Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,670 detections
Filters
Last updated
All Time
Detection languages
10,186
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,280
2,976
2,237
1,829
1,457
Platforms
10,381
1,107
807
155
98
Products / Services
10,670
9,758
6,693
4,421
3,749
MITRE Techniques
3,812
3,129
1,796
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects the execution of the Bun runtime attempting to execute known malicious scripts associated with the Mini Shai-Hulud supply chain compromise. Attackers use Bun during npm installation to evade traditional Node.js security monitoring.
Detects outbound network connections to known C2 domains associated with the Mini Shai-Hulud supply chain worm, used to exfiltrate stolen credentials from developer machines and CI/CD pipelines.
This suite of rules detects various activities associated with the Mini Shai-Hulud npm worm, including the execution of its payload via bun, network connections to its exfiltration domain, attempts by Node.js or Bun processes to access AWS IMDS for credential theft, access to local HashiCorp Vault instances, identification of known malicious script file hashes, and the installation of its specific malicious GitHub dependency.
Detects the execution of the Bun runtime attempting to execute known malicious scripts associated with the Mini Shai-Hulud supply chain compromise. Attackers use Bun during npm installation to evade traditional Node.js security monitoring.
This rule identifies 'chokepoint' devices within an environment based on their high number of inbound and outbound connections (at least 2 each). It then enriches these chokepoint devices with vulnerability and misconfiguration remediation recommendations from Microsoft Defender for Endpoint (MDE) TVM and Exposure Graph. The rule prioritizes remediation based on the calculated 'ChokepointScore' (InboundCount * OutboundCount) and indicates if the device has active exploits. This helps security teams focus remediation efforts on critical assets that could significantly impact the network if compromised.
Detects suspicious command line interpreters or downloaders stored in the Windows RunMRU registry key. This technique is often used in ClickFix attacks where users are socially engineered into pasting malicious commands into the Windows Run dialog.
Detects the execution of the Windows Bluetooth File Transfer Wizard (fsquirt.exe), which may be abused for data exfiltration or payload delivery over Bluetooth. The rule identifies execution of fsquirt.exe and flags potentially suspicious indicators like specific transfer arguments or execution from non-standard paths.
Detects instances where 'curl.exe' is used to download content related to Node.js, specifically looking for 'nodejs.org' or 'node-v' in the command line. This could indicate an adversary attempting to download and execute a Node.js runtime or related tools on a compromised system.
Detects the creation or modification of a registry run key that establishes persistence by executing 'conhost' or 'node.exe' with '--headless' or '.cfg' arguments. This technique is often used by adversaries to maintain access to a system after a reboot or user login.
Detects the execution of mshta.exe attempting to download and execute a remote payload masquerading as an msixbundle file. This technique is used in the InstallFix campaign to deliver ZIP/HTA polyglots.
Detects the variable splitting technique in cmd.exe specifically designed to obfuscate the invocation of PowerShell (e.g., set x=pow&&set y=ershell). This technique is used in the InstallFix campaign to bypass static command-line monitoring.
Detects the creation of a scheduled task named 'WindowsHelper', which is used by Operation HumanitarianBait for persistence to launch its Python implant every 5 minutes. This rule specifically looks for command-line executions of 'schtasks.exe' or commands containing 'schtasks' that include '/create' and the task name 'WindowsHelper'.
Detects the execution of 'module.pyw' using 'pythonw.exe', which is a technique employed by Operation HumanitarianBait to silently run an infostealer. This rule specifically targets the combination of the windowless Python interpreter and the known payload script name.
Detects DNS lookups and outbound network connections to known PhantomRaven command and control (C2) infrastructure, including specific domains and IP addresses. The rule also specifically identifies potential data exfiltration attempts to the '/mozbra.php' endpoint.
Detects cmd.exe spawning PowerShell to download a file using System.Net.WebClient to the Windows Temp directory. This pattern was observed in the DAEMON Tools supply chain attack to drop secondary payloads.
Detects network connections to known PhantomRaven Wave 5 command-and-control infrastructure. PhantomRaven is an NPM supply chain attack targeting DeFi, Cloud, and AI developers.
Detects DNS queries or network connections to known PhantomRaven Wave 5 command-and-control infrastructure (domains and IP addresses). This rule identifies communication with specific malicious domains and IP addresses associated with the PhantomRaven campaign, indicating potential compromise or attempted communication with adversary infrastructure.
Detects Node.js processes querying public IP-address and geolocation lookup services. This automated reconnaissance behavior is the standard "where am I" primitive used by an enormous range of Node-based malware and supply chain campaigns including PhantomRaven (npm), Shai-Hulud, the Bitwarden CLI compromise, Ultralytics-style attacks, and countless commodity Node-based stealers and droppers. Legitimate Node applications rarely query public IP services from developer endpoints — when they do, it is most often during malicious package install lifecycle hooks or within fileless droppers fetched from attacker-controlled C2 servers.
Identifies regasm.exe executing a payload disguised as a .txt file, a technique observed in CloudZ RAT intrusions to proxy the execution of its .NET loader.
Detects unexpected access to PhoneExperiences-*.db files which may contain synchronized SMS and OTP messages. This behavior is associated with the CloudZ RAT and Pheno plugin bypassing SMS-based MFA.
Detects the creation of Pheno plugin output files (phonelink-<COMPUTERNAME>.txt) in the Microsoft feedback folder. This indicates the Pheno plugin is actively preparing to intercept PC-to-phone synchronization tools for OTP theft.
Page 435 of 509