Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects the creation or modification of TxF CLFS log files (FsTxLog.blf) within the System Volume Information directory, which is a primary staging mechanism for the YellowKey BitLocker bypass. The rule also identifies potential VMware MAC OUI within the Resource Manager GUID, indicating a high-confidence proof-of-concept artifact.
Detects the creation of a scheduled task named '\MicrosoftSystem64', which is a specific Indicator of Compromise (IoC) associated with the Windows variant of the FAMOUS CHOLLIMA / MicrosoftSystem64 RAT malware for persistence. The rule identifies this activity through Windows Event Log (Event ID 4698 for task creation), command-line execution of 'schtasks.exe' with '/create' and the specific task name, and Defender EDR telemetry for scheduled task creation.
his detection identifies suspicious execution of update.exe processes launched by svchost.exe from user-writable directories such as AppData, Temp, Downloads, and Public folders.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This behavior is associated with malware techniques observed in the MiniFast campaign, where attackers use fake updater binaries and service-based execution chains to evade detection and maintain persistence.
The rule helps detect:
Malicious or fake update.exe execution
Abnormal parent-child process relationship (svchost.exe → update.exe)
Execution from non-standard user directories
Potential malware staging and execution behavior
This detection is intended to identify early-stage malware execution and suspicious process behavior linked to threat actor techniques described in recent threat intelligence reports.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects the creation or modification of an executable named 'GoogleUpdateService.exe' within a user's Windows Startup folder. This activity is indicative of the SStar Agent malware establishing persistence, as it masquerades as a legitimate Google update service but uses an atypical persistence mechanism (Startup folder instead of Scheduled Tasks or Registry Run keys).
Detects process executions or command-line arguments referencing the installation of identified malicious npm packages, specifically 'chalk-tempalte', '@deadcode09284814/axios-util', 'axois-utils', and 'color-style-utils'. These packages are associated with 'Shai-Hulud clones' and 'Phantom Bot' campaigns, often involving typosquatting or similar deceptive naming conventions to trick developers into installing malicious dependencies.
This rule detects network connections or DNS queries made to the domain 'data-seed-prebsc-1-s1.binance.org'. This domain is associated with the Binance Smart Chain testnet. Connections to such domains from enterprise environments might indicate unauthorized cryptocurrency-related activities, potential malware beaconing, or other policy violations.
Detects the creation or connection to the named pipe '\REDSUN' which is known to be used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This rule monitors both Microsoft Defender for Endpoint events and Sysmon Event IDs 17 and 18 for named pipe activity.
Identifies active Command and Control communication from infected hosts to known Red Lamassu infrastructure by monitoring network connections to specific C2 domains.
Detects RomulusLoader persistence behavior where Vulkan components (vulkan-1.dll, vulkaninfo.exe) or encrypted payload files (.bin) are written to the Common Files directory by the TA4922 threat actor.
This rule detects the creation of specific files associated with AppDomain hijacking by the Nimbus Manticore threat actor. It looks for the creation of files like 'setup.exe.config', 'TOTPGuard.dll', 'main.dll', and 'setup.exe' within the '\AppData\Roaming\2FAGuard\' directory. The rule is tuned to trigger when at least two distinct campaign files are created within a 10-minute window on the same device.
Detects the execution of the legitimate Windows binary 'usoclient64.exe' from unusual directories. This behavior has been observed in campaigns by the threat actor 10FXRAT for DLL side-loading and persistence.
Detects the execution of taskkill.exe targeting the iediagcmd.exe diagnostic tool. This defense evasion action is performed by the PlugX payload prior to establishing a C2 communication channel to prevent network diagnostic monitoring.
Detects Quick Assist spawning command interpreters (cmd.exe, powershell.exe, pwsh.exe) that execute common discovery and reconnaissance commands. This pattern is associated with hands-on-keyboard activity, as documented in campaigns like Nimbus RAT, and broader kill chains used by groups such as Storm-1811, Black Basta affiliates, and 3AM ransomware operators. The rule specifically looks for commands like 'whoami', 'ipconfig', 'systeminfo', 'hostname', 'net time', 'net user', 'net group', 'net localgroup', 'net view', 'nltest', 'qwinsta', 'tasklist', 'arp', 'route', 'netstat', '/domain', 'dsquery', and 'gpresult'.
KQL Query from file: Cloudflare Eviltokens: Gotta catch’em all
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
(Originally Authored by: Steven Lim (SlimKQL)
Expanded the original query to provide more context useful for investigation.
Original: https://systemtwosecurity.com/share/rule/Mn1XS6n9?utm_source=social&utm_medium=copy_link&utm_campaign=share&utm_content=detection
Detects the registration of a Cloud Files sync root provider with the name 'SERIOUSLYMSFT', a hardcoded value used by the RedSun exploit (CVE-2026-41091). This activity indicates an attempt to establish persistence or execute malicious code by abusing the Windows SyncRootManager functionality.
Detects the creation of specific .NET configuration files (.config) used by Screening Serpens for AppDomainManager hijacking, alongside known malicious DLLs. This rule correlates the creation of the campaign's specific config file names with the deployment of its associated payloads in the same folder within a short time frame.
Detects the specific command line arguments used by Payouts King ransomware, specifically requiring the mandatory execution trigger parameter '-i' alongside at least one of the obfuscated behavior flags: '-noelevate', '-nohide', '-nopersist', or '-note'. This combination is highly indicative of Payouts King ransomware execution.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects instances of the Tor daemon executing with custom torrc configurations outside of the standard Tor Browser directory. This behavior is often associated with malware like IronWorm, which downloads the Tor expert bundle, writes its own torrc, and starts the daemon to tunnel C2 traffic.
Detects cmd.exe launched with the exact command line arguments used by LampoRAT (Boggy Serpens) to spawn a shell for payload execution. This specific command line includes '/e:ON', '/v:OFF', '/d', and '/c', which are characteristic of LampoRAT's dispatcher logic.
Page 427 of 509