Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
295 detections
Filters
Last updated
All Time
Detection languages
116
41
34
33
20
Contributors
106
38
28
23
20
Categories
165
157
111
46
39
Platforms
229
188
103
9
9
Products / Services
10,660
9,755
6,689
4,418
3,748
295
MITRE Techniques
172
112
60
51
43
CVEs
6
6
3
2
2
IDS Classtypes
4
IDS Protocols
4
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
This rule detects command line patterns associated with common Impacket tools (wmiexec, psexec, smbexec) executed via Windows processes (cmd.exe, powershell.exe) or via network connections to ports 445 and 135 initiated by Python processes. These tools are frequently used by adversaries for lateral movement, remote service execution, and command execution on compromised systems.
Detects potential exploitation of CVE-2025-3248 in Langflow by identifying suspicious inbound network traffic targeting the /api/v1/validate/code endpoint, correlated with subsequent python child processes containing base64 decoding and execution primitives such as eval, exec, or subprocess.
This rule detects command line patterns associated with common Impacket tools (wmiexec, psexec, smbexec) executed via Windows processes (cmd.exe, powershell.exe) or via network connections to ports 445 and 135 initiated by Python processes. These tools are frequently used by adversaries for lateral movement, remote service execution, and command execution on compromised systems.
Detects the execution of Python scripts explicitly named 'socks5.py'. This is a common pattern used by adversaries to establish proxying capabilities for command and control or to tunnel traffic through a compromised host.
This rule detects command line patterns associated with common Impacket tools (wmiexec, psexec, smbexec) executed via Windows processes (cmd.exe, powershell.exe) or via network connections to ports 445 and 135 initiated by Python processes. These tools are frequently used by adversaries for lateral movement, remote service execution, and command execution on compromised systems.
This rule detects command line patterns associated with common Impacket tools (wmiexec, psexec, smbexec) executed via Windows processes (cmd.exe, powershell.exe) or via network connections to ports 445 and 135 initiated by Python processes. These tools are frequently used by adversaries for lateral movement, remote service execution, and command execution on compromised systems.
The following analytic detects a Python process making an outbound network connection during package installation.
Adversaries can abuse `setup.py` build scripts by leveraging `distutils`/`setuptools` command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed.
This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running `pip install`.
If confirmed malicious, this could indicate a successful software supply chain compromise.
Adversaries can abuse `setup.py` build scripts by leveraging `distutils`/`setuptools` command classes to execute arbitrary code, including network beacons to third-party domains, the moment a malicious Python package is installed.
This activity is significant because it allows adversaries to establish a foothold or exfiltrate data without any direct interaction from the victim beyond running `pip install`.
If confirmed malicious, this could indicate a successful software supply chain compromise.
SynkLoader PhishLocker Behavior
Cortex XDR
Detects indicators of the PhishLocker credential harvester, specifically the loading of fake Microsoft Visual C++ runtime DLLs from non-standard (user-writable) paths and unauthorized access to Windows lock screen images by Python-based processes.
Detects the use of a modified 'msvcp160.dll' associated with SynkLoader, specifically identifying exports related to manual DLL mapping ('ManualMapDLL', 'ManualResolveExport') and the accompanying Python loader script that utilizes 'ctypes.WinDLL' to perform in-memory execution.
Detects the execution of Python or Pythonw processes with command-line arguments that include base64 decoding followed by the exec() function. This pattern is commonly used by adversaries to execute obfuscated or encoded malicious code directly in memory to evade detection.
Detects python.exe executing from unusual locations (AppData, Temp, or ProgramData directories) that subsequently establish outbound network connections, consistent with DeviceManager RAT behavior delivered via the DOUBLECUP loader.
Detects python.exe executing from unusual locations (AppData, Temp, or ProgramData directories) that subsequently establish outbound network connections, consistent with DeviceManager RAT behavior delivered via the DOUBLECUP loader.
Detects Python worker processes (e.g., dataset converters) spawning suspicious child processes (shells, network tools) or accessing sensitive filesystem paths/endpoints, such as Kubernetes service account tokens or cloud instance metadata, which are often indicative of post-exploitation activity following an SSTI or code injection vulnerability.
This rule detects the presence of the Edgecution native_host.py Python backdoor by identifying specific, hardcoded code structures used for XOR deobfuscation. It specifically looks for the decryption loop combined with the registry lookup against 'HKCU\SOFTWARE\Microsoft\Edge' used to derive the decryption key, as well as distinct function names and error strings associated with the malware's implementation.
Detects installation or import of the trojanized mrmustard 0.7.4 PyPI package via pip or a direct python import, the initial-access vector for this supply-chain compromise.
Detects Python process creation where the command line references base64, zlib, and ctypes libraries concurrently. This combination is frequently used by attackers to deobfuscate, decompress, and execute payloads dynamically in memory, often bypassing traditional file-based detection mechanisms.
Detects Python process creation where the command line references base64, zlib, and ctypes libraries concurrently. This combination is frequently used by attackers to deobfuscate, decompress, and execute payloads dynamically in memory, often bypassing traditional file-based detection mechanisms.
Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.
Detects Python process creation where the command line references base64, zlib, and ctypes libraries concurrently. This combination is frequently used by attackers to deobfuscate, decompress, and execute payloads dynamically in memory, often bypassing traditional file-based detection mechanisms.
Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.
Page 4 of 15