Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the creation of scheduled tasks that invoke rundll32.exe to execute code from suspicious, user-writable, or temporary file paths. This pattern is consistent with common persistence mechanisms employed by threat groups such as Wizard Spider (also known as Grim Spider, Gold Blackburn, and Periwinkle Tempest) to execute payloads like TrickBot or BazarLoader.
Detects Microsoft Office applications (Winword/Excel) spawning PowerShell or MSHTA with base64-encoded command-line arguments, followed by subsequent persistence mechanisms such as creating scheduled tasks or modifying Registry Run keys. This behavior is indicative of APT38 (BlueNoroff) and similar campaigns delivering banking Trojans via malicious Office macros.
Detects the execution of potentially malicious processes mimicking cryptocurrency or wallet applications (e.g., 'wallet', 'coin', 'crypto', 'exchange') that are launched from user-accessible directories like Downloads or Temp. The detection specifically looks for these processes spawning command-line interpreters (cmd.exe, powershell.exe) or proxy execution binaries (rundll32.exe), a behavior pattern characteristic of the AppleJeus campaign associated with Lazarus Group (Diamond Sleet).
Detects the modification of registry keys under HKLM or HKCU classes related to COM objects, specifically the InprocServer32 subkey, where the default value is changed to point to a DLL in common user-writable locations such as AppData, Temp, or ProgramData. This behavior is indicative of COM Hijacking used for persistence, as observed in Turla (Secret Blizzard) campaigns.
Detects Gamaredon (Armageddon) group activity characterized by Microsoft Office applications (winword.exe or excel.exe) writing to global template files (Normal.dotm or Personal.xlsb) to implant malicious macros, or dropping .vbs or .lnk files into startup or template directories to achieve persistence and facilitate further propagation.
Detects the silent installation of common Remote Monitoring and Management (RMM) tools (ScreenConnect, Atera, AnyDesk) when triggered by potentially suspicious parent processes such as email clients, web browsers, or archive utilities. This pattern is characteristic of MuddyWater's (Mango Sandstorm) post-compromise tradecraft for establishing persistent C2 channels.
This rule detects instances where Microsoft Word (winword.exe) or Microsoft Excel (excel.exe) initiate a PowerShell (powershell.exe) process containing command-line arguments typical of downloader stagers, such as 'IEX', 'DownloadString', or hidden execution flags. This behavior is a common indicator of macro-based delivery of malware, frequently observed in campaigns associated with FIN7/Carbanak and other threat actors utilizing Cobalt Strike or similar offensive frameworks.
Detects lateral movement via PsExec (PSEXESVC) followed by mass file encryption/rename activities and the creation of ransom note files, characteristic of Wizard Spider's deployment of Conti ransomware.
Detects a suspicious sequence of events where a remote access tool (RAT) is installed on a device, followed by significantly elevated and anomalous database query activity performed by the same account over an extended period. The rule utilizes a baseline window to identify deviations from normal query volumes while excluding known service accounts and administrative ETL/BI tasks.
Detects a suspicious sequence of events where a remote access tool (RAT) is installed on a device, followed by significantly elevated and anomalous database query activity performed by the same account over an extended period. The rule utilizes a baseline window to identify deviations from normal query volumes while excluding known service accounts and administrative ETL/BI tasks.
Detects a suspicious sequence of events where a remote access tool (RAT) is installed on a device, followed by significantly elevated and anomalous database query activity performed by the same account over an extended period. The rule utilizes a baseline window to identify deviations from normal query volumes while excluding known service accounts and administrative ETL/BI tasks.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects a suspicious sequence of events where a common internet-facing server process (e.g., w3wp.exe, nginx.exe) spawns a potentially malicious child process (e.g., cmd.exe, powershell.exe), followed shortly thereafter by mass file modifications on the same host, which is characteristic of ransomware behavior following initial exploitation.
Detects execution patterns associated with known Water Hydra exploit chains, specifically targeting CVE-2023-38831 (WinRAR self-extracting archive exploitation) and CVE-2024-21412 (Mark-of-the-Web/SmartScreen bypass via nested internet shortcuts). The rule monitors process lineage for WinRAR spawning command interpreters from temporary extraction directories and command line anomalies associated with rundll32.exe triggered from internet shortcut chains.
IOC hunt across DNS, network, and file-hash telemetry for the Ledger Google Ads phishing campaign. Vercel redirect domains are matched by exact hostname (DNS query name / parsed URL host) rather than substring, eliminating false positives from unrelated strings that merely contain a look-alike domain fragment. GCS bucket and Google Sites path IOCs remain substring-matched since the bucket IDs and page slugs are already highly specific.
Detects DNS query activity from processes commonly used as AI agent runtimes (e.g., python.exe, node.exe) toward domains characterized by DGA-like patterns, such as long alphanumeric strings or high-consonant density, which may indicate command-and-control communication.
Detects the installation of known AI-powered coding assistant extensions (e.g., Copilot, Tabnine, Cursor) on a device, followed by significant source-code repository cloning or archival activity by Git within two hours. This pattern is potentially indicative of intellectual property theft or sensitive source code exfiltration facilitated by a newly introduced AI tool.
Detects instances where a Claude process accesses a 'SKILL.md' file, followed closely by a suspicious command execution on the same device. The rule specifically targets command-line activity that involves encoding, download-and-execute patterns, staging in sensitive directories, or communication with suspicious domains/IPs, which is indicative of a supply-chain or poisoned agent-skill file attack.
Detects service-creation commands (sc create / New-Service / reg add under a Services key) whose COMMAND LINE itself references a known NeedyMantis binary name or sideload staging folder. Requiring the malicious reference to appear in the command being executed -- rather than merely in the calling process's own folder location -- removes false matches from unrelated legitimate software that happens to be installed under a similarly-named folder.
Detects the anomalous behavior of a Node.js process acting as a typosquatting agent. The detection identifies a node.exe process initiating a network connection to a known malicious C2 IP and port, followed by the termination of that same process within 45 seconds. This pattern is consistent with the agent crashing due to an unhandled exception (e.g., os.userInfo() failure) after beaconing.
Detects instances where common scripting or development language runtimes (Go, Node.js, WScript, CScript) access sensitive configuration or credential files, such as AWS credentials, Kubernetes configs, SSH keys, or environment files. This activity is often indicative of credential harvesting or unauthorized access to sensitive secrets by potentially malicious scripts or processes.
Page 26 of 465