Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,581 detections
Filters
Last updated
All Time
Detection languages
729
235
193
112
98
Contributors
323
311
275
169
73
Categories
20,456
11,839
5,876
5,155
4,865
1,581
Platforms
1,042
289
181
159
111
Products / Services
497
264
238
141
128
MITRE Techniques
852
757
502
416
312
CVEs
5
3
3
3
2
IDS Classtypes
211
4
3
3
2
IDS Protocols
219
7
3
1
1
Detects the execution of the RUSTYSHADE Rust-based backdoor, observed during Operation RapidRust, associated with the threat group APT36 (Transparent Tribe). The rule monitors for the specific 'DriverInstaller.exe' filename, known malicious file hashes, and suspicious command-line patterns involving PowerShell-based downloads of 'DriverInstaller.zip' from Backblaze cloud storage.
Detects the execution of PowerShell with hidden window style attempting to download Node.js related files (e.g., .msi or node.exe) from nodejs.org using common download cmdlets or utilities.
Detects the execution of AnyDesk or its installation from common user-writable directories (Downloads or AppData), as well as scenarios where a browser (msedge.exe) initiates an AnyDesk-related download. This is a common indicator of unauthorized remote access tool deployment.
Detects the use of bitsadmin.exe to create or modify Background Intelligent Transfer Service (BITS) jobs, specifically when combined with the /setnotifycmdline flag. This technique is used by adversaries to download malicious payloads and trigger their execution upon job completion, often bypassing network security controls that might otherwise flag traditional download-and-execute activity.
Detects the use of bitsadmin.exe to initiate file transfers from remote URLs to sensitive or writable system directories, or the use of /SetNotifyCmdLine to define a command to execute upon job completion. These techniques are often used by adversaries to download payloads or establish persistence via BITS jobs.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
Detects AI agent tooling (e.g., Copilot, Cursor, Ollama) that makes outbound network calls to known AI model providers followed by the execution of suspicious shell commands within a short duration. The rule flags high-severity activities such as download-cradles, credential reconnaissance, LOLBin usage, and persistence mechanisms. Informational alerts are generated for standard CLI activity within the same timeframe.
Detects HTTP responses containing a file named 'ClaudeDesktop.exe' served from paths containing '/artifacts/' on the 'claude.ai' host where the request referrer is not 'claude.ai' or 'anthropic.com', suggesting a malvertising or supply chain delivery attempt of a malicious installer.
Detects network, HTTP, and DNS activity associated with the known three-tier delivery infrastructure (phishing sites, relay/dispatcher servers, and payload hosts) used by the threat actor UNC6671/SilverFox/Aurora. The rule distinguishes between high-confidence confirmed connections and low-confidence DNS-only events.
This rule monitors network connections, file events, and process execution command lines for references to a list of known malicious URLs, including indicators associated with ClearFake, IClickFix, AMOS, Remus, and Mozi botnet payloads.
This rule detects malicious PowerShell execution originating from common Office or script-based parent processes (explorer.exe, mshta.exe, wscript.exe). The detection specifically looks for hidden command-line flags combined with indicators related to the Konni/VelvetCake campaign, such as specific artifact filenames (update1.vbs, update2.ps1) or remote downloads from raw.githubusercontent.com.
Detects usage of msiexec.exe to execute an MSI package from a remote URL. This technique is often used to download and execute malicious installers directly from the internet, bypassing local file storage.
Detects the use of PowerShell to download a file named Document.pdf using Invoke-WebRequest, saving it to disk, and immediately executing it using Start-Process. This behavior is indicative of a dropper or secondary stage payload execution pattern.
This rule correlates web clicks on Google Sites URLs containing keywords related to GlobalProtect with the subsequent creation or renaming of an unsigned or improperly signed GlobalProtect.msi file on the same endpoint within a 30-minute window. This behavior is indicative of a spearphishing attempt using a masqueraded landing page to deliver malicious or unauthorized software.
Detects network activity related to the SectopRAT malware downloading a secondary module named 'WbElevation.dll' from a known command and control (C2) server. This module is typically associated with browser credential theft functionality.
Detects network activity related to the SectopRAT malware downloading a secondary module named 'WbElevation.dll' from a known command and control (C2) server. This module is typically associated with browser credential theft functionality.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects HTTP GET requests to external services 'trycloudflare.com' or 'workers.dev' that return a file content starting with the 'MZ' and 'PE' header signatures within the first 256 bytes, indicating a Windows executable payload download often associated with AvisLoader activity.
Detects outbound HTTP requests to identified scam infrastructure (e.g., herokuapp domains) containing platform-specific query parameters (win or mac). This behavior is indicative of a user interacting with a malicious site that is delivering an OS-tailored locker or malware payload.
Detects endpoint network connections to Heroku-hosted domains containing Google Ads tracking parameters (gclid, gad_source, gad_campaignid). This activity is associated with the initial staging phase of 'ShopEase' style malware delivery chains, where users are directed to decoy pages that prepare the environment for subsequent malicious browser-based actions.
Page 18 of 76