Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects signed executable files with untrusted certificates (expired, revoked,
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
or broken chain) that were downloaded from the internet and executed within one
hour of being written to a high-risk path such as user temp, AppData, Downloads,
or Public directories.
An untrusted certificate on a downloaded executable can indicate use of a
revoked or stolen code-signing certificate, a technique observed in multiple
Iranian APT campaigns including Seedworm/MuddyWater (ref: CyberProof, April 2026)
and consistent with CISA advisory AA26-097A.
Note: IsTrusted reflects certificate status at time of MDE cloud scan, not
real-time revocation status. Files executed before MDE scan completion or before
CA revocation may not be detected.
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Axios NPM Supply Chain Attack Delivers RAT
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
https://www.trendmicro.com/en_us/research/26/c/axios-npm-package-compromised.html
Detects execution of Advanced Installer MSIX Package Support Framework (PSF) components, specifically AI_STUBS executables with original filename 'popupwrapper.exe'.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.
This activity may indicate malicious MSIX packages build with Advanced Installer leveraging the Package Support Framework to bypass application control restrictions.
Detects suspicious and uncommon child processes of WmiPrvSE
Detects the execution of the primary PhantomPull loader component ('syncobs.exe') before it decrypts and reflectively loads the final PhantomPulse RAT payload, as observed in the REF6598 campaign.
Detects the execution of 'syncobs.exe', which is identified as the primary loader component for the PhantomPulse RAT. This loader is responsible for decrypting and reflectively loading the final RAT payload. The detection focuses on the specific filename, which is considered highly indicative of this threat.
Office application called wmic to proxye execution through a LOLBIN process. This is often used to break suspicious parent-child chain (Office app spawns LOLBin).
Detects a flashplayer update from an unofficial location
Detects the process injection of a LittleCorporal generated Maldoc.
Detects malicious behavior where the MMC utility (`mmc.exe`) executes files with reversed extensions caused by Right-to-Left Override (RLO) abuse, disguising them as document formats.
Detects the execution of Remote Desktop Protocol (RDP) client (mstsc.exe) with an .rdp configuration file, specifically when the .rdp file is launched from common Outlook attachment or temporary internet file directories. This behavior can indicate a user being tricked into opening a malicious RDP file delivered via email, potentially leading to remote access to an attacker-controlled system or a compromised internal host.
This rule goes after the behauviour of a variant of REMCOS, a remote access trojan (RAT) that has been observed in the wild.
The rule looks for specific indicators of compromise (IOCs) and behaviors associated with this malware, such as unusual process creation patterns, network connections to known command and control (C2) servers, and specific file modifications.
The rule looks for specific indicators of compromise (IOCs) and behaviors associated with this malware, such as unusual process creation patterns, network connections to known command and control (C2) servers, and specific file modifications.
This rule correlates the creation of a potentially executable or script file by a browser or Microsoft Office application with its subsequent execution within a short time frame. This pattern is highly indicative of a user being tricked into downloading and running a malicious payload, often associated with initial access techniques like spearphishing with malicious attachments.
Detects suspicious PowerShell execution patterns commonly associated with the ClickFix initial access technique, where a user is tricked into pasting and executing a malicious script.
Detects the execution of Microsoft Edge via the command shell to open a PDF file. This pattern can be indicative of malicious activity where an attacker attempts to bypass direct execution or leverage a browser vulnerability to open a malicious PDF.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Detects a file download where the referrer URL is a Microsoft Entra ID OAuth endpoint returning an error. This pattern is indicative of an attacker abusing OAuth's error-handling redirection mechanism to lead a user to a malicious payload on an attacker-controlled domain.
Identifies file downloads (archives, shortcuts) originating from a legitimate OAuth provider URL that contains error parameters. This pattern is indicative of an attacker abusing OAuth error redirection to deliver a malicious payload.
Page 70 of 86