Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
21 detections
Filters
Last updated
All Time
Detection languages
9
7
5
Contributors
4
4
4
3
2
Categories
5
5
5
5
4
Platforms
16
5
4
1
1
Products / Services
7
5
3
2
2
MITRE Techniques
18,115
15,635
12,576
8,388
6,215
IDS Classtypes
5
IDS Protocols
5
This rule detects the creation or presence of specific file artifacts ('PDF_C2089_20260911100446.exe' and 'active_desktop_render_x64.dll') within the '\AppData\Microsoft\Update\' directory. These file names and paths are characteristic of potential malware staging or persistence mechanisms, specifically associated with the SilverFox threat activity.
Detects outbound network requests to known infrastructure associated with the ClickFix Traffic Direction System (TDS), specifically targeting domains 'fsputnik.com' and 'uasputnik.com'. The rules monitor for requests to specific lure pages, tracker files, and established IP connections used by this malicious campaign to deliver fraudulent prompts or lures to victims.
Detects the MSBuild.exe process adding new root or intermediate certificate authorities to the Windows certificate stores. This activity is indicative of potential malicious PKI infrastructure staging, which can be used to facilitate adversary-in-the-middle (AiTM) attacks or bypass certificate validation.
Detects outbound HTTP requests to 'third-party.com', a domain identified as being associated with 'ClickFix' social engineering lures, which are commonly used to deceive users into executing malicious scripts or downloading payloads.
This rule detects the creation or presence of specific file artifacts ('PDF_C2089_20260911100446.exe' and 'active_desktop_render_x64.dll') within the '\AppData\Microsoft\Update\' directory. These file names and paths are characteristic of potential malware staging or persistence mechanisms, specifically associated with the SilverFox threat activity.
UNC6692 Edgecution phishing/payload page hosted on AWS S3 static website hosting (patch.html/.a payload)
Detects endpoint connections directly to Kali365 PhaaS panel domains, which are associated with phishing-as-a-service operations. This rule identifies network activity to specific domains used by the Kali365 platform, indicating potential compromise or interaction with phishing infrastructure.
Detects malware using Pastebin as a dead drop resolver for C2 config
This rule detects HTTP PUT requests to known remote file hosting services (transfer.sh, file.io, gofile.io, anonfiles). This activity is indicative of payload staging, where an attacker uploads malicious files or tools to a remote server for later use in an attack, often as part of the resource development phase of the attack lifecycle.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
This rule detects the download of Android Application Package (APK) files from Amazon S3 buckets, where the HTTP URI contains keywords related to gambling (slot, bet, play, jackpot). This activity is indicative of potential malware distribution, specifically targeting Android devices with gambling-themed applications, as observed in Indonesian gambling ecosystems.
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.
Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.
Detects suspicious attempts to download files from legitimate Microsoft domains (Outlook and OneNote) using command-line tools or PowerShell. Adversaries may leverage these trusted domains to host malicious files, bypassing traditional perimeter defenses and making the activity appear legitimate. The rule specifically looks for common download utilities like curl, wget, Invoke-WebRequest, and Start-BitsTransfer in conjunction with specific Microsoft attachment/sync domains.
Detects suspicious ways to download files from Microsoft domains that are used to store attachments in Emails or OneNote documents
Detects the installation of the Azure Hybrid Connection Manager service by monitoring registry modifications. This service can be used to allow remote code execution from Azure functions, potentially as a method for adversaries to establish persistence or facilitate further access.
Detects the installation of the Azure Hybrid Connection Manager service to allow remote code execution from Azure function.