Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
302 detections
Filters
Last updated
All Time
Detection languages
138
85
23
18
14
Contributors
73
46
31
30
20
Categories
248
129
57
47
36
Platforms
300
1
1
1
1
Products / Services
112
93
59
20
8
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
CVEs
2
1
1
1
1
IDS Classtypes
3
IDS Protocols
3
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
This rule detects various stages of a cryptojacking campaign, as described by Microsoft, involving initial access via autorun.dll sideloading, silent MSI installations, execution of RuntimeHost.exe from suspicious locations, scheduled task creation for persistence, .NET process hollowing, Windows Defender exclusions, and persistence via Startup folder shortcuts and Registry Run keys. The campaign leverages ScreenConnect for remote access and .NET utilities for process hollowing, ultimately leading to GPU mining cryptojacking.
This rule detects various suspicious activities associated with a cryptojacking campaign, including the execution of 'RuntimeHost.exe' from unusual directories, creation of suspicious scheduled tasks, DLL side-loading followed by silent MSI execution, process hollowing into .NET utilities, Windows Defender exclusion attempts, and persistence mechanisms via startup folder shortcuts and registry run keys. These activities are indicative of an attacker establishing persistence and evading defenses to perform unauthorized cryptocurrency mining.
Detects installation of Tiflux RMM components delivered through phishing campaigns. Threat actors abuse Tiflux to establish persistent remote access and subsequently deploy additional remote management tools.
Detects the execution of obfuscated PowerShell commands that attempt to install MSI packages via the Windows Installer COM object (`WindowsInstaller.Installer`).
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
The technique involves manipulating strings to hide functionality, such as constructing class names using string insertion (e.g., 'indowsInstaller.Installer'.Insert(0,'W')) and correcting
malformed URLs (e.g., converting 'htps://' to 'https://') at runtime. This behavior is commonly associated with malware loaders or droppers that aim to bypass static detection
by hiding intent in runtime-generated strings and using legitimate tools for code execution. The use of `InstallProduct` and COM object creation, particularly combined with
hidden window execution and suppressed UI, indicates an attempt to install software (likely malicious) without user interaction.
Detects installation of a remote msi file from web.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory, indicating potential unauthorized deployment associated with fileless loader campaigns.
Detects the execution of the ScreenConnect ClientSetup MSI from the C:\Temp directory via msiexec.exe, indicating potential unauthorized deployment observed in an in-memory loader attack.
Detects usage of Msiexec.exe to install packages hosted remotely quietly
Detects the unexpected installation of Node.js by an unusual parent process (such as VS Code, cmd, or PowerShell). This behavior is indicative of the StoatWaffle downloader, which automatically fetches and installs the Node.js runtime if it is absent from the target environment.
Detects the execution of msiexec.exe to download and install packages from remote locations. This activity is frequently observed in LeakNet ClickFix campaigns where users are tricked into copying and pasting malicious commands via fake verification prompts.
Detects 'msiexec.exe' being launched from a web browser with a command line containing indicators of remote package download or path traversal. This is a primary indicator of the 'ClickFix' social engineering technique used by LeakNet and other threat actors.
This rule detects when two different MSI installations, both related to known VPN clients (Pulse Secure, Fortinet, Ivanti, GlobalProtect), occur on the same device within a short timeframe. This could indicate an attempt to establish redundant access, bypass security controls, or an unusual administrative activity.
Detects suspicious process injection attempts where common scripting/proxy execution tools (wscript.exe, cscript.exe, mshta.exe, powershell.exe, msiexec.exe) are used to inject into other processes (RegAsm.exe, InstallUtil.exe, vbc.exe, svchost.exe, explorer.exe) using CreateRemoteThread. The detection is further refined by looking for command-line indicators often associated with malicious activity, such as downloading content or executing scripts.
Detects the execution of msiexec.exe to download and install a remote MSI payload from Supabase cloud storage. This technique is known to be used by the Warlock ransomware group to silently deploy the Velociraptor C&C framework while evading network detections.
Detects Cursor IDE spawning download utilities or LOLBins commonly used for
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
payload staging. Directly maps to the CursorJack technique where a malicious
MCP deeplink encodes a command that downloads and executes a remote payload.
Low false-positive rate — these child processes have no legitimate use when
launched directly by Cursor.
Detects PowerShell commands using Invoke-WebRequest to download and then execute an MSI file, a technique observed in campaigns deploying RMM tools like ScreenConnect and Tactical RMM. This is often done within a single command line or script block.
Detects msiexec.exe executing with /i to install an MSI package from a remote HTTP/HTTPS domain, excluding internal RFC1918 networks, loopback, and APIPA addresses. This pattern is commonly used for remote payload installation and malware staging over the web.
Detects the use of msiexec.exe to install a package from a remote URL that contains keywords associated with fake verification or captcha lures. This technique is used by threat actors in "Fake Captcha" campaigns to bypass script-based detections.
Detects the execution of msiexec.exe to install an MSI package with a naming convention characteristic of the GS7 threat actor. GS7 uses specific, automated naming conventions for their malicious RMM installers, such as 'em_[8 alphanumeric]_installer' or 'Win_[18-20 digits]_installer'.
This rule detects suspicious outbound network connections to Cloudflare Workers domains, indicative of potential command and control (C2) activity. It identifies connections to known malicious Cloudflare Workers domains or IPs, as well as generic Cloudflare Workers domains (.workers.dev) when initiated by suspicious processes like `WsusService.exe`, `curl.exe`, `certutil.exe`, `bitsadmin.exe`, `Velociraptor.exe`, or `msiexec.exe`. The rule prioritizes detection based on specific indicators like known malicious workers or C2 IPs, and flags activity from processes commonly abused for C2 or payload delivery. It also provides severity scoring and investigation steps based on the identified threat type.
Page 11 of 15