Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
40,056 detections
Filters
Last updated
All Time
Detection languages
15,357
13,598
2,797
1,803
1,721
Contributors
7,678
5,999
5,315
4,504
4,191
Categories
18,109
9,757
3,851
3,758
3,713
Platforms
40,056
7,331
6,542
3,907
3,664
Products / Services
10,439
9,678
6,723
1,887
1,878
MITRE Techniques
13,737
13,116
8,066
5,949
4,414
CVEs
49
45
30
30
29
IDS Classtypes
214
56
43
23
19
IDS Protocols
183
172
20
16
8
Detects the execution of OrionQuests-Setup.exe, a .NET-based executable identified as a malicious installer used by the Kimsuky (APT-C-55/BabyShark) threat group. The rule flags PE files that match the specific filename and contain both .NET framework indicators and references to LNK files, suggesting the dropper mechanism for initial stage infection.
Detects the execution of PowerShell with suspicious command line flags (such as hidden windows, bypass execution policies, or encoded commands) where the parent process is a shortcut (.lnk) file. This is a common technique used by attackers to execute malicious scripts via phishing or social engineering, where a user is tricked into clicking a malicious link file.
Detects the execution of a process named 'firefox.exe' that is running from a path other than the standard Mozilla Firefox installation directory. This is a common technique used by malware to masquerade as a legitimate web browser.
This rule detects processes named 'firefox.exe' running from locations other than the standard Mozilla Firefox installation directories. This behavior is often indicative of an adversary attempting to masquerade malicious activity by using a legitimate browser process name.
Detects unauthorized write, modification, or rename operations performed on the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) by processes that are not typically authorized for such activity, such as standard system processes (svchost, services, etc.).
Detects the use of .NET reflection assembly loading techniques (e.g., Assembly.Load, [Reflection.Assembly]::Load) within the command line arguments of known LOLBAS (Living Off the Land Binary and Script) processes. This behavior is frequently associated with fileless malware execution or the loading of malicious assemblies directly into the memory space of trusted Windows binaries.
Detects unauthorized processes attempting to access browser credential database files such as Login Data for Chromium-based browsers or logins.json and key4.db for Firefox. The rule filters out known browser processes to isolate potential credential harvesting or exfiltration activity.
This rule detects processes named 'firefox.exe' running from locations other than the standard Mozilla Firefox installation directories. This behavior is often indicative of an adversary attempting to masquerade malicious activity by using a legitimate browser process name.
Detects unauthorized write, modification, or rename operations performed on the Windows hosts file (C:\Windows\System32\drivers\etc\hosts) by processes that are not typically authorized for such activity, such as standard system processes (svchost, services, etc.).
Detects execution, file writing, or network activity associated with the process named 'Stella_Gary', which may indicate the retrieval or use of malicious plugin modules.
This rule detects the execution of 'OrionQuests-Setup.exe' triggered via a shortcut (.lnk) file. It correlates file creation events involving .lnk files with subsequent process creation events for the specified executable to track potential user execution or masquerading attempts.
Detects the execution of PowerShell with common obfuscation or stealth-related flags (e.g., -enc, -nop, -w hidden) when initiated by CMD or from a LNK file, particularly when originating from Windows Explorer. This is a common pattern for malicious file execution and dropper activity.
This rule detects the execution of 'OrionQuests-Setup.exe' triggered via a shortcut (.lnk) file. It correlates file creation events involving .lnk files with subsequent process creation events for the specified executable to track potential user execution or masquerading attempts.
This rule searches for any process, image load, or file events containing the string 'Stella_Gary' within file names, folder paths, or process command lines. This is a generic hunting rule typically used to identify artifacts, indicators, or files associated with a specific entity or project codename.
This rule searches for any process, image load, or file events containing the string 'Stella_Gary' within file names, folder paths, or process command lines. This is a generic hunting rule typically used to identify artifacts, indicators, or files associated with a specific entity or project codename.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla installation directories, such as AppData, Temp, Downloads, or ProgramData. Additionally, the rule validates if the binary is digitally signed by Mozilla. This behavior is indicative of a masquerading attempt, where an attacker runs a malicious executable disguised as Firefox.
Detects instances of 'firefox.exe' executing from locations other than the standard Mozilla installation directories, such as AppData, Temp, Downloads, or ProgramData. Additionally, the rule validates if the binary is digitally signed by Mozilla. This behavior is indicative of a masquerading attempt, where an attacker runs a malicious executable disguised as Firefox.
Detects instances where a process named firefox.exe, executing from the ProgramData directory, is used to establish persistence via Windows Registry Run keys or to create scheduled tasks/services. This behavior is indicative of a malicious process masquerading as the legitimate Firefox browser to maintain persistence on a host.
Detects unauthorized processes attempting to access sensitive web browser files (login data, cookies, configuration) located in Chrome or Firefox profile directories. The detection excludes known browser-related processes and system processes, focusing on third-party or potentially malicious utilities that could be used to harvest credentials stored in these local files.
This rule detects modifications to the Windows hosts file (C:\Windows\System32\drivers\etc\hosts). Adversaries often modify this file to redirect legitimate traffic to malicious IP addresses, a technique commonly used for command and control or phishing campaigns.
Detects instances where a process masquerading as 'firefox.exe' executes common system reconnaissance commands such as systeminfo, ipconfig, whoami, and tasklist from non-standard file paths. This behavior is indicative of the BabylonRAT malware attempting to gather system and network information after establishing persistence.
Page 406 of 1908