Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the execution of wscript.exe loading a VBScript from a relative suspicious subdirectory like ".\data\", indicative of the initial LNK-based infection chain observed in Operation Dragon Weave.
This rule detects the download of a potentially malicious LNK shortcut file over HTTP. It specifically looks for HTTP responses (flow:to_client) containing a URI with ".lnk" (nocase) and the byte sequence "|4C 00 00 00|" at the beginning of the file data (depth:4), which is characteristic of an LNK file header. This activity is often associated with initial access or execution techniques where attackers use shortcut files to deliver malware or execute malicious commands.
Detects curl making direct HTTP requests to raw IPv4 addresses specifically seeking 'installer' binaries. This specific command-line pattern is a documented staging technique used by UNC3753 to deploy RMM payloads on victim machines.
This rule detects suspicious process creation events where Microsoft Office applications (Word, Excel, PowerPoint, Outlook) are the initiating process, but the created process is not another Office application. Instead, the created process is a command-line interpreter or scripting host like PowerShell, cmd.exe, cscript, wscript, or mshta. This behavior is often indicative of initial access techniques involving malicious Office documents that execute scripts or commands.
Detects the specific sequence of commands used in the ClickFix FakeCaptcha attack, moving a ZIP from Downloads, extracting it via tar, and silently executing a batch file. This rule looks for `cmd.exe` processes that contain `move`, `Downloads`, `tar`, `start`, `-xf`, and `/min` in their command line, along with specific payload filenames like `update.zip`, `u.zip`, or `update.bat`.
This rule detects the transfer of a potentially malicious PDF file containing embedded JavaScript over HTTP. It specifically looks for the PDF file header '%PDF' followed by the string '/JavaScript' within the file data, indicating the presence of JavaScript code within the PDF. This is a common technique used by attackers to execute malicious code when the PDF is opened.
This rule detects the opening of a potentially malicious Office document containing macros. It specifically looks for HTTP traffic where the response body contains both "[Content_Types].xml" and "vbaProject", which are indicators of an Office document (like .docx, .xlsx, .pptx) that includes VBA macros. The 'flow:to_client,established' indicates that the document is being downloaded by a client over an established HTTP connection.
Microsoft Threat Intelligence observed Russian military Intelligence actor Seashell Blizzard conduct a phishing campaign using Excel attachments embedded with the custom CheapShot malware. CheapShot allows the actor to maintain persistence on targeted devices, likely to support intelligence collection. The actor primarily targeted critical infrastructure and key resources in Ukraine and Europe.
Search for events in your network and locate potential CheapShot malware- related indicators.
The file hashes are associated with CheapShot activity.
Search for events in your network and locate potential CheapShot malware- related indicators.
The file hashes are associated with CheapShot activity.
Detects the creation of disk image files (ISO, IMG, VHD, VHDX, WIM) within temporary folders under a user's AppData directory. This activity can be indicative of malware staging or unpacking, often associated with initial access techniques where malicious payloads are delivered as disk images.
Detects the creation of disk image files (ISO, IMG, VHD, VHDX, WIM) within temporary folders under a user's AppData directory. This activity can be indicative of malware staging or unpacking, often associated with initial access techniques where malicious payloads are delivered as disk images.
Detects Plane9 or Cluster-Overlay style execution from AppData or other user-writable staging paths, which is indicative of malware associated with the UAC-0184 threat actor.
Sublime Threat Intelligence and Research (STIR) identified a phishing campaign using a recently published open-source Javascript virtual machine and obfuscation tool called KrakVM. The initial KrakVM-encoded HTML file arrives as an attachment in phishing emails. These emails are short, often not even including a body, with subjects and HTML attachment filenames suggesting the target has a new voicemail, a vendor credit, or unpaid invoices
Detects the execution of scripts (.vbs, .js, .wsf, etc.) proxied through explorer.exe or rundll32.exe (via shell32.dll).
Threat actors embed these commands in .LNK files to bypass direct cscript/wscript detections and break process tree lineage. Because the user executes the LNK from the GUI, the desktop explorer.exe acts as the parent, mimicking normal user activity.
Threat actors embed these commands in .LNK files to bypass direct cscript/wscript detections and break process tree lineage. Because the user executes the LNK from the GUI, the desktop explorer.exe acts as the parent, mimicking normal user activity.
Detects the execution of Notepad++ using the '-settingsDir=' argument, which can be used to redirect the application to load attacker-controlled configuration files, potentially exploiting vulnerabilities like CVE-2026-48778. This technique could allow an adversary to achieve persistence or execute malicious code by manipulating Notepad++'s configuration.
This rule detects potential thread hijacking phishing attempts where an email with a subject starting with 'RE:' or 'FW:' (indicating a reply or forward) contains an attachment with a suspicious file extension (.js, .hta, or .lnk). The rule specifically looks for these emails originating from domains outside of a predefined list of trusted domains and flags instances where more than one such suspicious reply/forward is sent from the same sender with the same subject and filename within a day, suggesting a coordinated attack.
Detects process execution patterns associated with the Mini Shai-Hulud malware, including lifecycle hook
execution, daemonized Node.js processes, and PyPI payload execution.
execution, daemonized Node.js processes, and PyPI payload execution.
Detects Mini Shai-Hulud supply-chain malware (router_init.js / router_runtime.js / tanstack_runner.js)
Detects process execution patterns associated with the Mini Shai-Hulud malware, including lifecycle hook execution and daemonized Node.js processes.
This rule detects the creation, modification, or execution of files matching a predefined list of known malicious SHA256 hashes. It correlates file and process events to identify the presence and activity of these specific malicious artifacts on monitored systems.
Bitwarden CLI (@bitwarden/cli@2026.4.0) was compromised in April 2026 as part of the Checkmarx-linked supply chain attack. Attackers injected malicious code via Bitwarden’s CI/CD pipeline.
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Bitwarden CLI (@bitwarden/cli@2026.4.0) was compromised in April 2026 as part of the Checkmarx-linked supply chain attack. Attackers injected malicious code via Bitwarden’s CI/CD pipeline.
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Ref:
https://cyberinsider.com/bitwarden-cli-backdoored-in-checkmarx-supply-chain-attack
https://www.aikido.dev/blog/shai-hulud-npm-bitwarden-cli-compromise
Page 69 of 86