Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,695 detections
Filters
Last updated
All Time
Detection languages
547
535
293
77
61
Contributors
401
223
219
189
154
Categories
727
561
461
367
323
Platforms
1,477
157
136
87
8
Products / Services
335
331
222
196
56
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,695
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects suspicious PowerShell command lines that utilize Base64 encoded commands combined with memory-execution primitives such as Invoke-Expression (IEX) or DownloadString. The rule specifically flags commands longer than 100 characters to reduce noise from short administrative tasks.
Detects execution of the macOS.Gaslight Rust-based implant. The rule identifies the specific malicious binary by its SHA-256 hash and targets its behavior of using runtime dynamic symbol resolution (via dlsym) to hide API calls from static analysis.
Detects HTTP responses that utilize JavaScript Web Crypto API (subtle.importKey, subtle.decrypt) or AES-GCM encryption in conjunction with data decoding functions (atob, Uint8Array.from). This behavior is characteristic of malicious landing pages, such as those used by ErrTraffic ClickFix and EvilTokens campaigns, which encrypt payloads to evade static analysis by security tools.
Detects execution of PowerShell scripts associated with ErrTraffic (ClickFix) campaigns. The rule identifies malicious patterns, including the use of hex-encoded XOR operations, specific browser update comment markers, and the dynamic creation of ScriptBlocks to facilitate payload execution.
Detects the creation of a .ps1 script in the Windows AppData\Local\Temp directory followed by the execution of that script via PowerShell using hidden window flags (-WindowStyle Hidden) and policy bypass options (-ExecutionPolicy Bypass). This pattern is commonly associated with persistence mechanisms used by steganographic loaders to execute obfuscated payloads.
Detects malicious Python or JavaScript package archives (such as those used in dependency confusion attacks) that contain obfuscated code execution logic (base64 encoded commands) within package installation hooks (setup.py), or those embedding suspicious binary executables (PE/ELF headers) within the package structure.
Detects HTTP response bodies containing specific strings associated with the 'Montana Empire' phishing kit. This rule monitors for indicators that a web server is serving a phishing credential harvesting page.
This rule detects potential Bluekit malware activity by identifying specific CSS filter function combinations (saturate, hue-rotate, brightness, and contrast) within HTTP header data. These functions are used by Bluekit to generate unique pixel hashes for page loads, intended to bypass screenshot-based detection. The rule also flags instances where these headers co-occur with content-length and javascript identifiers.
This rule detects potentially malicious web content by identifying the use of randomized or specific combinations of CSS filters (saturate, hue-rotate, brightness, contrast) within HTML responses. These techniques are often used by attackers to obfuscate malicious content, such as phishing pages, from automated scanners and security filters. The rule also incorporates a check for unusually large JavaScript bundle sizes, which may indicate the presence of injected malicious scripts.
Detects STOCKSTAY .NET backdoor components (e.g., STOCKMARKET, STOCKTRADER) accessing their encrypted 'fonts' configuration files located in the local application data SMN directory. These components use environmental keying (hostname or domain-based) to decrypt the configuration, a technique designed to thwart analysis.
Detects various post-exploitation activities associated with the Amadey loader, including the execution of its persistence mechanism (nudwee.exe), dropping and executing secondary payloads in temporary directories, using PowerShell download cradles, creating scheduled tasks for persistence, and silent MSI installations. This rule aims to identify the delivery of secondary payloads like StealC and Lumma Stealer.
Detects the deployment of SharkLoader components into suspicious directories (%APPDATA%\xwreg, %APPDATA%\xgdf, or %ProgramData%\KasperskyLab) followed by the execution of SystemSettings.exe from these locations. This rule also tracks the loading of encrypted DLL payloads like DscCoreR.mui or SyncRes.dat by these processes, which is indicative of a DLL sideloading execution chain.
Detects the suspicious installation and execution of a Python runtime from within a disguised directory (%LOCALAPPDATA%\Programs\Python\Python3127). This behavior is characteristic of an infostealer campaign that leverages Node.js to download archive files (python.zip, python.7z) and archiving tools (7zr.exe) to bootstrap a Python-based malicious payload.
Detects the creation of hidden, dot-prefixed staging directories in /tmp/ or /var/tmp/ commonly associated with the 'lambsys' cryptominer dropper. The rule monitors for the creation of a hidden directory, multiple subsequent file drops (binaries or scripts), execution of chmod +x on these files, and final execution of the binary. A lower-severity alert is triggered when a non-interactive web server process creates such a directory.
Detects execution of PowerShell commands associated with the Gamaredon Group's Ptero malware family. This rule monitors for suspicious PowerShell command lines (including encoded commands and common obfuscation patterns) originating from Office applications or temporary directories, correlated with network connections to known Gamaredon C2 domains or registry modifications to Run keys for persistence.
Detects the macOS script reading a downloaded text file, decoding the Base64 contents, and piping it to execution.
This rule detects potentially malicious PowerShell execution by identifying the use of obfuscated encoded commands or common execution policy bypass flags. It monitors for patterns such as '-EncodedCommand' with long strings, '-ExecutionPolicy Bypass', and other flags typically used to hide PowerShell execution or bypass security restrictions, while excluding trusted Microsoft-signed processes and commands executed from standard system paths.
This rule detects potentially malicious PowerShell execution by identifying the use of obfuscated encoded commands or common execution policy bypass flags. It monitors for patterns such as '-EncodedCommand' with long strings, '-ExecutionPolicy Bypass', and other flags typically used to hide PowerShell execution or bypass security restrictions, while excluding trusted Microsoft-signed processes and commands executed from standard system paths.
Detects the Prinz Eugen ransomware operator leveraging RemotePC's RPCCMDHOST.EXE to spawn PowerShell with hidden window, no profile, and non-interactive flags, consistent with obfuscated stager execution observed in active intrusions.
Detects PowerShell script used to extract hidden payloads from BMP image files via RGB pixel channel parsing, as observed in multi-stage Remcos RAT loader campaign. This technique is often used to conceal malicious code within seemingly innocuous image files.
Detects `cmd.exe` starting PowerShell with hidden-window, bypass execution policy, and encoded-content options, which is a common technique used by malware like Banana RAT to evade detection and execute malicious scripts. The rule specifically looks for PowerShell or pwsh.exe being launched with command-line arguments indicating hidden windows, execution policy bypass, or encoded commands, with `cmd.exe` as the parent process.
Page 44 of 81