Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
33 detections
Filters
Last updated
All Time
Detection languages
16
8
5
3
1
Contributors
6
6
5
4
3
Categories
15
5
5
4
4
Platforms
26
5
4
3
1
Products / Services
9
8
5
4
2
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
CVEs
1
1
IDS Classtypes
5
IDS Protocols
5
Detects the usage of command-line flags in AI coding assistant CLIs (such as Claude Code, Amazon Q CLI, and others) that intentionally skip security permissions, bypass approvals, or disable sandbox protections. The rule identifies potential developer activity that may inadvertently reduce the security posture of the development environment.
Detects the usage of command-line flags in AI coding assistant CLIs (such as Claude Code, Amazon Q CLI, and others) that intentionally skip security permissions, bypass approvals, or disable sandbox protections. The rule identifies potential developer activity that may inadvertently reduce the security posture of the development environment.
Detects network traffic associated with Wazza phishkit anti-bot gates, including beacon communications, TLS SNI patterns, fingerprint iframe URIs, and challenge-platform requests.
Detects network traffic associated with Wazza phishkit anti-bot gates, including beacon communications, TLS SNI patterns, fingerprint iframe URIs, and challenge-platform requests.
Detects network traffic associated with Wazza phishkit anti-bot gates, including beacon communications, TLS SNI patterns, fingerprint iframe URIs, and challenge-platform requests.
Detects network traffic associated with Wazza phishkit anti-bot gates, including beacon communications, TLS SNI patterns, fingerprint iframe URIs, and challenge-platform requests.
Detects the execution of a RevStealer native PE payload by an Electron-based loader (XabivSystem.exe). The rule identifies when the loader spawns an unsigned, detached process from a hidden, randomly-named subdirectory within the user's AppData folder. This process creation is a precursor to the malware's environment checks, anti-VM/sandbox gating, and CAPTCHA verification routines.
Detects execution of processes masquerading as system threads (e.g., [kcached], [rcu_preempt]) that utilize the command-line flag 'exec -a' and include indicators associated with 'gs-dbus' or specific port configurations (GS_PORT=53). This pattern is often associated with obfuscated command-and-control or malicious persistence mechanisms that attempt to hide within common system process names.
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects the execution of COM files located in the AppData\Local directory with a numeric filename and specific command-line arguments indicative of file transfer or proxying tools like curl/wget wrappers.
Detects creation of a mutex matching Abyssos's Global\[UUID4]_Admin/_User single-instance naming convention, or the specific known hardcoded mutex GUID.
Detects creation of the lg.txt debug/failure log written by ChonkyChicken's filename-gating anti-sandbox check.
Detects creation of a hardcoded mutex object used by the WLDR C2 implant to enforce single-instance execution and prevent duplicate agent processes.
Detects creation of a hardcoded mutex object used by the WLDR C2 implant to enforce single-instance execution and prevent duplicate agent processes.
Detects malicious browser extensions associated with the StegoAd campaign fetching steganographic payloads (WebP/PNG) from known C2 infrastructure. The detection identifies requests originating from a browser extension context (via Referer header) that target specific image files commonly used by the malware for post-compromise staging and execution guardrail fingerprinting.
Detects the execution of DcRAT in Operation DragonReturn, which uses a specific hardcoded named mutex 'Global\ShitSetupOn26126k' to ensure only a single instance of the malware runs on the infected host. This acts as an execution guardrail to prevent multiple processes from running simultaneously.
Detects the LokiBot malware attempting to resolve the 'CreateMutexW' API function at runtime using a specific hashed value (0xcf167df4). This technique is used by the malware to prevent multiple concurrent instances from running on the same host, which is a characteristic behavioral pattern for this information stealer.
This rule detects HTTP responses from a server to a client that contain specific strings ('ComputerName', 'UserName', and 'MZ') within the file data. The presence of 'MZ' at the beginning (depth:2) suggests an executable file. The combination of these strings indicates a potential 'guardrail' payload checking the environment (computer name and user name) before executing, which is a common technique used by malware to evade analysis environments or target specific systems. The rule is designed to identify trojan activity related to defense evasion.
This query attempts to identify file events for javaapp.lock files which is used by Nimbus RAT as a way to to enforce single-instance execution.
Page 1 of 2