Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
114 detections
Filters
Last updated
All Time
Detection languages
54
22
10
8
7
Contributors
23
21
16
12
7
Categories
58
36
34
24
16
Platforms
93
18
4
4
1
Products / Services
36
25
12
7
4
MITRE Techniques
18,113
15,640
12,591
8,389
6,208
IDS Classtypes
2
2
IDS Protocols
4
Detects browser cache smuggling (ClickFix/FileFix delivery mechanisms) where a non-browser script interpreter or LOLBin accesses a browser HTTP-cache directory and writes an executable or script payload outside the cache, followed shortly by the execution of a payload from a user staging directory.
Detects observable hiding actions targeting ScreenConnect (ConnectWise Control) clients, such as modifying registry keys to hide uninstall entries, using attrib.exe to set hidden attributes, or launching management tools with hidden window styles.
Detects a shell command referencing a hidden, octal/self-deleting payload
file written to a VMFS datastore volume using a '.sys' filename prefix followed by a
numeric timestamp, combined with an 'rm -f' cleanup of the same file. CrowdStrike observed
this VMFS staging technique used to blend a decoded payload in with legitimate system files
before it is executed and then removed as an anti-forensics step, denying incident
responders a copy of the payload from disk.
file written to a VMFS datastore volume using a '.sys' filename prefix followed by a
numeric timestamp, combined with an 'rm -f' cleanup of the same file. CrowdStrike observed
this VMFS staging technique used to blend a decoded payload in with legitimate system files
before it is executed and then removed as an anti-forensics step, denying incident
responders a copy of the payload from disk.
Detects the creation of hard links using 'mklink /H' targeting specific paths in ProgramData or linking to specific executable paths in AppData. This behavior is often indicative of adversaries attempting to perform file system manipulation for persistence, defense evasion, or masquerading.
Detects the creation of files within the 'SystemFolder32' or 'System Folder32' directory under the user's Local AppData path, a known behavioral pattern for payload staging used by the Transparent Tribe threat actor.
Detects the creation of hard links using 'mklink /H' targeting specific paths in ProgramData or linking to specific executable paths in AppData. This behavior is often indicative of adversaries attempting to perform file system manipulation for persistence, defense evasion, or masquerading.
Detects the creation or renaming of files within the '\ProgramData\doxc' directory, and correlates this with the execution of 'mklink /H' commands that point to that directory. This behavior is indicative of an adversary establishing persistence or hiding files by creating hard links.
Detects the creation or renaming of files within the '\ProgramData\doxc' directory, and correlates this with the execution of 'mklink /H' commands that point to that directory. This behavior is indicative of an adversary establishing persistence or hiding files by creating hard links.
Detects the creation of hard links on a Windows system using utilities such as mklink or fsutil. Specifically, this rule identifies scenarios where a malicious executable located in %APPDATA% is linked to a backdoor binary stored in C:\ProgramData\, a technique used by adversaries to mask the true file path and evade security controls or detection mechanisms.
Detects files referencing malicious implant install paths under C:\Windows\Fonts\web used to blend with legitimate system files
Detects files referencing malicious implant install paths under C:\Windows\Fonts\web used to blend with legitimate system files
Detects files referencing malicious implant install paths under C:\Windows\Fonts\web used to blend with legitimate system files
Detects potential anti-forensic activities performed by malware, specifically the use of 'attrib.exe' to hide files and 'cmd.exe' with 'del /f /q' to forcibly remove dropped payloads. These actions are common indicators of a cleanup phase in a malware lifecycle to hinder analysis.
Detects creation or modification of files under hidden, Apple-mimicking Application Support directories (.com.apple.accountsd, .com.apple.metadata.mds) that back a masquerading LaunchAgent -- the persistence mechanism AMOS stealer uses to survive reboot as AccountsHelper/mdworker_shared.
Detects creation of a new Microsoft Edge browser profile with a non-default, non-standard-numbered name, followed within 5 minutes by creation of files/folders containing "extension" or "native" under that profile's User Data path — consistent with the Edgecution malicious Edge extension backdoor installation flow.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Detects the mrmustard stealer's compiled-bytecode artifacts (hw_probe.pyc, .lock_*, .ts_*) dropped in the hidden .tf_cache directory used to evade static source-code review.
Detects the mrmustard stealer's compiled-bytecode artifacts (hw_probe.pyc, .lock_*, .ts_*) dropped in the hidden .tf_cache directory used to evade static source-code review.
Detects the use of the Windows 'attrib.exe' utility to hide a file named 'svehost.exe' within the 'AppData\Windows' directory. This behavior is indicative of an adversary attempting to conceal malicious artifacts or persistence mechanisms from the user and basic system exploration tools.
Page 1 of 6