Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
4,009 detections
Filters
Last updated
All Time
Detection languages
1,931
723
350
236
231
Contributors
1,122
652
408
328
198
Categories
20,453
11,838
5,876
5,154
4,865
4,009
Platforms
3,584
661
528
41
33
Products / Services
1,156
900
583
581
225
MITRE Techniques
3,297
1,718
1,465
731
551
CVEs
10
5
5
4
4
IDS Classtypes
19
3
2
1
1
IDS Protocols
16
5
2
1
1
Detects install-time execution context consistent with the Axios npm supply chain compromise. This rule looks for 'node setup.js' launched from within 'node_modules/plain-crypto-js' or related npm install working directories, or for npm install commands involving 'axios' or 'plain-crypto-js'.
This rule detects the execution of PowerShell commands that utilize .NET's System.Drawing.Bitmap class and the .GetPixel method. This combination is indicative of steganography techniques being used to extract hidden data, often malicious payloads, from image files. This specific pattern has been associated with APT29.
Detects suspicious process execution chains involving 'regsvr32.exe' followed by 'mshta.exe', 'powershell.exe', or 'rundll32.exe', especially when 'regsvr32.exe' is launched from common user download or application data directories. This pattern is often indicative of malware execution or living-off-the-land techniques.
Detects the execution of AppleScript with the presence of 'character id' in loops. This pattern is often used by malware to hide malicious AppleScript code.
Detects the execution of a curl command downloading a shell script (.sh) directly into the /var/tmp/ directory. This technique is actively used in ClickFix social engineering campaigns, such as "Contagious Interview," where attackers manipulate developers into pasting malicious commands into the macOS Terminal to bypass Gatekeeper protections.
Detects early-stage collection and reconnaissance activities targeting sensitive email data prior to exfiltration via Exchange cmdlets. This rule identifies the use of 'New-MailboxSearch' and 'Get-Recipient' cmdlets, which can be leveraged by adversaries to discover and collect email-related information. Detection covers both endpoint PowerShell execution and cloud audit logs for Microsoft Exchange Online.
Detects cmd.exe executing a batch script disguised with a .txt extension, a persistence technique used by SERPENTINE#CLOUD. The campaign delivers VenomRAT, AsyncRAT, XWorm/Violet, PureHVNC, and Brute Ratel C4 via ClickFix lures and Cloudflare tunnels.
Medusa Ransomware Script Execution
Detects execution of a base64 decoded payload piped directly into the zsh shell. This technique is highly indicative of ClickFix social engineering campaigns, where users are manipulated into copying and pasting malicious one-liners into their macOS terminal to bypass Gatekeeper and execute malware such as AMOS.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
Detects the creation of hidden temporary workflow files (e.g., .prt_tmp_<nonce>.yml) indicative of the prt-scan supply chain campaign's DISPATCH phase used to capture secret values. This rule specifically looks for newly written script files with a filename matching the pattern /.github/workflows/.prt_tmp_[a-f0-9]+\.yml$/i.
Detects the execution of malicious artifacts associated with the Sapphire Sleet (UNC1069) Axios npm supply chain attack, including the initial plain-crypto-js setup, specific curl commands posting to C2, and OS-specific second-stage payload executions.
This rule detects a potential software supply chain compromise by correlating `npm install`, `npm ci`, or `npm update` activity with the subsequent execution of a `node setup.js` script on the same device within a 30-minute window. It specifically looks for `setup.js` execution or processes running from the `/node_modules/plain-crypto-js` directory, which is indicative of the Axios npm supply chain compromise.
Detects PowerShell execution that interacts with GitHub API or raw content endpoints and includes a GitHub Personal Access Token (PAT) in the command line. This combination can indicate malicious activity such as data exfiltration, code deployment, or C2 communication, especially if originating from an unexpected host or user.
Detects the creation of specific VBScript or PowerShell dropper files (6202033.vbs, 6202033.ps1) within temporary directories. This activity is indicative of malware attempting to establish a foothold or execute malicious code.
Detects suspicious network connections to 'sfrclak.com' on port 8000 or command-line activity involving 'curl' targeting 'packages.npm.org' on port 8000, potentially indicating malicious activity such as malware download or command and control communication. The rule specifically looks for various command-line patterns including 'cmd.exe' with PowerShell scripts, 'python' scripts, or 'com.apple.act.mond' related commands.
Just reading about a fake Boeing RFQ was enough to trigger a full attack chain — starting from a DOCX and moving through RTF, JavaScript, PowerShell and even a full Python runtime, ending with Cobalt Strike running in memory.
Nothing particularly new in terms of techniques, but the way everything is chained together makes it effective and easy to miss. It relies on tools and formats we see daily.
Being focus on catch the IoA Pattern, I created the KQL Detection below. PowerShell disabling TLS validation before downloading the payload, it’s a small step, but a very useful one from a detection point of view.
Nothing particularly new in terms of techniques, but the way everything is chained together makes it effective and easy to miss. It relies on tools and formats we see daily.
Being focus on catch the IoA Pattern, I created the KQL Detection below. PowerShell disabling TLS validation before downloading the payload, it’s a small step, but a very useful one from a detection point of view.
This rule detects the execution of hidden shell scripts within the `/tmp/` directory on Linux systems, specifically looking for `nohup` commands that launch a shell (`sh` or `bash`) to execute a hidden `.sh` file (e.g., `.eba9ee1e4.sh`). This behavior is indicative of the UAT-10608 / React2Shell threat, often associated with credential harvesting operations.
Detects suspicious process execution originating from npm postinstall scripts, which can indicate a supply chain compromise. Specifically, this rule looks for npm, node, or npm.cmd processes with 'postinstall' or 'plain-crypto-js' in their command line, spawning suspicious executables like curl, wget, python, bash, sh, cmd, powershell, or wt, or connecting to known malicious domains/IPs or specific file names associated with the 'plain-crypto-js' RAT dropper.
Detects wscript.exe or cscript.exe spawning cmd.exe to decompress a specific archive using the built-in Windows tar utility. This staging behavior is used by the PyLangGhost VBScript loader to unpack required library files before executing the RAT payload associated with NICKEL ALLEY campaigns.
Detects the execution of PowerShell commands using the Remove-Item cmdlet to explicitly target and delete the :Zone.Identifier Alternate Data Stream (ADS). This technique is commonly used by adversaries to evade Mark-of-the-Web (MOTW) detection and make downloaded malicious files appear less suspicious.
Page 146 of 191