Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
14 detections
Filters
Last updated
All Time
Detection languages
9
2
1
1
1
Contributors
4
3
2
2
1
Categories
10
5
3
2
2
Platforms
13
1
Products / Services
3
2
1
1
1
MITRE Techniques
18,114
15,633
12,576
8,388
6,214
IDS Classtypes
1
IDS Protocols
1
This rule detects potential persistence via Windows Registry Run keys by monitoring for the creation or modification of values pointing to suspicious paths (e.g., AppData, Temp, winupdate.exe). It also identifies suspicious execution of files originating from user-writable directories, specifically looking for indicators of PyInstaller-packaged executables or specific known malicious hashes, which are frequently used by adversaries for malware deployment.
Detects the execution of potential stealer malware (such as Yuta or Glove Stealer) packaged as a PyInstaller executable. The detection monitors for the characteristic behavior where the application unpacks its runtime environment into a _MEI* temporary directory and subsequently spawns child processes from that path, or utilizes specific naming conventions like 'winupdate.exe' within temporary or cache directories, common techniques for staging malicious payloads.
This rule detects the download of executable installer files (MSI or EXE) over HTTP that are larger than 500KB and contain the 'MZ' header, which is characteristic of Windows executables. The rule specifically looks for these files being delivered to a client within the home network. The message indicates a potential 'Executable Installer with Weak File Permission Exploit', suggesting that the downloaded file might be malicious or used in an exploit chain related to weak file permissions.
Detects the use of SharpUp, a tool for local privilege escalation
Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.
A recent worldwide cyberattack campaign has been detected involving the npm package axios. Malicious versions were reportedly used to deploy a remote access trojan during installation, which may impact developer workstations and CI/CD environments.
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
Detects the presence of malicious Microsoft Edge add-on IDs associated with the ShadyPanda campaign. These extensions are part of an active spyware operation affecting millions of users by exfiltrating browsing history, search queries, and other sensitive data.
Detects the presence of malicious Google Chrome extension IDs associated with the ShadyPanda campaign. These extensions can act as a backdoor, enabling remote code execution and data exfiltration.
Detects the execution of SharpUp, a tool used for local privilege escalation. The rule specifically looks for the executable name 'SharpUp.exe' or the description 'SharpUp', combined with command-line arguments indicative of its privilege escalation enumeration capabilities, such as 'HijackablePaths', 'UnquotedServicePath', 'ProcessDLLHijack', 'ModifiableServiceBinaries', 'ModifiableScheduledTask', 'DomainGPPPassword', and 'CachedGPPPassword'.
Detects the execution of "Setup16.EXE", an old installation utility, with a custom ".lst" file. These ".lst" files can contain references to external programs that "Setup16.EXE" will execute. Attackers and adversaries might leverage this as a Living Off The Land (LOLBIN) utility for various malicious purposes.
Detects the execution of "Setup16.EXE" and old installation utility with a custom ".lst" file.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.
These ".lst" file can contain references to external program that "Setup16.EXE" will execute.
Attackers and adversaries might leverage this as a living of the land utility.
Detects the use of SharpUp, a tool for local privilege escalation
Detects the use of SharpUp, a tool for local privilege escalation