Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
106 detections
Filters
Last updated
All Time
Detection languages
58
33
7
2
2
Contributors
22
14
11
8
8
Categories
48
21
15
12
11
Platforms
84
8
4
3
3
Products / Services
21
19
15
6
4
MITRE Techniques
18,114
15,633
12,576
8,388
6,215
IDS Classtypes
1
IDS Protocols
1
Detects the execution of QEMU binaries or the utilization of .qcow2 disk files. The rule flags these activities as higher risk when they occur within common user-writable or temporary directories, which is a common indicator of unauthorized virtualization usage, staging for side-loading, or attempts to hide malicious artifacts within virtual disks.
Detects the execution of QEMU emulator binaries (qemu-system-x86_64.exe, qemu-system-i386.exe, qemu.exe, qemu-img.exe) on a Windows host. This activity is associated with threat campaigns attempting to spawn hidden guest virtual machines to evade detection mechanisms and potentially stage ransomware or other malicious payloads.
KQL Query from file: INC Ransomware Command Execution
Photo-themed ZIP phishing campaign dropping a Node.js implant
Detects the initialization and execution of processes within the Windows Subsystem for Linux (WSL) environment, specifically tracking the start of WSL processes or the invocation of WSL-related binaries like wsl.exe and vmmem. This allows security teams to monitor interop operations between the host Windows OS and the Linux subsystem.
Detects the creation of hidden Python virtual environments (.venv, .pip) in user directories used to cleanly execute OpenClaw and GhostSocks without system dependencies. This rule specifically looks for 'python.exe' executing with the '-m venv' argument followed by a hidden directory name (starting with a dot) and joins this with file events indicating a folder creation.
Identifies the execution of WindowsBackstageShell.exe used to create the invisible alternative desktop environment, as observed in Operation SilentCanvas.
Detects the creation or modification of registry values used by the HIDDENDRIVER rootkit to configure its hiding and protection capabilities. This rootkit, a modified version of the open-source "Hidden" project, uses these registry entries to define which files, processes, and registry keys to conceal. This activity is associated with the REF3927 threat actor and the TOLLBOOTH malware campaign.
Detects the creation or modification of registry values used by the HIDDENDRIVER rootkit to configure its hiding and protection capabilities. This rootkit, a modified version of the open-source "Hidden" project, uses these registry entries to define which files, processes, and registry keys to conceal. This activity is associated with the REF3927 threat actor and the TOLLBOOTH malware campaign.
Detects patching of network device system images for persistent backdoors
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
Detects the creation of the '.bun_ran' run-once marker in a temporary directory or suspicious Python '.pth' startup hooks (e.g., 'langchain_core-setup.pth') indicative of the Hades loader variant. The '.bun_ran' file acts as a marker for the loader, while '.pth' files can be used to inject malicious code into Python's import mechanism, achieving persistence or execution.
Detects setting IsHidden on a macOS user record to suppress the account from the login screen.
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
Maps to Atomic Red Team test "Create Hidden User using IsHidden option" (T1564.002).
KQL Query from file: INC Ransomware Command Execution
Hidden User Use Case Monitors dslocal user plist modifications for IsHidden, indicating a concealed local account created or modified outside standard account management workflows.
Detects enabling Hide500Users in com.apple.loginwindow plist preferences, which suppresses
sub-500 UID accounts from the login screen and System Settings.
sub-500 UID accounts from the login screen and System Settings.
This rule detects attempts to create hidden files or directories in the /tmp directory on a remote host via SSH. Specifically, it looks for SSH traffic (tcp port 22) containing the strings "touch ." and "/tmp/." (case-insensitive). This behavior is often associated with adversaries attempting to hide their artifacts on a compromised system.
Detects hiding a user home folder with chflags, complementing account-level hiding
documented in T1564.002.
documented in T1564.002.
Detects hiding a user home folder with chflags, complementing account-level hiding, documented in T1564.002.
Detects delete/create sequences on the same /Users/ path within a short time window,
consistent with account attribute laundering during hidden user setup.
consistent with account attribute laundering during hidden user setup.
Detects instances of QEMU emulators, particularly renamed binaries (e.g., svvhost.exe), executing with arguments indicative of loading a .qcow2 virtual disk image. BlackSuit affiliates are known to deploy QEMU virtual machines containing Linux or Windows operating systems to conceal backdoor proxy tools from host-level EDR.
Page 2 of 6