Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the full FakeGit infection chain: CMD/BAT launcher spawning LuaJIT with malicious payload argument.
This detection identifies the execution of suspicious shell commands (such as download cradles, reverse shells, or unexpected GUI applications like Calculator) spawned as child processes of the Claude Code CLI ('claude'). This activity is indicative of potential Remote Code Execution (RCE) through the exploitation of malicious hooks in `.claude/settings.json` or malicious MCP server commands, as described in CVE-2025-59536.
Detects Microsoft Office applications such as Word or Excel spawning a command-line interpreter (cmd.exe or powershell.exe). This behavior is often associated with malicious documents that execute macros to run commands on the victim's system. The MuddyWater group has been observed using this technique in their 'Operation Olalampo' campaign.
Detects execution of specific Python scripts (modes.py, extentions.py, udp.pyw) using the windowless Python interpreter (pythonw.exe) from user-writable locations. This behavior is a strong indicator of ModeloRAT delivered via the CrashFix/ClickFix campaign using portable WinPython for stealth.
Detects the creation of the '___unique_id___' file in a temporary directory. This file is a specific artifact used by the PeckBirdy JScript framework to store a persistent victim identifier.
This query detects evidence of the CrashFix malicious command being stored in the Windows Run dialog (Win+R) history. The RunMRU registry key stores commands executed via the Run dialog. This is a strong indicator that a user was prompted to and did execute the malicious command.
Detects processes launched by Windows Explorer where the command line contains excessive whitespace or hidden control characters. This pattern is indicative of CVE-2025-9491, a technique used to hide malicious arguments from the LNK Properties dialog.
Detects modification of the VSCode settings.json file by a process other than VSCode itself. This could indicate an attempt to exploit vulnerabilities where an attacker tricks a user into applying a malicious configuration to achieve remote code execution.
Detects behavioral indicators associated with a malware campaign distributing a credential and crypto-wallet stealer disguised as a Windows 11 update. Detection is based on TTPs rather than IOCs for longevity: suspicious directory creation, obfuscated PowerShell execution, and registry-based persistence.
Detects the Microsoft Edge WebView2 process (msedgewebview2.exe) being spawned by suspicious parent processes that typically do not use embedded web content, such as PowerShell, CMD, or common lolbins. This activity is a key indicator of the 'AI-Proxy' technique where malware uses WebView2 to programmatically interact with AI web interfaces for C2.
Detects the execution of 'cmd.exe' initiated by common Microsoft Office applications, scripting engines, or msiexec.exe, where the command line includes 'curl' for downloading a '.pdf' file and also attempts to delete files using 'del /s /q'. This behavior is often associated with initial access, download of malicious payloads, and cleanup activities by adversaries. The rule specifically looks for command lines that interact with 'Users\Public', 'conhost.exe', or use the '--headless' flag, which can indicate automated or background execution.
Detects file activity associated with the LunarApplication malware, either by the known installer hash or by creation of files/directories within its installation path. This rule combines a high-fidelity hash with a specific folder path.
Detects Microsoft Edge launched with command-line arguments used to hide the browser window (headless mode or off-screen positioning) in conjunction with a Base64-encoded HTML data URI. This technique was observed in the APT28 "Operation MacroMaze" campaign to execute payloads stealthily.
Detects file names associated with the Guloader Performance Report Pretext campaign.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects the execution of msiexec.exe to install an MSI package with a naming convention characteristic of the GS7 threat actor. GS7 uses specific, automated naming conventions for their malicious RMM installers, such as 'em_[8 alphanumeric]_installer' or 'Win_[18-20 digits]_installer'.
This query hunts for indicators of compromise associated with the Notepad++ hosting breach attributed to the Lotus Blossom (aka Billbug) threat actor. It detects the Chrysalis backdoor execution chain, specific DLL side-loading techniques, and network connections to known malicious infrastructure.
Detects ClickFix-style PowerShell payloads based on command-line patterns and fake error prompts.
In this campaign, the threat actor leveraged specially crafted Microsoft RTF files to exploit CVE-2026-21509 and deliver malicious backdoors in a multi-stage infection chain. Due to significant overlaps in tools, techniques, and procedures (TTPs) between this campaign and those of the Russia-linked advanced persistent threat (APT) group APT28, we attribute this new campaign to APT28 with high confidence. Microsoft released an out-of-band update to address CVE-2026-21509 on January 26, 2026. ThreatLabz observed active in-the-wild exploitation on January 29, 2026.
Detects the execution of an NSIS installer associated with the Silver Fox APT, which drops a legitimate executable (Thunder.exe) and a malicious DLL (libexpat.dll). This activity is the initial stage of the Silver Fox infection chain.
Page 71 of 86