Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,110
15,627
12,575
8,387
6,212
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects the FormBook RAT persistence mechanism where it copies itself to a disguised location (%APPDATA%\Roaming\word\word.exe) and creates a registry run key named 'svchost.exe' to ensure execution at user login. The rule correlates the file creation and registry modification events on the same device within a short time window.
Detects the creation of VBScript or Batch files in the Windows Startup folder. This is a common persistence technique used by various malware families, including the scripts (`pws1.vbs`, `PWS.vbs`, `startuppp.bat`) dropped by the SERPENTINE#CLOUD campaign.
Detects the execution of a malicious JAR file, a technique used by the Bloody Wolf APT group to download and execute NetSupport RAT components.
A General detection for files being created in the Windows startup directory. This could be an indicator of persistence.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects persistence and execution artifacts associated with the Latrodectus malware. This includes the creation of a misspelled registry run key ('sentinelssheduler') and the execution of a payload masquerading as SentinelOne from a non-standard AppData path.
This query hunts for .lnk (shortcut) files that are either newly created or have the hidden attribute set, located in common Windows startup folders. Attackers often place LNK files in these locations to establish persistence.
Detects the execution of a JavaScript file via wscript.exe or cscript.exe where the file path in the command line contains a tilde (~). This is indicative of the Gootloader malware, which leverages Windows 8.3 short filenames (e.g., "ADAPTI~1.JS" for "Adaptive Algorithms.js") as part of its persistence mechanism to evade simple string-based detections. The persistence scripts are typically dropped in subfolders under the user's AppData\Roaming directory.
Detects Gootloader's persistence mechanism where a shortcut (.lnk) file is placed in the Startup folder or AppData, which in turn executes a JavaScript file using an 8.3 short filename.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects the execution of PowerShell commands associated with the ClickFix social engineering tactic. This involves downloading and executing remote payloads, often followed by creating a .lnk file in the Startup folder for persistence.
Detects indicators associated with a watering hole attack originating from a compromised xubuntu.org website. This includes the creation of a tampered 'tos.txt' file, the dropping and execution of a trojanized dropper ('elzvcf.exe') in AppData\Roaming, and the establishment of persistence via a registry Run key.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects suspicious command line reg.exe tool adding key to RUN key in Registry
Detects the creation of the "EdgeUpdateCore" Run key, a persistence mechanism used by the LeakyStealer malware.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects the execution of XWORM malware delivered via the Ghost Crypt crypter service. The attack chain involves a legitimate but vulnerable PDF reader (HaiHaiSoft PDF Reader) side-loading a malicious 'oledlg.dll', which then uses process hypnosis to inject the final XWORM payload into 'csc.exe'. The rule also detects the persistence mechanism used.
Detects modification of autostart extensibility point (ASEP) in registry.
Detects WinRAR creating files in Windows startup locations, which may indicate an attempt to establish persistence by adding malicious files to the Startup folder. This behavior has been associated with exploitation of WinRAR path traversal vulnerabilities like CVE-2025-6218 or CVE-2025-8088.
This rule detects the creation or modification of a specific registry run key used by the Leviathan APT group for persistence. The key path observed is '\Software\Microsoft\Windows\CurrentVersion\Run\ntkd'. This indicates that a program named 'ntkd' is configured to execute automatically when a user logs in, a common technique for maintaining access to a compromised system.
Page 48 of 59