Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
931 detections
Filters
Last updated
All Time
Detection languages
661
149
45
25
18
Contributors
300
290
82
79
29
Categories
752
259
83
35
34
Platforms
922
6
2
1
Products / Services
286
207
111
22
18
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
931
CVEs
7
3
2
2
1
IDS Classtypes
4
IDS Protocols
2
2
Detects the loading of radcui.dll from the non-standard %LOCALAPPDATA%\Microsoft\RemoteApp\Gateway\ directory. This behavior is associated with DLL sideloading chains where signed Microsoft binaries (such as wkspbroker.exe) are abused to load malicious payloads, often seen in the PREY-0058/Aur0ra Teams vishing campaigns.
Detects instances where curl.exe is spawned by cmd.exe or wscript.exe and uses the -o flag to save downloaded files into user-writable directories (e.g., Temp or AppData), a technique often used to stage secondary payloads during the exploitation process.
Detects the copying of the legitimate Windows curl.exe binary from System32 to a user-writable directory (such as AppData\Local\Temp) and renaming it. This is a common LOLBin (Living Off the Land Binary) technique used by adversaries to disguise the utility as a benign application to evade detection while facilitating the download of second-stage payloads.
Detects the execution of the Pester framework's Build.bat script, which is being abused as a LOLBAS (Living Off the Land Binary and Script) technique. This activity is typically characterized by being launched from an LNK file, often indicating a malicious dropper or secondary stage payload delivery.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning common LOLBAS (Living Off the Land Binaries and Scripts) child processes. This behavior is a common indicator of macro-based malware or malicious document exploitation where Office applications are used to execute shell commands or scripts for payload delivery or execution.
Detects a suspicious sequence where the 'chrome_cleanup.exe' binary is written to disk, its Mark of the Web (MOTW) identifier is removed, and it is subsequently launched by an unusual process (e.g., explorer, svchost, dllhost, or rundll32) without command-line arguments. This behavior is indicative of a COM-based shell launch, a technique often used by post-exploitation tools to bypass security controls and execute binaries stealthily.
Detects the creation of a scheduled task named 'OneDrive KeepAlive' or a task set to execute every 5 minutes, in conjunction with the execution of 'taskhostw.exe' containing 'exec hide' in its command line. This pattern is indicative of the Kimsuky threat group using a renamed version of the NirCmd utility to maintain persistence and execute commands silently.
Detects the execution of staged payloads from the Windows %TEMP% directory. This rule monitors for suspicious activity often associated with loader-style C2 execution, including direct execution of randomly named files, proxy execution via rundll32 or regsvr32, silent MSI installations, and the execution of payloads extracted from archives in temporary locations.
Detects the execution of staged payloads from the Windows %TEMP% directory. This rule monitors for suspicious activity often associated with loader-style C2 execution, including direct execution of randomly named files, proxy execution via rundll32 or regsvr32, silent MSI installations, and the execution of payloads extracted from archives in temporary locations.
Detects instances where the Steam service (steamservice.exe) is executing suspicious child processes such as command interpreters or binaries located in unusual paths like Temp, Downloads, or AppData, often indicating an attempt to hide malicious activity under a trusted process.
Detects instances where PowerShell rapidly cycles through a known list of Microsoft-signed .NET binary utilities (LOLBins) located in .NET framework directories, within a short duration. This behavior is consistent with resiliency-spray techniques, such as those used by Veil#Drop, to find an available binary to host an injected .NET assembly.
Detects host reconnaissance activity performed by PureLog Stealer, characterized by the execution of system administration tools (e.g., wmic, reg, systeminfo) spawned as child processes from .NET LOLBins (e.g., msbuild, installutil, regsvcs). This behavior indicates an adversary performing discovery of system configuration and environment details.
Detects instances where the Steam service (steamservice.exe) is executing suspicious child processes such as command interpreters or binaries located in unusual paths like Temp, Downloads, or AppData, often indicating an attempt to hide malicious activity under a trusted process.
Detects AutoIT executables running from a Temp directory that take an .ini file as a command-line argument. This pattern is commonly used by AutoIT-based malware loaders or droppers to ingest configuration files containing obfuscated code or C2 communication parameters.
Detects the execution of the Pester framework's Build.bat script, which is being abused as a LOLBAS (Living Off the Land Binary and Script) technique. This activity is typically characterized by being launched from an LNK file, often indicating a malicious dropper or secondary stage payload delivery.
Detects the execution of the Windows binary InstallUtil.exe using specific flags (/logfile=, /LogToConsole=false, and /U) commonly used to execute arbitrary .NET code while bypassing application control mechanisms such as AppLocker or Windows Defender Application Control (WDAC).
This rule detects instances where the DISM core library (DismCore.dll) is loaded by a process named 'index.exe', or where a process named 'index.exe' is executing from or interacting with a folder path containing 'DISM'. This behavior is characteristic of malicious tools or scripts attempting to proxy execution through the Deployment Image Servicing and Management (DISM) binary, a common technique for bypassing security controls.
This rule detects two suspicious indicators related to SloppyRAT activity: an outbound network connection using the legacy Finger protocol (TCP port 79), which can be abused by binaries like 'finger.exe' for payload staging, and DNS queries resolving to the known SloppyRAT staging domain 'finger.linked4x.com'.
Detects outbound network activity on TCP port 79 (finger) initiated by a client to the domain 'finger.linked4x.com'. This behavior is associated with the SloppyRAT 'ClickFix' campaign, where attackers use social engineering to trick users into executing commands, leading to payload staging and tool retrieval.
Detects instances where the Steam service (steamservice.exe) is executing suspicious child processes such as command interpreters or binaries located in unusual paths like Temp, Downloads, or AppData, often indicating an attempt to hide malicious activity under a trusted process.
Detects the execution of curl.exe by various script interpreters (cmd.exe, powershell.exe, wscript.exe, mshta.exe) or Windows Explorer. This pattern is commonly used by adversaries to download malicious payloads or intermediate loaders as part of an attack chain, such as deploying CastleLoader/CastleRAT.
Page 4 of 45