Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,115
15,635
12,577
8,388
6,215
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
This rule detects the execution of Windows system utilities (rundll32.exe, regsvr32.exe, msiexec.exe) with command-line arguments that suggest the loading of DLLs, CPLs, or MSIs, often associated with HR-themed lures (e.g., payroll, tax, resume) and originating from the Downloads folder. This behavior is indicative of a DLL loader being launched, potentially from a malicious archive.
Detects user execution of malicious files downloaded via email link clicks
Detects executable files embedded inside Office documents for delivery
Detects download of disk image files used to bypass Mark-of-the-Web
Detects the creation of disk image files (ISO, IMG, VHD, VHDX, WIM) within temporary folders under a user's AppData directory. This activity can be indicative of malware staging or unpacking, often associated with initial access techniques where malicious payloads are delivered as disk images.
This rule watches for AI-named programs run straight from the Downloads folder or temporary directories after a web download. Many fake AI scams start exactly this way. If the program then does anything unusual, it may be malware posing as a free AI tool. Ask the person who used the computer whether they installed new software or clicked a link, and involve your security team if the answer is unclear.
Detects downloads of CVE exploit proof-of-concept code
Detects opening of macro-enabled Office documents potentially containing malware
This rule detects emails containing macro-enabled documents (.docm, .xlsm, .pptm). It specifically looks for instances where a sender sends two or more such emails within an hour, which could indicate a targeted phishing attempt using malicious macros.
This rule detects emails containing macro-enabled documents (.docm, .xlsm, .pptm). It specifically looks for instances where a sender sends two or more such emails within an hour, which could indicate a targeted phishing attempt using malicious macros.
Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.
Detects VBA stomped Office documents where source code is stripped to evade analysis
Detects the creation of an MSI (Microsoft Installer) file on a device where the file's origin referrer URL indicates it was downloaded from a ZIP archive that was originally an email attachment. This could indicate a user opening a malicious ZIP file from an email, leading to the execution of an installer.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
Detects the execution of cURL commands downloading an MSI installer and passing it to msiexec for silent installation, matching UNC3753's SuperOps RMM staging tactic.
Detects cURL making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This specific command-line pattern is a documented staging technique used by UNC3753 to deploy RMM payloads on victim machines.
Detects WinRAR extracting and launching HTML applications (mshta.exe) or script interpreters (wscript.exe/cscript.exe). This behavior is indicative of the CVE-2025-8088 exploit chain used by Gamaredon to deploy GammaPhish and GammaLoad.
This rule detects installers masquerading as legitimate security or analysis utilities (e.g., Ghidra, dnSpy, Wireshark) that subsequently launch common loader programs (e.g., PowerShell, rundll32, cmd.exe). Such activity often indicates an attempt to bypass user suspicion and deliver malware. It is crucial to verify publisher signatures and the origin of downloaded software. Further investigation should involve questioning the user about recent software installations or clicked links, and engaging the security team if the situation remains unclear.
This rule detects the download of ISO, IMG, VHD, or VHDX files over HTTP that are larger than 500KB. These file types are often used as containers for malware delivery, allowing attackers to bypass traditional file-based security controls by embedding malicious executables or scripts within disk images.
Page 68 of 86