Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
18,128 detections
Filters
Last updated
All Time
Detection languages
6,549
6,208
1,473
1,005
661
Contributors
3,555
2,652
2,153
2,087
1,515
Categories
7,572
3,901
1,465
1,393
1,330
Platforms
13,733
1,392
1,319
824
738
Products / Services
3,828
3,137
2,448
912
908
MITRE Techniques
18,128
15,653
12,600
8,411
6,235
CVEs
19
18
17
16
14
IDS Classtypes
305
51
24
23
22
IDS Protocols
308
136
13
10
10
Detects the execution of PowerShell commands using '[scriptblock]::Create' in conjunction with character array decoding or large negative integer-array patterns. This technique is commonly used to deobfuscate and execute obfuscated PowerShell scripts at runtime.
Detects the execution of PowerShell commands using '[scriptblock]::Create' in conjunction with character array decoding or large negative integer-array patterns. This technique is commonly used to deobfuscate and execute obfuscated PowerShell scripts at runtime.
Detects the execution of known Canon or Stardock software binaries (COTFileReadApp.exe, DeElevate64.exe) when spawned by msiexec.exe from non-standard locations such as Temp or AppData directories. This pattern is indicative of potential defense evasion, where adversaries leverage legitimate software to proxy execution or potentially perform side-loading activities.
Detects the creation of Windows Registry Run keys with names mimicking known applications (e.g., 'Canon Configuration Reader' or 'Stardock DeElevation Tool'). These naming patterns are highly suspicious and indicative of attempts to achieve persistence or perform defense evasion via registry-based autostart execution.
Detects instances where identified RAT-associated or potentially malicious parent processes spawn command-line interpreters (e.g., cmd, powershell) or execute archive management commands, which is indicative of secondary stage payload deployment or automated execution following initial compromise.
Detects suspicious execution patterns involving msiexec where a PowerShell process launches or is the parent of an MSI installation occurring from the %TEMP% directory with a GUID-based filename, or when msiexec executes an application from within %AppData%\Local\Programs. This pattern is often associated with fileless malware, ClickFix-style social engineering attacks, or suspicious persistence/installation behavior.
Detects the creation of specific named mutexes used by the CHOSEN BRICK malware. The malware utilizes these mutexes as an execution guardrail to ensure only one instance of the infection persists on a host. Identification of these mutexes is a high-confidence indicator of CHOSEN BRICK infection activity, often accompanying persistence via Registry Run keys and subsequent communication with Telegram-based command and control servers.
This rule detects instances where PowerShell is executed by a Windows Script Host process (wscript.exe or cscript.exe) using common suspicious command-line arguments. This pattern is frequently used by adversaries to execute obfuscated or bypassed PowerShell scripts while attempting to hide or proxy the execution through legitimate scripting host processes.
Detects the execution of regsvcs.exe when initiated by PowerShell, or when invoked with specific command line arguments indicating .NET reflection (GetType, GetMethod, method.Invoke) typically associated with fileless execution or proxying malicious code. The rule specifically targets instances involving .NET Framework directories.
Detects VBScript files that exhibit characteristics of a downloader or dropper, including common Windows API usage (WScript.Shell, Shell.Application, MSXML2.XMLHTTP, ADODB.Stream), staging in the C:\Users\Public\ directory, and performing sandbox evasion via WMI InstallDate checks.
This rule detects potential dropper activity associated with the TrustSink/XHOPLESS threat actor, specifically involving an 'Evernote.zip' file staged in the C:\Users\Public directory. It monitors for the automated extraction of files (like a repurposed notepad++.exe) using VBScript's Shell.Application or WScript.Shell, which is indicative of a side-loading attack chain.
Detects the presence of ZIP archive files masquerading as 'Evernote.zip' that contain 'notepad++.exe', which is a pattern frequently observed in VBScript-based downloaders utilizing binary sideloading to execute malicious payloads.
Detects successful VPN logins that bypass multi-factor authentication (MFA) and originate from unusual ASN/IP addresses or occur during atypical hours. This behavior is indicative of potential unauthorized access using compromised credentials, consistent with threat actor patterns that exploit environments lacking mandatory MFA enforcement.
Detects the use of WScript or CScript to query the Win32_OperatingSystem WMI class for the InstallDate property. This behavior is commonly used by malware to identify the system installation time, which can serve as a simple heuristic for sandbox evasion or environmental keying.
Detects a multi-stage malware execution pattern consistent with VelvetCake activity. This includes staging text-based files in C:\Users\Public, downloading PowerShell scripts to temporary directories, executing the script via PowerShell, and subsequently deleting both the staged text files (except for specific allowed filenames) and the payload script.
Detects the installation or execution of virtual camera or synthetic media software followed shortly by the launch of common video conferencing applications on the same endpoint. This behavior may indicate an attempt to inject synthetic video feeds into meetings for impersonation or business email compromise (BEC) attacks.
Detects PowerShell ScriptBlock events (4104) that exhibit characteristics of AI/LLM-generated code, specifically the presence of highly descriptive inline commentary combined with encoded commands or remote network download cradles. This pattern is often used by automated tools to generate syntactically randomized obfuscated scripts to evade detection.
Detects the insertion of malicious prompt injection payloads—containing imperative commands to AI agents or hidden unicode/non-printable characters—into wiki pages, ticketing systems, or other shared knowledge bases. These payloads are designed to be ingested by AI agents or Retrieval-Augmented Generation (RAG) pipelines, leading to unauthorized instructions or behavioral overrides upon retrieval.
Detects video and audio conferencing clients (e.g., Zoom, Microsoft Teams, Webex) loading either unsigned DLLs or DLLs commonly associated with virtual camera and audio injection tools (e.g., OBS VirtualCam, Snap Camera). This behavior is characteristic of deepfake injection techniques used to manipulate video conference participants.
Detects a sequence of suspicious identity activities indicative of a post-account-takeover pivot. The rule identifies a user profile engaging in corporate VPN SAML SSO probing, triggering a MFA enrollment interrupt in Azure, and subsequently accessing multiple Microsoft 365 applications (Azure Portal, OfficeHome, SharePoint) within a 30-minute window.
This rule monitors for two distinct suspicious patterns: first, the interaction between Claude Desktop and the CEF (Chromium Embedded Framework) library, which may indicate unauthorized plugin or extension loading; second, the execution of non-standard binaries initiated by various JetBrains IDE processes located outside of standard program directories, which could indicate process hollowing or unauthorized tool execution.
Page 69 of 864