader delivered via ErrTraffic ClickFix lures. The rule identifies a sequence where a web browser spawns a PowerShell process that subsequently creates a large archive file (binary bloating), followed by the execution of suspicious processes (often associated with process injection/hollowing) from the extracted context.
Detects the ClickFix infection chain where a web browser process spawns PowerShell to execute obfuscated ScriptBlock content. This activity is correlated with network connections to identified ErrTraffic C2 infrastructure (/api/index.php?a=ctx) used for distributing various malware payloads including Vidar, Stealc, and others.
This rule detects instances where Microsoft Excel (excel.exe) initiates an external network connection within 60 seconds of process startup. This behavior is often associated with the execution of malicious macros or embedded objects designed to reach out to attacker-controlled infrastructure for downloading secondary payloads or establishing command-and-control (C2) communication.
Detects instances where the Remote Desktop Client (mstsc.exe) is launched from common web browsers or email clients, followed shortly thereafter (within 120 seconds) by the execution of a potentially suspicious child process such as PowerShell, command prompt, WScript, or MSHTA. This pattern is indicative of a user-initiated execution flow that may be part of a phishing attack or malicious payload delivery.
Detects the execution of a process named 'gemini.exe' with the '--yolo' command-line argument when spawned by common CI/CD runner processes such as 'actions-runner', 'runner.worker', 'node', or 'npm'. This pattern may indicate unauthorized use of execution environments or potential exploitation of a CI/CD pipeline to run suspicious tools.
This rule detects instances where Microsoft Excel (excel.exe) initiates an external network connection within 60 seconds of process startup. This behavior is often associated with the execution of malicious macros or embedded objects designed to reach out to attacker-controlled infrastructure for downloading secondary payloads or establishing command-and-control (C2) communication.
Detects instances where the Remote Desktop Client (mstsc.exe) is launched from common web browsers or email clients, followed shortly thereafter (within 120 seconds) by the execution of a potentially suspicious child process such as PowerShell, command prompt, WScript, or MSHTA. This pattern is indicative of a user-initiated execution flow that may be part of a phishing attack or malicious payload delivery.
Detects the creation of executable files in the AppData\Roaming folder, excluding common legitimate applications, when the file's version information (internal file name, product name, or file description) matches known indicators for the TuglaInsaatci malware. This rule specifically looks for files named 'oacY.exe' or containing 'TuglaInsaatci' in their version info, indicating potential self-copying or masquerading behavior of the malware.
Detects common productivity applications (e.g., Word, Excel, Acrobat Reader) spawning typical command-line interpreters or scripting hosts. This behavior is a frequent indicator of malicious macro execution or exploit-based payload delivery often seen in phishing campaigns.
Detects the execution of PowerShell with suspicious download-related commands (Invoke-WebRequest, DownloadFile, WebClient, IEX, DownloadString) when initiated through conhost.exe, specifically when the originating parent process is a common shell or utility associated with shortcut (.lnk) file execution or specific command patterns.
Detects phishing attempts leveraging legitimate service redirectors such as Calendly and Google share URLs to deliver malicious photo-themed ZIP archives. The rule identifies suspicious redirect chains to Cloudflare-hosted (.cfd) domains and monitors for specific ZIP filename patterns commonly used in these campaigns to target the hospitality sector.
This rule detects potentially malicious process chains involving PowerShell and Node.js. It specifically flags cases where PowerShell launches PowerShell or Node.js with command lines containing suspicious file patterns (e.g., .lnk masquerading as images) or when Node.js is executed from PowerShell in user-writable directories (e.g., AppData, Temp) with command lines referencing known malicious domains.
Page 60 of 86