Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,918 detections
Filters
Last updated
All Time
Detection languages
1,568
780
216
110
94
Contributors
703
507
419
236
211
Categories
20,443
11,831
5,875
5,151
4,864
2,918
Platforms
2,584
507
385
83
17
Products / Services
1,265
605
83
82
72
MITRE Techniques
841
797
582
344
307
CVEs
24
8
8
5
5
Files with well-known filenames (parts of credential dump software or files produced by them) creation
Detects the creation of a file with a suspicious extension in the public folder, which could indicate potential malicious activity.
Detects the creation of an "lsass.dmp" file by the taskmgr process. This indicates a manual dumping of the LSASS.exe process memory using Windows Task Manager.
Detects the creation of potential LANDFALL spyware delivery files. These are malformed DNG image files, often with filenames suggesting delivery via WhatsApp, used to exploit CVE-2025-21042.
Detects a suspicious Microsoft desktopimgdownldr file creation that stores a file to a suspicious location or contains a file with a suspicious extension
Detects the creation of a new office macro files on the system via an application (browser, mail client).
This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.
This can help identify potential malicious activity, such as the download of macro-enabled documents that could be used for exploitation.
CyberSecurityNews has reported a raising case about a new wave of phishing emails masquerading as breach notifications from LastPass.
To summarise, these emails claim that the recipient’s account has been compromised and urge them to download a “security patch” to restore access.
In reality, the attached file is a sophisticated malware loader built to steal credentials and deploy additional malicious payloads onto the victim’s system.
Each phishing message includes a ZIP attachment named 'LastPass_Security_Update' that contains an executable disguised as an MSI installer. When executed, the fake MSI installs a PowerShell script into the user’s AppData folder and schedules it to run via a scheduled task. The script then contacts a remote command-and-control server to download a second-stage payload capable of keylogging, taking screenshots, and moving laterally within corporate networks.
This following KQL Query is based on the IOA where the emails arrive with a .zip file attached and it content is a msi file. Using IOA instead the IOC (LastPass_Security_Update .zip) is more feasible because the malicious actors could easily change the zip name and the detection would not detect the mentioned threat.
To summarise, these emails claim that the recipient’s account has been compromised and urge them to download a “security patch” to restore access.
In reality, the attached file is a sophisticated malware loader built to steal credentials and deploy additional malicious payloads onto the victim’s system.
Each phishing message includes a ZIP attachment named 'LastPass_Security_Update' that contains an executable disguised as an MSI installer. When executed, the fake MSI installs a PowerShell script into the user’s AppData folder and schedules it to run via a scheduled task. The script then contacts a remote command-and-control server to download a second-stage payload capable of keylogging, taking screenshots, and moving laterally within corporate networks.
This following KQL Query is based on the IOA where the emails arrive with a .zip file attached and it content is a msi file. Using IOA instead the IOC (LastPass_Security_Update .zip) is more feasible because the malicious actors could easily change the zip name and the detection would not detect the mentioned threat.
Detects the presence of SVG files containing obfuscated JavaScript and redirection logic. This technique is used by phishing campaigns, such as Tykit, to redirect victims to malicious sites.
Detects unusual processes accessing `desktop.ini` files. Adversaries can leverage `desktop.ini` to alter how Windows Explorer displays a folder's content (e.g., renaming files or changing icons) without modifying the actual files on disk. This can be used for persistence, privilege escalation, or to hide malicious files.
Detects the creation of files named "ebpfbackdoor" within the "cron.d" and "sudoers.d" directories. This activity is associated with the TripleCross eBPF rootkit, which uses these locations for persistence.
This rule detects LNK (shortcut) files that contain embedded PowerShell commands, specifically looking for the string "powershell" and the argument "-windowstyle hidden". This combination is often used by adversaries to execute malicious PowerShell scripts discreetly, making them less visible to the user.
These rules detect encrypted ZIP files that contain only a single entry. The rules further specialize to detect if that single entry is a VBScript (.vbs) or Microsoft Management Console (.msc) file. This pattern is often used by adversaries to deliver malicious payloads, bypassing email security solutions that might not scan encrypted archives or might not recognize the malicious intent of single-entry archives containing specific script or configuration file types.
Detects the creation or modification of specific files associated with the exploitation of Windows vulnerabilities CVE-2021-31979 and CVE-2021-33771, and the deployment of DevilsTongue malware by the threat group Sourgum. The rule specifically looks for the presence of certain filenames in critical system directories.
Detects when the Code Integrity (CI) engine blocks a process from loading an unsigned DLL that resides in a suspicious location. This often indicates an attempt to bypass security controls or execute malicious code through DLL hijacking or side-loading.
Detects a phishing attack which expands a ZIP file containing a malicious shortcut. If the victim expands the ZIP file via the explorer process, then the explorer process expands the malicious ZIP file and drops a malicious shortcut redirected to a backdoor into the Startup folder. Additionally, the file name of the malicious shortcut in Startup folder contains {0AFACED1-E828-11D1-9187-B532F1E9575D} meaning the folder shortcut operation.
This rule detects file write operations performed by 'scrcons.exe' (WMI Scripting Host). This activity is indicative of WMI persistence mechanisms, specifically the creation or modification of WMI script event consumers. Adversaries often use WMI event subscriptions to establish persistence and execute arbitrary code when a defined event occurs, such as system startup or user logon. The detection focuses on the 'Image' field, looking for the specific WMI scripting host executable.
Detects the creation of doas.conf file in linux host platform.
The following KQL query focuses on detecting cases where files are created, modified, or otherwise accessed via RDP from another computer. Its main objective is to verify whether, during an RDP session, the connection has mapped a local disk or other redirected device — allowing us to easily identify potential cases of data exfiltration through RDP file transfer
This rule detects attempts to write files to the local administrative share (ADMIN$) on a Windows system, specifically when the target is the local machine (127.0.0.0/8 IP range). Adversaries often use administrative shares for lateral movement, persistence, or to stage tools and data during post-exploitation activities. The detection logic looks for file events where the target filename contains both a local loopback IP address (e.g., \\127.0.0.1) and the administrative share name 'ADMIN$'.
Detects known malicious file hashes associated with malware families (VIDAR, LUMMAC.V2, RADTHIEF, ATOMIC) distributed by the threat actor UNC5142.
Detects the modification of common WordPress PHP files to include content characteristic of the UNC5142 CLEARSHORT infection chain. This activity is indicative of a compromised web server. This rule requires a File Integrity Monitoring (FIM) solution or EDR that can inspect the contents of modified files.
Page 112 of 139