Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,746 detections
Filters
Last updated
All Time
Detection languages
1,334
86
80
79
79
Contributors
515
305
271
90
67
Categories
20,443
11,831
5,875
5,151
4,864
1,746
Platforms
1,483
338
159
7
7
Products / Services
937
167
117
79
56
MITRE Techniques
758
441
324
250
241
CVEs
5
5
5
5
5
IDS Classtypes
1
Detects the Komari agent executing from anomalous staging directories (e.g., Public, ProgramData, Temp) and immediately initiating high-frequency external network connections. This rule correlates process creation events with network connection events to identify suspicious behavior indicative of Komari C2 activity.
Identifies the fake updater process making network connections to download heavily encrypted payload blobs (often .bin or .dat files) to evade perimeter AV. This rule specifically looks for `curl.exe`, `powershell.exe`, or `certutil.exe` being used to download files with `.bin`, `.dat`, or `.enc` extensions, initiated by a process with 'setup' or 'update' in its filename.
This rule detects a potential HTML smuggling attack where a browser (Chrome or Edge) saves a file (specifically ISO, IMG, VHD, ZIP, or RAR extensions) via a JavaScript Blob, and that same file is executed by the user via Windows Explorer within a 10-minute window. This chain of events is indicative of a phishing technique used to bypass traditional security controls.
Detects malware copying itself as RuntimeHost.exe into a localized cache directory (D3F4E2A1) while ScreenConnect.ClientService.exe is running, indicating potential cryptojacking activity.
Detects the execution of a shortcut file named 'MicrosoftUpdateSerice.lnk', which is a common misspelling of 'MicrosoftUpdateService.lnk'. This technique is often used for evasive startup persistence by adversaries, as highlighted by its use in APT28/MuddyWater campaigns.
Detects scripts or commands that directly reference 'RtlDosPathNameToNtPathName' in their command line. This function can be used by adversaries for NT path evasion, a technique to manipulate how the operating system resolves file paths, potentially leading to execution of malicious files or bypassing security controls. The detection is based on the presence of this specific function name in process command lines.
Detects if multiple different fake AI installers (e.g., DeepSeek and Kimi) are executed on the same machine, indicating a concentrated phishing delivery.
Detects an environment where 'bun' is executing both the primary ('setup.mjs') and secondary ('execution.js' or 'bw_setup.js') payloads within an hour, indicating a potential supply chain attack.
This rule detects attempts to manipulate Windows Management Instrumentation (WMI) Quality of Service (QoS) policies, specifically targeting the 'MSFT_NetQosPolicySettingData' class. This activity is indicative of the EDRChoker technique, which aims to throttle network traffic for Endpoint Detection and Response (EDR) agents to hinder their telemetry and block their functionality. The detection logic looks for WMI events or process command lines containing references to 'MSFT_NetQosPolicySettingData' along with 'ThrottleRateAction' or 'AppPathNameMatchCondition'.
This rule identifies indicators and behaviors associated with KongTuke and PS1Bot campaigns. It specifically looks for network connections to known malicious IPs, domains, and URI paths, as well as the execution or presence of files with known malicious SHA256 hashes associated with these campaigns. The original description mentions 'finger.exe abuse, scheduled task and registry persistence, dynamic C# compilation for keylogging/screen capture, and suspicious PowerShell download cradles', but the current KQL rule only covers network and file/process IOCs.
Detects the use of two or more distinct remote access products by the same user on the same device within a one-hour window. This could indicate suspicious activity, such as an attacker attempting to maintain persistence or using multiple tools for different stages of an attack, or a legitimate user having multiple remote access tools installed and running concurrently.
Detects command-line utilities such as grep, cat, sed, awk, or shell commands (bash, sh) being used to read the 'psappsrv.cfg' file and specifically searching for sensitive configuration parameters like 'Address=', 'HostName=', 'appserv', 'prcs', or 'ps_config_homes'. This activity could indicate an attacker attempting to discover system information or network configurations related to Oracle PeopleSoft.
Detects inspection of active mounts or /etc/hosts for PeopleSoft, configuration home, NFS, or environment naming patterns. This rule specifically looks for commands like 'mount', 'cat', 'grep', 'bash', or 'sh' being executed with command-line arguments that include 'mount' and PeopleSoft-related terms ('psoft', 'ps_config', 'nfs'), or '/etc/hosts' with PeopleSoft-related terms ('psoft', 'csprd', 'peoplesoft', 'psft').
Detects Python processes attempting to decrypt browser credential databases using DPAPI or CryptUnprotectData. This behavior is characteristic of malware like InvisibleFerret, which targets stored browser credentials.
Detects a custom proxy process listening for forwarding instructions and creating a second outbound connection to a supplied host and service. This rule specifically looks for network events where the process image name contains 'chainworm', 'svc', or 'proxy' (case-insensitive) and the command line arguments indicate forwarding or connection establishment activities like 'forward', 'next hop', 'bind', 'listen', 'reconnect', or 'TcpClient'.
Detects files executing with double extensions designed to trick users (e.g., .pdf.exe). This rule specifically looks for process events where the filename matches a pattern of a common document/image/archive extension followed by an executable extension.
Detects WMI activity where 'wmiprvse.exe' is used to query 'SecurityCenter2' for antivirus product information. This behavior is often associated with adversaries performing reconnaissance to identify security software.
This rule detects processes that attempt to set the 'BlockNonMicrosoftBinaries' mitigation policy using 'SetProcessMitigationPolicy'. This policy is typically used to prevent the loading of non-Microsoft signed DLLs into a process, which can be an evasion technique used by adversaries to hinder analysis or prevent injection by security products.
Detects unique INFINITERED marker strings in process command lines or event metadata. The indicators include the upgrade-code GUID delimiter, its Base64 representation, the stolen-session identifier prefix, and the custom file-download command tag. These values are specific to the reported malware and should be treated as high-confidence evidence when present.
Correlates the execution of an executable initiated by cscript.exe with the subsequent access of Chrome's 'Login Data' file, indicating an attempt at offline DPAPI decryption, potentially by the Laravel Stealer malware.
Correlates the execution of the trojanized scp binary passed with the '!' flag, an internal trigger designed to disable SELinux enforcing mode prior to payload execution. This rule specifically looks for 'scp' command-line executions containing '!' and excludes standard scp syntax that might contain '@' for user@host.
Page 61 of 84