Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,759
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects suspicious processes (e.g., powershell.exe, cmd.exe, mshta.exe) making outbound network connections to public IP addresses on non-standard ports. This behavior can indicate command and control (C2) communication or data exfiltration attempts, as adversaries often use non-standard ports to evade detection.
Detects the creation, modification, or renaming of 'btasc.cfg', a configuration file specifically associated with the JFMBackdoor malware. This file is used to store encrypted configuration data necessary for the backdoor's operation.
This rule detects when a web browser initiates the execution of an executable (.exe), dynamic link library (.dll), JavaScript (.js), or VBScript (.vbs) file. This behavior can be indicative of malicious activity such as drive-by downloads, phishing attacks leading to malware execution, or exploitation of browser vulnerabilities.
Detects the specific sequence of commands used in the ClickFix FakeCaptcha attack, moving a ZIP from Downloads, extracting it via tar, and silently executing a batch file. This rule looks for `cmd.exe` processes that contain `move`, `Downloads`, `tar`, `start`, `-xf`, and `/min` in their command line, along with specific payload filenames like `update.zip`, `u.zip`, or `update.bat`.
This rule set detects various stages of the JFMBackdoor and Showboat malware, including DLL sideloading of FLTLIB.dll by fltMC.exe from non-standard directories, network connections to known C2 and staging infrastructure (namefuture.site or 23.27.201.160), command-line activity referencing a specific Pastebin URL used by Showboat for process-hiding code, and the creation of JFMBackdoor payload artifacts (flt.bin, scr.mui).
Detects the creation of the 'Oregon.wdlp' file in the Windows Startup folder, which is a known secondary persistence mechanism used by the BlackBeard malware, linked to the Boggy Serpens threat group.
This rule detects attempts to search for sensitive keywords like 'password', 'secret', 'credential', 'creds', 'apikey', 'token', or 'key' using 'findstr.exe' or 'reg.exe'. This activity can indicate an adversary attempting to discover credentials or other sensitive information on a compromised system.
Detects the creation or configuration of a Windows service using 'sc.exe' executed via 'cmd.exe', specifically looking for commands containing 'create' or 'config' along with 'binpath'. This activity can indicate persistence mechanisms or privilege escalation attempts by adversaries.
Detects PowerShell execution initiated by 'MicrosoftSystem64.exe' or 'MicrosoftSystem64' with specific command-line arguments (-NoProfile, -NonInteractive, -Command). This activity is indicative of the Node.js SEA RAT malware, associated with the DPRK-linked actor FAMOUS CHOLLIMA, attempting remote command execution.
Detects the execution of the 'MicrosoftSystem64' RAT binary across Windows, macOS, and Linux operating systems. This specific malware is associated with the FAMOUS CHOLLIMA threat group, which is linked to DPRK, and is known to deploy a Node.js SEA RAT that exfiltrates data to HuggingFace.
Detects rundll32.exe executing with UNC path arguments, indicative of a remote WebDAV payload loaded directly into memory. This behavior has been observed in campaigns such as ClearFake and ClickFix.
Detects the creation of the specific named pipe '\REDSUN' used by the RedSun exploit (CVE-2026-41091) for inter-process communication. This named pipe is a unique indicator of the RedSun exploit's activity, often associated with process injection or other inter-process communication mechanisms.
Detects PowerShell or pwsh.exe processes being launched with the '-windowstyle hidden' or '-w hidden' or '-window hidden' command-line arguments. This technique is often used by adversaries to conceal their activity from users.
Detects the initial script execution phase of the Red Lamassu JFMBackdoor infection chain, specifically PowerShell downloading components into the TEMP directory. This rule looks for PowerShell execution that uses common download commandlets (Invoke-WebRequest, iwr, wget, Net.WebClient) to save specific Red Lamassu payload filenames (FLTLIB.dll, scr.mui, flt.bin, fltMC.exe) into a temporary directory.
Detects the SStar Agent malware executing remote shell commands by creating and executing ephemeral batch files. The malware creates a file named sstar-*.cmd in the %TEMP% directory and executes it using cmd.exe.
Identifies the creation or modification of the hardcoded persistence and staging directory used by the JFMBackdoor malware, specifically 'C:\Users\Public\jfm'. This rule detects file system events within this specific path, indicating potential JFMBackdoor activity.
This rule detects an unusually high number of executable (.exe or .msi) file creations within common installation or binary folders (containing 'setup', 'install', or 'bin' in their path) by a single process within a one-hour window. This behavior could indicate the staging or unpacking of malicious software, or a legitimate but potentially suspicious installation activity.
This rule detects processes making a high volume of network connections (10 or more within an hour) to URLs containing 'release' or 'download'. This behavior can be indicative of malware downloading additional components, updates, or exfiltrating data, but could also be legitimate software updates or large file transfers.
This rule detects the creation of 'requirements.txt' or 'pom.xml' files on a system. These files are commonly used in software development projects (Python and Java/Maven, respectively) to manage dependencies and project configurations. Monitoring their creation can help identify legitimate development activities, but also potential malicious actions such as supply chain compromise where an adversary might introduce or modify project dependencies.
Identifies the SHA-256 hash associated with the BLUEBEAM (Godzilla) web shell payload (LoadLibrary.dll) dropped during KnowledgeDeliver exploitation. This rule looks for the specific hash across file creation, image load, or process execution events.
Detects the execution of 'active_desktop_launcher.exe' (a legitimate signed KuGou binary) from unusual directories like ProgramData or AppData\Local\Temp. This behavior indicates potential DLL side-loading staging by the BoldTealLayer malware prior to executing its in-memory evasion chain.
Page 428 of 509