Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,456
11,839
5,876
5,155
4,865
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects VBScript files that exhibit characteristics of a downloader or dropper, including common Windows API usage (WScript.Shell, Shell.Application, MSXML2.XMLHTTP, ADODB.Stream), staging in the C:\Users\Public\ directory, and performing sandbox evasion via WMI InstallDate checks.
Detects the presence of ZIP archive files masquerading as 'Evernote.zip' that contain 'notepad++.exe', which is a pattern frequently observed in VBScript-based downloaders utilizing binary sideloading to execute malicious payloads.
Detects a suspicious sequence of network downloads initiated by bash, sh, or zsh using curl or wget where the command-line includes the 'force=1' parameter. This behavior is indicative of the ClickFix macOS dropper chain often associated with the Macfinger campaign, where multiple payloads (shell scripts and Mach-O binaries) are retrieved from a common C2 infrastructure.
Detects a suspicious execution chain where a command shell (cmd.exe) launched by explorer.exe uses curl.exe to download an MSI file from Azure Blob Storage, followed immediately by the installation of that MSI using msiexec.exe. This pattern is indicative of common malware delivery techniques, such as those observed with the RVTools.lnk delivery chain.
This rule detects potential smishing or malvertising attacks by monitoring network activity for the download of .apk files from non-reputable domains. It correlates these download attempts with previous browsing behavior on URLs containing specific 'fake app-store' lure patterns (e.g., promotional text like 'Nexus One' or 'Download Now' outside of official marketplaces like Google Play, APKMirror, or APKPure).
Detects the use of PowerShell to download the gitlab-runner-windows-amd64.exe binary from the official AWS S3 distribution bucket. This behavior is indicative of an attacker attempting to stage the GitLab Runner service to establish command and control or persistence within a compromised Windows environment.
Some FileFix/ClickFix chains pivot execution through the mshta.exe living-off-the-land binary immediately after the Explorer address-bar entry, before dropping the final payload.
FileFix loader chains abuse trusted code-hosting platforms like Bitbucket/GitHub to host staged payload components, exploiting domain trust to evade network detection.
Some FileFix/ClickFix chains pivot execution through the mshta.exe living-off-the-land binary immediately after the Explorer address-bar entry, before dropping the final payload.
Acronis TRU (Sept 2025) documented a FileFix campaign where a PowerShell loader downloads images from Bitbucket that conceal embedded malicious components, ultimately deploying a Go-based loader and StealC.
A FileFix sibling technique dubbed DownloadFix uses a broken/incomplete download to prompt the victim to manually execute a .cmd file via the browser's Downloads shortcut instead of the Explorer address bar.
After the initial FileFix paste-and-execute step, observed campaigns chain into a secondary download of the real payload using LOLBins or PowerShell web clients.
Detects VBScript droppers that utilize excessive 'WScript.Sleep' delays to bypass sandbox analysis, often combined with error suppression and downloader APIs to execute malicious payloads.
Detects the execution of rundll32.exe with a command line containing 'DavWWWRoot', indicating the loading of a DLL from a remote WebDAV share. This is a common technique used by attackers to execute remote malicious code while bypassing local execution policies or attempting to evade local file-based detection.
This rule detects suspicious usage of certutil.exe for file downloading or the execution of the Chisel proxy tool, specifically targeting connections or authentication towards the suspicious IP address 69.48.228.86. This behavior is indicative of C2 communication or ingress tool transfer.
Detects a multi-stage infection chain involving communication with known malicious infrastructure ('mnoskemp.beer'), staging and extraction of password-protected archives using '7za.exe' in temporary directories, installation of a spoofed OBS Studio MSI package, and subsequent DLL side-loading of malicious libraries (e.g., 'obs.dll', 'WSql-2.dll') by the 'obs64.exe' process when initiated from outside legitimate installation paths.
Detects a multi-stage infection chain involving communication with known malicious infrastructure ('mnoskemp.beer'), staging and extraction of password-protected archives using '7za.exe' in temporary directories, installation of a spoofed OBS Studio MSI package, and subsequent DLL side-loading of malicious libraries (e.g., 'obs.dll', 'WSql-2.dll') by the 'obs64.exe' process when initiated from outside legitimate installation paths.
Detects a multi-stage infection chain involving communication with known malicious infrastructure ('mnoskemp.beer'), staging and extraction of password-protected archives using '7za.exe' in temporary directories, installation of a spoofed OBS Studio MSI package, and subsequent DLL side-loading of malicious libraries (e.g., 'obs.dll', 'WSql-2.dll') by the 'obs64.exe' process when initiated from outside legitimate installation paths.
Detects suspicious execution of command-line utilities (cmd.exe, powershell.exe, conhost.exe) directly from Windows Explorer (explorer.exe), which is often indicative of fileless malware execution, downloader activity, or 'ClickFix' style social engineering attacks.
Detects suspicious execution of command-line utilities (cmd.exe, powershell.exe, conhost.exe) directly from Windows Explorer (explorer.exe), which is often indicative of fileless malware execution, downloader activity, or 'ClickFix' style social engineering attacks.
Detects suspicious execution of command-line utilities (cmd.exe, powershell.exe, conhost.exe) directly from Windows Explorer (explorer.exe), which is often indicative of fileless malware execution, downloader activity, or 'ClickFix' style social engineering attacks.
Page 17 of 76