Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
88 detections
Filters
Last updated
All Time
Detection languages
42
24
11
6
3
Contributors
88
Categories
20,632
11,971
5,918
5,199
4,875
Platforms
53
24
8
2
1
Products / Services
30
8
7
5
5
MITRE Techniques
64
24
19
19
13
CVEs
7
7
4
IDS Classtypes
1
1
IDS Protocols
2
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects su-privileged execution of an embedded ELF payload (libdevice.so or the disguised com.n2.systemservice package) from an application-data directory, consistent with the Kimwolf v7 Android dropper establishing persistence outside standard system binary paths.
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects the CaptiveCrunch ClickFix execution chain where a browser or Explorer process spawns a command interpreter that launches an unsigned or non-standard-vendor 'update'-named binary from a Temp/Downloads path, which then establishes a network connection (C2) within 5 minutes of process start.
Detects Apple-signed python/python3 or osascript referencing the same /tmp/*.js file path twice in one command line (drop-then-execute), indicating LOLBin abuse to stage and immediately re-run a JavaScript payload from a world-writable directory.
Detects python.exe binding a loopback listener on port 8000, 8001, or 8002 and then spawning cmd.exe or powershell.exe within 5 minutes of the listener being established, consistent with SNOWBASIN Python bindshell behavior observed in the UNC6692 Edgecution campaign.
Detects the Edgecution native messaging host chain where a batch wrapper (native_host.bat), spawned by msedge.exe, launches python.exe with the unbuffered output flag (-u) to run the malicious native_host.py backend used for C2 command execution.
Detects an APK file written to disk by a browser process within 15 minutes of that browser visiting a non-standard landing page, consistent with CaptiveCrunch/ClickFix Android APK delivery.
Detects PowerShell (or pwsh) processes that both download a file to a temp-like location and subsequently execute or install it within a short time window on the same host, indicative of a staged loader/dropper download-and-execute pattern.
Detects msiexec.exe launched with /qn or /quiet by powershell.exe or cmd.exe to install an MSI package from a non-standard location, consistent with SMOKE#SCREEN techniques that silently install ScreenConnect via VBScript/WMI droppers and PowerShell downloaders.
Detects a process named svchost32.exe running from a non-System32 path that spawns cmd.exe or powershell.exe with a -NoProfile/-NoP flag and subsequently makes an outbound network connection, consistent with CornFlake/ChocoShell remote shell behavior.
Detects the ClickFix pattern of a clipboard copy event followed within 5 seconds by an encoded/base64 mshta.exe or powershell.exe execution, consistent with DOUBLECUP's clipboard-hijacking lure.
Detects a correlated sequence where an unsigned cscript.exe/wscript.exe process executes a .vbs script, WMI-based hidden process creation is observed, and msiexec.exe performs a silent MSI installation, consistent with the SMOKE#SCREEN VBScript dropper chain that uses WMI to silently install a ScreenConnect MSI payload.
Detects the STAC4749 malicious vcruntime140_1.dll sideloaded via trojanized CopyQ binary, communicating with imarketads.com and launching sekv*.exe loader
Detects a browser-spawned explorer.exe chain launching powershell.exe, cmd.exe, mshta.exe, or rundll32.exe with both base64/obfuscation indicators and fake-update/support-dialog keywords in the command line, consistent with ClickFix-style social engineering.
Detects DeviceManager creating a scheduled task named MicroUpdaterV1 via schtasks.exe /Create /F from a %TEMP%\t.xml definition, followed by pythonw.exe execution, consistent with DeviceManager's persistence mechanism that re-runs every 10 minutes.
Detects fileless PowerShell execution using an encoded command line consistent with CountLoader v4.5p, corroborated by hidden-window/execution-bypass flags and excluding known legitimate deployment-tool parent processes.
Detects known CornFlake and ChocoShell malware binaries by exact full SHA-256 hash of executable files (file-write/process-creation scope), not incidental hash string mentions
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects Google Chrome launched with Chrome DevTools Protocol (CDP) remote-debugging flags on the fixed port 18907 used by XCSSET's persistence/browser-hijacking component, excluding known browser-automation tooling.
Detects CountLoader's taskType 9 USB-worming behavior: a recently created/modified .lnk file on a non-system drive followed by mshta.exe execution referencing that .lnk with a remote HTTP(S) URL.
Page 3 of 5