Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,234 detections
Filters
Last updated
All Time
Detection languages
565
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
428
290
252
179
Platforms
1,209
21
17
2
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,108
15,614
12,573
8,384
6,204
1,234
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects the creation of suspicious script files (.vbs, .js, .ps1, .bat, .cmd) in the Windows Startup folder. This is a common persistence technique used by malware, including XWorm, to ensure execution upon user logon.
This rule detects the creation of a registry run key (Run or RunOnce) that attempts to establish persistence by executing a DLL via regsvr32. It specifically looks for registry value data containing 'regsvr32' followed by a DLL path. The rule then correlates this registry event with a file creation event for the same DLL on the same device within a specified timeframe, indicating a potential persistence mechanism where a malicious DLL is dropped and then configured to run at startup.
Detects the YiBackdoor persistence technique where a DLL is written to disk and subsequently configured to be executed by regsvr32.exe via a registry Run key.
This rule detects various artifacts and behaviors associated with the DeedRAT malware, also known as MicRun or SBAMRES. It identifies the execution of 'MicRun.exe', suspicious file paths like 'C:\ProgramData\MicroDefaults', and registry persistence via 'Run' keys with specific data patterns. The rule also looks for the creation of malicious services using 'sc create MicRun', known malicious SHA256 hashes for both processes and files, and suspicious filenames such as 'SBAMRES.DLL' and 'MicRun.exe'. Additionally, it detects network communication to a known DeedRAT C2 domain, 'luckybear669.kozow.com'.
Detects suspicious new RUN key element pointing to an executable in a suspicious folder
Detects VenomRAT, a variant of QuasarRAT, used by the RevengeHotels group in recent campaigns targeting the hospitality industry. This rule identifies the RAT based on a characteristic list of security and analysis tools it attempts to terminate, along with other unique features.
This rule detects XWorm persistence mechanisms. It looks for the creation of scheduled tasks, registry run keys, or startup folder shortcuts that execute suspicious payloads from the AppData\Roaming directory. The malware is known to use filenames like "WmiPrvSE.exe" (masquerading as a legitimate system file) and "Soundman.exe").
This rule detects various activities associated with the NotDoor malware, including the copying of malicious files to Outlook macro folders, C2 beaconing attempts using nslookup or curl to suspicious domains, registry modifications to disable Outlook macro security or enable macro loading on boot, and the creation of staging files in temporary directories for potential exfiltration. These behaviors are indicative of NotDoor installation, persistence, defense evasion, and data staging.
Mustang Panda conducted a phishing campaign against Myanmar entities using a compromised embassy email. The lure involved a PDF with an embedded URL that delivered a ZIP archive containing a trojanized executable and malicious DLL. The malware disguised itself as a PDF, sideloaded the DLL, established persistence, and executed further payloads. It performed system reconnaissance, data exfiltration via SFTP, and defense evasion.
Detects persistence mechanisms associated with a Winos malware variant. This includes the creation of the 'Software\DeepSer' registry key or the modification of the 'User Shell Folders\Startup' key to redirect to a malicious folder.
Detects the initial PowerShell download cradle associated with ClickFix/CORNFLAKE.V3 campaigns. This activity is often the result of a user being tricked into pasting and running a command from a malicious website.
Detects various activities associated with the AppSuite PDF Editor backdoor, a trojanized application with extensive backdoor capabilities. This rule looks for specific command-line execution, persistence mechanisms, and network communications.
This analytic detects the execution of PowerShell commands to install unsigned AppX packages using Add-AppxPackage or Add-AppPackage cmdlets with the -AllowUnsigned flag. This activity is significant as adversaries may use unsigned AppX packages to install malicious applications, bypass security controls, or establish persistence. If confirmed malicious, this could allow attackers to install unauthorized applications that may contain malware, backdoors, or other malicious components.
register jar in run key
This rule detects the creation or modification of registry values within common Auto-Start Extensibility Point (ASEP) Run keys. It specifically flags entries that point to suspicious file paths (e.g., C:\Users\Public\, C:\ProgramData\, temporary directories) or contain suspicious command-line interpreters (e.g., rundll32, mshta.exe, powershell.exe, wscript.exe, cscript.exe). The rule filters out modifications made by known legitimate processes to reduce false positives.
Detects the PHP variant of the CORNFLAKE.V3 backdoor, which is often dropped as 'config.cfg' and used for C2 communications and payload execution.
The following analytic identifies a process writing a .txt file to a world writable path. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on file creation events within specific directories. This activity is significant as adversaries often use such techniques to deliver payloads to a system, which is uncommon for legitimate processes. If confirmed malicious, this behavior could allow attackers to execute arbitrary code, escalate privileges, or maintain persistence within the environment, posing a significant security risk.
Detects the NodeInitRAT NodeJS backdoor script used by the Mocha Manakin threat actor. This rule identifies specific strings related to C2 communication, persistence mechanisms, and command execution found within the script.
KQL Query designed to detected tactics employed during active exploitation of WinRAR Zero-Day ( CVE-2025-8088)
Detects specially crafted RAR archives that exploit the CVE-2025-8088 directory traversal vulnerability. This technique is used to drop files into the Windows Startup folder for persistence, as seen in campaigns by the RomCom threat actor.
This analytic detects when a known remote access software is added to common persistence locations on a device within the environment. Adversaries use these utilities to retain remote access capabilities to the environment. The detection specifically looks for modifications to the 'Run' registry keys or 'ImagePath' values within service registry keys, which are common methods for establishing persistence. The rule leverages a lookup table containing known remote access tools such as AnyDesk, GoToMyPC, LogMeIn, and TeamViewer.
Page 52 of 59