Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects the registration or installation of an MCP (Model Context Protocol) server or agent tool containing suspicious prompt-injection strings (e.g., instructions to ignore safety guardrails or role overrides), immediately followed by the execution of shell commands or unauthorized network connections originating from that tool.
Detects unauthorized modifications to AI agent configuration files, including system prompts, tool allow-lists, and MCP server registration files. Such changes are often performed by processes outside of approved configuration management or infrastructure-as-code pipelines, potentially allowing for persistent manipulation of AI model behavior and capabilities.
Detects outbound HTTPS connections to major generative AI inference endpoints originating from non-browser, non-development tool processes at regular intervals. This activity is indicative of beaconing behavior, where malware (specifically families like LAMEHUG) leverages LLM APIs for dynamic command generation, payload obfuscation, or C2 instruction retrieval, bypassing traditional security controls.
Detects a two-stage activity: first, the potential unauthorized reading or access of LLM provider API keys from files, environment variables, or command-line arguments; and second, the subsequent use of those same credentials to authenticate to LLM provider APIs (OpenAI, Anthropic, Azure, Bedrock) from a different, unrecognized source IP address, indicating potential credential theft and session hijacking.
Detects the execution of command-line interpreters (cmd, powershell, mshta, etc.) directly spawned by explorer.exe. This activity is indicative of the 'ClickFix' or 'ConsentFix' attack chain, where a victim is coerced into pasting malicious commands into the Windows Run dialog (Win+R) after interacting with a fraudulent CAPTCHA or verification page in their browser. The rule filters out standard installer-related activity to reduce false positives.
Detects execution of rundll32.exe or regsvr32.exe when spawned by powershell.exe or mshta.exe, specifically targeting DLLs located in common user-writable or temporary directories (AppData, ProgramData, Downloads). This pattern is consistent with the delivery of CastleLoader shellcode loaders following ClickFix-style social engineering lures.
Detects the use of legitimate Windows system binaries (LOLBins) such as curl.exe, certutil.exe, or bitsadmin.exe to download files. These binaries are monitored when spawned directly from common entry-point processes like explorer.exe, cmd.exe, or powershell.exe, which is characteristic of second-stage payload retrieval in ClickFix social engineering campaigns.
Detects the execution of Windows Installer (.msi) files or screensaver (.scr) files that were recently downloaded and executed via a web browser. Attackers often use these file types as lures for fake updates or software installers to execute malicious code on the victim's system.
Detects registry value modifications to the Windows Explorer RunMRU key where the data contains indicators of obfuscated PowerShell commands. This pattern is commonly associated with the 'ClickFix' social-engineering campaign, where users are prompted to copy and paste a malicious PowerShell command into the Windows Run dialog.
Detects instances where a suspected malicious loader initiates process hollowing or APC injection by launching trusted Windows binaries (e.g., LockAppHost.exe, makecab.exe, Magnify.exe) in a suspended state. The rule identifies suspicious post-injection behavior such as unexpected network connections or child process creation originating from these typically benign binaries, which is characteristic of the DeepLoad/ClickFix attack chain.
Detects DLL sideloading activity associated with the 'Lorem Ipsum Loader' malware. The rule monitors for specific combinations of legitimate Windows binaries loading specific DLLs from non-system directories, a common technique to execute malicious code via trusted processes.
The following analytic detects creation and removal of intermediary remediation artifacts of Windows Defender, during exploitation of ShieldCrash attacks.
Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the
symbolic link to redirect the remediation process to a staging directory controlled by the attacker. This detection aims to detect creation of defender artifact,
its alternate data stream, and their subsequent removal.
Exploit abuses the race condition between file validation and its remediation performed by Windows Defender. In between these steps, ShieldCrash changes the
symbolic link to redirect the remediation process to a staging directory controlled by the attacker. This detection aims to detect creation of defender artifact,
its alternate data stream, and their subsequent removal.
Detects the execution of the sckit Go implant, linked to the MemTensor supply chain compromise, during its host-profiling stage. The rule monitors for the 'sckit' binary being executed with 'stage0' and '--config64' command-line arguments, or being spawned by legitimate runtime interpreters like Node.js or Python, indicating an attempt to profile host information (timezone, language, privileges) and subsequent self-deletion.
Detects suspicious modifications to Windows Registry keys associated with URL protocol handlers or automatic startup mechanisms. Adversaries often use custom URL schemes or registry run keys to maintain persistence or execute malicious code when a specific protocol is invoked or upon user logon.
Detects instances where rundll32.exe loads a DLL file named Use.dll from a subdirectory named 'ComponentsFolder' within the AppData directory. This pattern is indicative of sandbox evasion techniques used by malware, such as the DarkMe RAT, where the DLL acts as an anti-sandbox gateway to check the execution environment.
Detects suspicious execution patterns characteristic of post-exploitation activity, such as invoking 'go run' or 'node' from non-standard directories like AppData or Temp, as well as the use of command-line routines to delete files after execution (often associated with self-deleting secondary payloads or persistence cleanup).
Detects the spawning of common administrative or script-execution tools as child processes from SharePoint-related processes (w3wp.exe or OWSTIMER.EXE). This behavior is often indicative of exploitation attempts targeting SharePoint application pools to execute arbitrary code.
Detects the loading of Python DLLs (python36.dll or python37.dll) from suspicious, non-standard user-writable directories such as Downloads, Temp, or AppData, which may indicate a DLL sideloading attempt.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
This rule detects a specific persistence technique used by AvisLoader malware. It monitors for the creation of a .lnk.backup file alongside a corresponding .lnk shortcut modification in common shell locations (Desktop, Taskbar, etc.), coupled with the execution of wscript.exe or cscript.exe referencing the 'VLCAssistant' VBScript within a short time window. This sequence indicates an attempt to persist malicious activity by backing up existing shortcuts and replacing them with a launcher for the AvisLoader payload.
Page 38 of 465