Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,443
11,831
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Detects creation of hero proxyware files in SysWOW64 directory.
This rule detects file and network indicators of compromise (IOCs) associated with the fake 'ClawdBot Agent' VS Code extension malware campaign. It looks for known malicious file hashes and network connections to C2 infrastructure, including specific C2 checks for ScreenConnect relay on port 8041.
Detects process, network, and file events associated with the fake 'ClawdBot Agent' VS Code extension. This malware drops weaponized ScreenConnect (Code.exe) and a Rust-based DWrite.dll loader. The rule covers Lightshot staging paths, relay C2 (bulletmailer.net:8041), extension C2 domains (getintwopc.site, clawdbot.getintwopc, darkgptprivate.com), and known payload hashes.
Malware often hides its payload in folders that look legitimate. In this case, it uses a path that sounds like an Intel driver folder, but it is fake. A real Intel installer would use a different, standard path. What makes this suspicious is that the file is created by a script, such as PowerShell or a batch file, not by an installer. Normal software installs show a setup wizard and write to known locations. Here, a script writes a file with an unusual name to a folder that mimics a trusted vendor. Security teams should treat any file created in this path by a script as highly suspicious. This rule helps catch that behaviour early in the attack.
This rule detects the presence or execution of known malicious file hashes associated with the ClawdBot campaign. It monitors file creation/modification events, process creation events, and module/image load events across devices for specific SHA256 hashes. The identified hashes correspond to components like 'Code.exe', 'zoomupdate.msi', 'DWrite.dll', 'extension.js', and 'run.bat', which are known to be part of the ClawdBot malware.
This rule detects the creation of script files (batch, VBS, JS, PowerShell, or shortcut files) within Windows Startup folders. It monitors both user-specific and all-users startup locations. The primary purpose is to identify persistence mechanisms where an attacker or malicious software places a script to execute automatically when the system or user logs on.
Detects file activity under Chrome Extensions folder where the extension ID matches a known malicious ID list pulled from a GitHub markdown feed. Flags devices that may have installed or loaded malicious browser extensions.
Malware sometimes creates files with names that look like system files. In this attack, it creates a file with a name that sounds like a Windows DLL. But the file is not a real DLL. It is a text file that holds hidden, encoded data. The malware uses it to pass data between stages of the attack. A script creates this file, not a normal program install. It appears in temp or ProgramData folders, which are common places for malware to hide. Real DLLs are usually installed by installers in specific system folders. Security teams should treat this exact filename being created by a script as highly suspicious. This rule helps catch that behaviour before the next stage runs.
Detects the creation of specific files in AppData paths associated with the second and third infection chains of the Notepad++ supply chain attack. These files are related to Lua script execution and DLL sideloading for persistence and execution.
When a user opens a fake document in this attack, the document runs a script in the background. That script creates a batch file in a hidden temp folder. The folder structure is unusual: a temp folder inside another temp folder. The batch file has a random-looking name. Normal programs rarely create batch files in this way. Legitimate installers might use temp folders, but they do not typically create nested temp paths with batch files. The script that creates this file is started by the document, not by the user. Security teams should look for batch files being written to this specific path by a script process. This rule helps catch that staging step before the malware runs.
Detects modification of core OpenClaw AI agent behavioral files (SOUL.md, AGENTS.md). Threat actors have been observed using malicious 'skills' to append instructions to these files, creating a 'cognitive rootkit' that persistently alters the agent's behavior.
Detects the creation or modification of a `.vscode/tasks.json` file that is configured to automatically run a task when a folder is opened.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Adversaries can abuse this feature in VS Code and GitHub Codespaces to achieve remote code execution by tricking a user into opening a malicious repository or pull request.
Detects a process reading a .env file, which often contains sensitive credentials like API keys. This is often the first step of a data exfiltration pattern where the credentials are then sent to an attacker-controlled server. This behavior was observed in the malicious 'rankaj' OpenClaw skill. This rule should be correlated with subsequent network activity from the same process to a rare destination.
The rule detects the creation of tar archive files (including .tar, .tar.gz, .tgz, and .tar.bz2) within common user-writable directories on Windows systems. Specifically, it looks for these archive files being created in paths containing '\Downloads\', '\Temp\', '\Public\', '\Desktop\', '\AppData\Local\Temp\', or 'C:\ProgramData\'. This activity could indicate data staging for exfiltration, where an attacker collects and archives data before moving it out of the compromised system.
Detects the modification of a `.vscode/settings.json` file to include a `PROMPT_COMMAND`. This technique allows an attacker to execute arbitrary commands every time a new terminal is opened in a Linux-based VS Code environment, such as GitHub Codespaces. It can be used for persistence or to exfiltrate credentials and secrets.
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
This rule looks for the GUP.exe process (the legitimate updater) spawning unexpected child processes like cmd.exe or the known malicious AutoUpdater.exe.
This rule detects the creation of specific image files (windows.png, koala.png, or Default.png) in common application data directories (AppData\Local\ or ProgramData\). The creation event must be initiated by Microsoft Office applications (WINWORD.EXE, EXCEL.EXE) or prnfldr.dll. This activity is indicative of APT28's Phantom Net Voxel operation, which uses steganography to embed shellcode within these image files.
Detects the use of lifecycle hooks in `.devcontainer/devcontainer.json` files to execute potentially malicious commands. Adversaries can abuse hooks like `postCreateCommand` or `postStartCommand` in development environments like GitHub Codespaces to automatically run scripts upon container creation. This can be used to exfiltrate secrets, such as GitHub tokens, or establish further access.
Page 108 of 139