Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects potential Remcos RAT installation by correlating the creation of an executable in a user's AppData directory with the creation of a registry run key for persistence.
Detects the creation of a specific registry run key used by the TamperedChef malware for persistence.
Pulsar RAT is a derivative of Quasar RAT with extensive functionality including keylogging, cryptocurrency wallet clipping, credential theft, file management, remote shell execution, and data exfiltration capabilities. As a modular, open-source remote administration tool designed for Windows systems, Pulsar introduces significant enhancements over its predecessor.
This rule detects attempts to establish persistence by modifying the 'RunMRU' registry key to execute malicious commands. It specifically looks for the presence of common scripting and download utilities (powershell, pwsh, mshta, certutil, bitsadmin, curl, wget) combined with indicators of remote execution or code download (http, iex, Invoke-Expression, DownloadString, iwr, Invoke-WebRequest) within the registry data.
This rule detects attempts to use the Windows registry key 'Software\Microsoft\Windows\CurrentVersion\Explorer\TypedPaths' to execute potentially malicious commands. It specifically looks for the presence of 'powershell', 'mshta', 'certutil', 'curl', 'bitsadmin', or 'wget' within the registry data associated with this key. This technique can be used for persistence or execution of malicious payloads.
This rule detects suspicious process creation patterns indicative of the MuddyWater (also known as RustyWater) APT group. Specifically, it looks for Microsoft Office applications (Word, Excel, PowerPoint) launching scripting or Living Off The Land Binaries (LOLBins) such as cmd.exe, powershell.exe, mshta.exe, rundll32.exe, wscript.exe, or cscript.exe. The detection is further narrowed down by checking if these processes are created in suspicious writable paths like ProgramData, Users\Public, AppData\Roaming, or AppData\Local\Temp. Additionally, the rule includes optional enrichment for known MuddyWater/RustyWater payload names (reddit.exe, art.exe, cloud.exe, nginx.exe), persistence via the Run registry key, and the dropping of a specific staging artifact named 'CertificationKit.ini'.
Detects the execution of a JScript file by cscript.exe using a legacy NTFS 8.3 shortname format. This is a specific behavior observed in Gootloader's persistence mechanism, where a .LNK file in the Startup folder executes a second-stage script.
Detect modification of the User Shell Folders registry values for Startup or Common Startup which could indicate persistence attempts.
Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup.
This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.
Attackers may modify User Shell Folders registry keys to point to malicious executables or scripts that will be executed during startup.
This technique is often used to maintain persistence on a compromised system by ensuring that the malicious payload is executed automatically.
Detects PowerShell execution launched by a batch script located in a user's Startup folder, where the PowerShell command line contains common download primitives. This pattern aligns with persistence via Startup folder (BAT) combined with retrieval of a next-stage payload, as reported for Paper Werewolf (GOFFEE) activity.
Detects direct modification of autostart extensibility point (ASEP) in registry using reg.exe.
Detects PowerShell downloading a batch file (.bat) into the user's Startup folder. This is a common persistence technique (T1547.001) and was observed in an AsyncRAT campaign where the payload was downloaded from a malicious `trycloudflare.com` domain.
Detects a script process (wscript.exe/cscript.exe) creating files in a specific HP-themed path and then creating a Run key for persistence, indicative of the Turla Kazuar VBScript dropper.
This detection identifies the creation of an Internet Shortcut (.url) file in a user's Startup folder. This is a persistence mechanism (T1547.001) used by adversaries like the PHALT#BLYX campaign, which created a .url file pointing to a local executable using the 'file:///' protocol to launch malware at logon. The rule specifically looks for the creation of '.url' files in the Startup folder and includes a filter for a known IOC ('DeleteApp.url') from the PHALT#BLYX campaign, as well as excluding common legitimate processes like web browsers and explorer.exe as initiating processes.
vvs-stealer
KQL
This rule detects activities associated with the VVS Stealer malware, as described in the Palo Alto Networks Unit 42 blog. It identifies the malware through specific SHA256 hashes of known VVS Stealer executables, network connections to hardcoded Discord webhook URLs used for exfiltration, persistence mechanisms via creation of executables in Windows startup folders, creation of '_vault.zip' files (likely containing stolen data), and suspicious Discord-related process activity indicative of the stealer's operation.
PHALT BLYX Startup URL Persistence
Cortex XDR
Detects the creation of .url files in the Windows Startup folder, which can be used for persistence. Specifically identifies a known IOC for PHALT BLYX malware ('DeleteApp.url') and flags other suspicious .url file creations in the Startup folder. This rule filters out common browser processes that might legitimately create .url files.
This rule detects several suspicious activities often associated with post-exploitation and defense evasion. It identifies PowerShell commands used for recursively searching for msbuild.exe, tampering with Windows Defender settings (disabling real-time monitoring or adding exclusions), and downloading files from the internet to common temporary or application data directories. Additionally, it flags msbuild.exe executing suspicious .proj files from temporary directories, and any executable launched from temporary or program data folders by PowerShell or MSBuild. The rule also includes detection for persistence via .url file creation in the Startup folder and the dropping of specific suspicious files (.proj, pins.dat, staxs.exe, tybd7.exe) by PowerShell or MSBuild in temporary or program data directories.
This rule detects suspicious batch (.bat) file creation events by monitoring for several indicators. It flags batch files created by processes using command lines indicative of downloads (e.g., 'http:', 'https:', 'iwr', 'iex', 'invoke'), batch files created by suspicious executables ('curl.exe', 'mshta.exe'), batch files placed in high-risk directories ('\Users\Public\', '\Start Menu\Programs\Startup\'), or batch files exceeding a size threshold of 5MB. The rule explicitly excludes processes named 'java.exe' or 'javaw.exe' from triggering alerts.
Detects the creation or modification of registry values used by the Valley RAT malware to store its configuration and modular plugins. Silver Fox operators use this mechanism for persistence and to dynamically update C2 infrastructure.
Detects when the WinRAR process creates an executable or shortcut file in a user's Startup folder. This technique is used by adversaries, such as Paper Werewolf, to establish persistence.
This rule detects the multi-stage delivery of PlugX malware, attributed to Mustang Panda, leveraging HTML smuggling, DLL side-loading, and persistence via registry run keys. The detection chain starts with a browser dropping an MSI file (HTML smuggling), followed by msiexec.exe executing a known sideloading executable (gup.exe or robotaskbaricon.exe). Subsequently, a malicious DLL (libcurl.dll or RoboForm.dll) is side-loaded by the executable from the same path, and finally, persistence is established through a registry run key by the same sideloading executable.
KQL Query from file: ConvertMate - suspicious PDF editor
Page 47 of 59