Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,759 detections
Filters
Last updated
All Time
Detection languages
3,724
2,036
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,226
485
Categories
5,718
3,075
1,138
900
659
Platforms
9,646
658
432
53
30
Products / Services
10,696
9,759
6,696
4,421
3,752
MITRE Techniques
3,828
3,376
1,980
1,617
1,042
CVEs
18
14
12
12
11
Detects a sequence of events where a potential multimedia lure (PDF, image, or media file) is created or downloaded via a web browser or communication client, followed by an AI agent (e.g., ChatGPT, Claude) accessing the file, and subsequently initiating a shell execution process (PowerShell, CMD, etc.) involving suspicious command-line patterns or references to the original file. This behavior is indicative of an AI-assisted prompt injection attack where malicious content is processed and executed through agent tooling.
Detects a sequence of events where a potential multimedia lure (PDF, image, or media file) is created or downloaded via a web browser or communication client, followed by an AI agent (e.g., ChatGPT, Claude) accessing the file, and subsequently initiating a shell execution process (PowerShell, CMD, etc.) involving suspicious command-line patterns or references to the original file. This behavior is indicative of an AI-assisted prompt injection attack where malicious content is processed and executed through agent tooling.
Detects the loading of a known malicious 7z.dll file within the 'Traiolx Custom Utils' directory. This behavior is indicative of DLL sideloading used by LegionLoader to achieve code execution under the guise of a legitimate application.
Detects the loading of a known malicious 7z.dll file within the 'Traiolx Custom Utils' directory. This behavior is indicative of DLL sideloading used by LegionLoader to achieve code execution under the guise of a legitimate application.
Detects the presence of a suspicious or known malicious 'Normaliz.dll' file located within the 'Traiolx Custom Utils' directory, indicative of a DLL sideloading attempt.
Detects instances where msiexec.exe, the Windows Installer utility, spawns cmd.exe to execute a batch file named 'xupdate.bat' located within the 'AppData\Roaming\Traiolx Custom Utils\' directory. This behavior is indicative of malicious persistence or execution mechanisms, often associated with loaders like LegionLoader that leverage installer binaries for evasion.
Detects the creation of temporary files with names starting with 'MSI' and ending in '.tmp' within the system's temporary directory. Legitimate installations typically perform these actions via the 'msiexec.exe' process; therefore, files created by other processes may indicate suspicious payload staging or activity by malware attempting to masquerade as MSI installer components.
Detects the creation of files with the .ent extension within the Microsoft Internet Explorer directory. This behavior is associated with the NarwhalRAT malware, which uses this specific file extension and location to store AES-encrypted configuration files, likely for persistence or subsequent execution by the malware.
Detects the execution of 'userscreen.exe' (a renamed pythonw.exe used by NarwhalRAT) loading 'user32.dll'. This behavior is associated with the use of ctypes in Python to perform window enumeration via EnumWindows, specifically used by the malware to identify and monitor KakaoTalk application windows.
Detects the creation of a local user account and its subsequent addition to the local Administrators group via PowerShell cmdlets (New-LocalUser, Add-LocalGroupMember) triggered by the ConfigurationRemotingServer.exe process. This activity is indicative of abuse of the WinGet Desired State Configuration (DSC) 'Script' resource to establish persistent administrative access.
Detects the execution of the Python interpreter (pythonw.exe) renamed to 'codeflush.exe' residing in non-standard paths like '\Public\Music\MusicLibrariesPackage\'. This behavior is characteristic of adversaries attempting to camouflage malicious Python scripts or binaries as legitimate files to evade detection.
Detects execution of cmd.exe with suspicious command-line patterns utilizing environment variable substring expansion (%VAR:~offset,length%). This technique is used to dynamically reconstruct and execute obfuscated commands, a method historically observed in APT37 delivery chains to hide malicious payloads and bypass simple string-based signatures.
Detects processes associated with the WinGet/DSC configuration engine (ConfigurationRemotingServer.exe, WindowsPackageManagerServer.exe, or winget.exe) initiating processes with the COR_PROFILER or COR_ENABLE_PROFILING environment variables. This behavior is indicative of leveraging .NET profiler hijacking via the DSC 'Environment' resource for persistence or privilege escalation.
Detects the execution of WinGet DSC backend services, ConfigurationRemotingServer.exe or WindowsPackageManagerServer.exe, when launched as child processes of WinGet or DSCourier. This behavior is indicative of potential proxy execution abuse where WinGet components are leveraged to execute arbitrary code or configurations via signed Microsoft binaries.
This rule detects malicious .lnk files typically delivered as email attachments (spearphishing). It identifies shortcuts that execute cmd.exe with the /k switch, combined with environment variable substring expansion techniques designed to obfuscate multi-stage command execution chains.
Detects suspicious process command lines that access sensitive cryptocurrency wallet data files or registry keys associated with wallet applications, which is a common behavior of information-stealing malware.
This rule detects instances where the Faronics Deploy Agent process initiates the installation or download of ScreenConnect remote access software via PowerShell or the Windows Installer (msiexec.exe). This pattern is often indicative of authorized RMM deployment, but it is also a common tactic for adversaries to establish persistent remote access to endpoints.
This rule detects instances where the Faronics Deploy Agent process initiates the installation or download of ScreenConnect remote access software via PowerShell or the Windows Installer (msiexec.exe). This pattern is often indicative of authorized RMM deployment, but it is also a common tactic for adversaries to establish persistent remote access to endpoints.
The following analytic identifies the `finger.exe` utility being spawned with a command line containing an `@` character, indicating a remote host/server was specified.
The Finger protocol utility is largely obsolete in modern environments and has been abused by adversaries as a living-off-the-land binary (LOLBIN) to retrieve encoded payloads or establish covert command-and-control communication with an attacker-controlled finger server.
This behavior is uncommon in legitimate enterprise usage and warrants investigation.
The Finger protocol utility is largely obsolete in modern environments and has been abused by adversaries as a living-off-the-land binary (LOLBIN) to retrieve encoded payloads or establish covert command-and-control communication with an attacker-controlled finger server.
This behavior is uncommon in legitimate enterprise usage and warrants investigation.
This rule detects a sequence of suspicious activities indicative of malicious driver installation. It identifies the creation of an irregularly named .sys file in temp directories, the use of curl.exe to retrieve symbols for a potentially malicious driver, and the subsequent registration/start of that driver as a Windows system service.
This rule detects a sequence of suspicious activities indicative of malicious driver installation. It identifies the creation of an irregularly named .sys file in temp directories, the use of curl.exe to retrieve symbols for a potentially malicious driver, and the subsequent registration/start of that driver as a Windows system service.
Page 50 of 465