Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
9,764 detections
Filters
Last updated
All Time
Detection languages
3,724
2,041
1,335
1,055
969
Contributors
2,963
2,050
1,372
1,231
485
Categories
5,723
3,080
1,138
901
659
Platforms
9,650
659
432
53
30
Products / Services
10,704
9,764
6,706
4,421
3,752
MITRE Techniques
3,828
3,377
1,982
1,618
1,042
CVEs
18
14
12
12
11
Detects unauthorized access to critical browser files such as cookies, login data, and local state files. These files contain sensitive information such as authentication cookies and stored credentials, which are primary targets for infostealer malware.
Detects the use of PowerShell commands that reflectively load assemblies into memory, often associated with obfuscated or encoded payloads typically used in fileless malware execution and post-exploitation activity.
Detects the execution of an LNK file that initiates a command chain resulting in an encoded PowerShell script. This behavior is indicative of malicious shortcut files often used in initial access to trigger multi-stage payloads, consistent with techniques observed in Kimsuky-linked infection chains.
Detects the execution of a .lnk file that directly triggers a PowerShell process. This behavior is frequently associated with malicious shortcut files used in initial access and execution, such as those observed in Kimsuky (APT-C-55) infection chains where disguised installers drop LNK files that execute PowerShell scripts for anti-analysis and subsequent payload deployment.
Detects execution of PowerShell spawned by suspicious processes (e.g., installers or Windows Explorer) involving LNK file patterns or suspicious command-line obfuscation techniques commonly associated with Kimsuky (APT-C-55) activity.
Detects the ScreenConnect remote access binary spawning suspicious child processes often associated with lateral movement, system reconnaissance, or anti-forensics activity (such as deleting shadow copies, modifying boot configuration, or using administrative tools for remote command execution). This behavior is highly indicative of an adversary abusing legitimate RMM software to execute post-exploitation commands.
Detects the execution of 'SimpleService.exe' when the binary is located within a restricted subdirectory associated with JWrapper-Remote Access. This pattern may indicate the execution of unauthorized or restricted remote access tools.
Detects file creation events initiated by ScreenConnect (ConnectWise Control) client processes. ScreenConnect is a legitimate remote support and RMM tool often leveraged by adversaries for remote access or as a secondary persistence mechanism. Monitoring file creation by these processes may indicate the installation of additional tools, scripts, or malware via a remote support session.
Detects the use of native Windows utilities (vssadmin, wbadmin, bcdedit, wmic) to delete volume shadow copies, backup catalogs, or disable system recovery features. This behavior is a common precursor to or component of ransomware encryption operations intended to prevent system recovery.
Detects the execution of common command-line or scripting interpreters (cmd, powershell, cscript, etc.) spawned by the ScreenConnect remote administration client. This is a common pattern used by attackers leveraging legitimate remote access tools for post-exploitation activities and lateral movement.
Detects known malicious files associated with Kimsuky (APT-C-55) Stella_Gary attack chain by MD5 hash: OrionQuests-Setup.exe installer, guide.url.lnk, test.bef_fri, and backdoor payload component
Detects known malicious files associated with Kimsuky (APT-C-55) Stella_Gary attack chain by MD5 hash: OrionQuests-Setup.exe installer, guide.url.lnk, test.bef_fri, and backdoor payload component
Detects known malicious files associated with Kimsuky (APT-C-55) Stella_Gary attack chain by MD5 hash: OrionQuests-Setup.exe installer, guide.url.lnk, test.bef_fri, and backdoor payload component
Detects the Kimsuky second-stage payload test.bef_fri which masquerades as an RTF file via a falsified RTF header before header repair and decompression
Detects the Kimsuky second-stage payload test.bef_fri which masquerades as an RTF file via a falsified RTF header before header repair and decompression
Detects the Kimsuky second-stage payload test.bef_fri which masquerades as an RTF file via a falsified RTF header before header repair and decompression
Detects the Kimsuky trojanized .NET installer OrionQuests-Setup.exe that decrypts embedded AES resource OrionSetup.payload.enc to drop a decoy OrionLauncher installer and malicious LNK file
Detects the Kimsuky trojanized .NET installer OrionQuests-Setup.exe that decrypts embedded AES resource OrionSetup.payload.enc to drop a decoy OrionLauncher installer and malicious LNK file
Detects the Kimsuky trojanized .NET installer OrionQuests-Setup.exe that decrypts embedded AES resource OrionSetup.payload.enc to drop a decoy OrionLauncher installer and malicious LNK file
Detects the creation of multiple or specific file locks that deviate from standard naming conventions, often associated with wiper malware attempting to overwrite files or fill disks by creating locking files as part of their destructive payload.
Detects the execution of processes related to the 'Toy Ghouls' bird-agent tool delivery, utilizing Evil-WinRM or WinRM-fs to execute commands remotely via the WinRM service (wsmprovhost.exe).
Page 92 of 465