Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
This rule detects various stages of the VOID#GEIST multi-stage Python loader as described in the Securonix blog. It identifies initial batch file execution, Chrome decoy PDF lures, hidden PowerShell relaunching of the batch file, persistence via the Startup folder, curl commands downloading zip payloads, Python embedded runtime downloads, and final Python payload execution. The rule is designed to catch the distinct command-line patterns associated with each stage of this specific malware.
This rule detects the execution of ELF binaries from user-writable directories within the home folder, specifically targeting paths containing '/.local/bin/'. It aims to identify potentially malicious programs, such as clipboard hijackers, that are dropped and launched by a user. The rule filters out common packaging paths like '/snap/' and '/flatpak/' to reduce false positives.
This rule detects the creation of specific batch files ("non.bat" or "spol.bat") within the Windows Startup folder (`\Microsoft\Windows\Start Menu\Programs\Startup`). This activity is indicative of persistence, as files placed in this location will execute automatically when a user logs in, potentially associated with the VoidGeist malware chain.
This rule detects the creation of specific batch files, 'spol.bat' or 'non.bat', within the Windows Startup folder. This activity is indicative of persistence, as these files will execute automatically when a user logs in, allowing an attacker to re-establish control or continue malicious operations. The rule specifically targets these filenames and the Startup folder path to reduce false positives and focus on a known persistence mechanism used by the VoidGeist threat chain.
Detects Windows registry run keys executing processes out of suspicious paths, for establishing persistence
Detects scripts modifying Windows registry run keys for establishing persistence
This rule detects when a process, potentially a Go-compiled binary (indicated by 'go' in the command line), establishes persistence by creating or modifying a registry run key or by dropping a file in a startup folder. This behavior is associated with the Moonrise RAT.
Detects persistence via an Internet Shortcut (.url) file in a startup folder that points to a local executable (file://). This is a known TTP of the PHALT#BLYX campaign.
Detects NetSupport RAT persistence established via a Registry Run key, followed by the clearing of the RunMRU history. This sequence of events is a known TTP associated with the IClickFix framework, where adversaries attempt to hide the initial execution command after achieving persistence.
Detects persistence mechanisms used by the HoneyMyte APT group's CoolClient backdoor. The rule looks for the creation of a specific scheduled task ('ComboxResetTask') or the modification of a registry run key to include the 'work' parameter, which are characteristic of the backdoor's 'passuac' and 'install' routines.
This rule detects a suspicious sequence of events: a file named 'host.exe' being created in the Windows Startup folder, a 'runtime.zip' file being created in the local temporary directory, and subsequent network communication to the Telegram API (api.telegram.org) from the same device. This pattern is indicative of malware establishing persistence, staging data, and exfiltrating it via Telegram, potentially associated with malware like Small Sieve.
This rule detects a multi-stage attack chain associated with BQTLock and GREENBLOOD ransomware. It identifies the staging of registry keys for a fodhelper UAC bypass, the subsequent execution of fodhelper.exe, the creation of run-key persistence, and the execution of processes containing the keyword 'greenblood' in their command line, indicating the final payload or related activity.
The rule detects write access to files named NTUSER.MAN by monitoring Windows Security Event Log event ID 4663.
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
Identifies a Windows Script Host process (wscript.exe or cscript.exe) creating a JScript (.js) file in a Startup folder. This is a common persistence technique used by malware, including the JScript downloader in the Remcos RAT campaign.
This rule detects the creation of a registry key named 'MonitoringService' under 'HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run'. This registry key is commonly used by adversaries to establish persistence, ensuring that a malicious program or script executes automatically each time a user logs on to the system.
This rule detects the presence of a fake Windows 11 malvertising installer, specifically 'ms-update32.exe', which is known to be distributed via malicious advertisements. It correlates network connections to suspicious domains (including lookalike domains and GitHub hosting) with process execution from user-writeable paths or the presence of 'LunarApplication' artifacts, and registry modifications to the 'TIP\AggregateResults' key, indicating persistence. The rule requires at least two independent signals (registry write plus one or more supporting signals) within a 30-minute pivot window to reduce false positives.
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
Detects the exploitation of the WinRAR path traversal vulnerability (CVE-2025-8088) where a compression utility process creates script or shortcut files in the Windows Startup folder for persistence. This technique has been observed in use by the Amaranth-Dragon threat actor.
Detects Python executing pip installs for common Arkanix loader dependencies (requests, pycryptodome, psutil) as described in the report.
Page 45 of 59