Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,695 detections
Filters
Last updated
All Time
Detection languages
547
535
293
77
61
Contributors
401
223
219
189
154
Categories
727
561
461
367
323
Platforms
1,477
157
136
87
8
Products / Services
335
331
222
196
56
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,695
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
Detects the suspicious use of the legitimate Windows utility CertUtil.exe for downloading files from remote URLs or for encoding/decoding files. These actions are common techniques used by adversaries to bypass security controls, download malicious payloads, or obfuscate staging files.
Detects the suspicious use of the legitimate Windows utility CertUtil.exe for downloading files from remote URLs or for encoding/decoding files. These actions are common techniques used by adversaries to bypass security controls, download malicious payloads, or obfuscate staging files.
Detects rapid staging of multiple files (3+ within 1 minute) with varying executable and script extensions (.dll, .bat, .dat, .exe, .pyd) in a non-standard subdirectory under AppData\Roaming. This behavior is characteristic of LegionLoader and Traiolx Custom Utils payload staging activities. The rule excludes common system processes to minimize noise.
This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.
This rule targets suspicious process launches where an executable, specifically a `.exe` file, is executed from a temporary directory (e.g., `temp` or `appdata\local\temp`). The detection is further refined by looking for a command line pattern where the executable is followed by a numeric argument (1 to 10 digits) and then a long Base64-like string (at least 40 characters long, optionally padded with '=='). This pattern is often observed in malware that uses temporary files and obfuscated command-line parameters for execution.
Detects the execution of BeepRAT, a RAT derived from DcRAT, which utilizes heavy obfuscation of class names and Base64-encoded strings that are decoded at runtime. The rule monitors command-line arguments for specific obfuscated identifier patterns and encoded strings associated with the malware's operation, while excluding files located in standard Windows or Program Files directories.
Detects the use of the Tiny C Compiler (TCC) to compile or execute shellcode associated with BeepRAT malware. The rule monitors for characteristic TCC command line arguments ('-nostdlib', '-run') and specific file names ('temp.bin', 'config.ini.c') within the TCC deployment path that are indicative of staging and executing malicious code while attempting to bypass defensive mechanisms like AMSI, ETW, and WLDP.
Detects suspicious PowerShell command lines that utilize Base64 encoded commands combined with memory-execution primitives such as Invoke-Expression (IEX) or DownloadString. The rule specifically flags commands longer than 100 characters to reduce noise from short administrative tasks.
Detects execution of InvisibleFerret backdoor logic as a Shared Object on macOS.
EchoCreep Decodes AES-CBC Base64 Command
Cortex XDR
Detects a non-browser process combining base64 decoding with AES-CBC processing before launching shell commands. This behavior is indicative of the EchoCreep malware, which uses sophisticated obfuscation techniques to hide its command and control communications.
Detects PowerShell IEX download cradle used for fileless execution
Detects inbound emails carrying an attachment whose filename matches the voicemail lure pattern (v-mail_*mp3.eml) but whose declared MIME type is application/html — a content-type mismatch used in Scotiabank-impersonation TOAD callback phishing campaigns to bypass gateway filters.
Detects process command lines containing keywords associated with resource extraction, decryption, or decompression, specifically when initiated by 'GST*.com' or involving 'Optimax.dll'. This behavior is indicative of a Remcos RAT loader attempting to unpack or prepare its payload.
Detects Node.js or JavaScript runtimes executing code patterns commonly associated with GlassWorm-style supply chain attacks. The campaign abuses invisible Unicode variation selectors to hide malicious payloads that are decoded and executed through eval(). Investigate execution originating from repositories, package managers, VS Code extensions, or temporary development directories.
This rule detects sophisticated PowerShell activity involving reflective code loading and suspicious process interaction. It identifies three distinct patterns: malicious script execution using Invoke-Expression (IEX) on files within ProgramData, PowerShell script blocks utilizing low-level NT APIs (such as NtAllocateVirtualMemory and NtCreateThreadEx) often associated with reflective injection, and suspicious cross-process remote thread creation by PowerShell processes.
Detects obfuscated PowerShell command lines executing code from a staging file located at C:\ProgramData\WC3. The rule targets execution patterns where Get-Content is used in conjunction with Invoke-Expression (IEX) to reflectively load a PE file, leveraging native NT API resolution via Microsoft.Win32.UnsafeNativeMethods, consistent with activity attributed to the UAC-0226 GIFTEDCROOK campaign.
Detects delayed environment variable expansion (/v:on) used to dynamically split and reconstruct the powershell string to evade command line monitoring. This technique is often used by malware like InstallFix.
Detects instances where PowerShell or cmd.exe drops an executable file (or extensionless file) into the C:\ProgramData directory, followed by the execution of that same file within a 2-minute window. This behavior is associated with the UAC-0226 campaign (GIFTEDCROOK loader chain) for staging malicious payloads.
This rule detects potentially malicious PowerShell activity involving memory injection techniques (e.g., NtAllocateVirtualMemory, NtWriteVirtualMemory, NtCreateThreadEx) occurring in conjunction with outbound network connections within a 5-minute window, which is indicative of command-and-control behavior.
Detects PowerShell scripts attempting to perform memory injection by utilizing native Windows API calls (e.g., NtAllocateVirtualMemory, NtProtectVirtualMemory, NtCreateThreadEx) alongside memory manipulation patterns such as byte manipulation and the use of System.Runtime.InteropServices.Marshal.
Detects Python processes executing complex, multi-layered decoding chains (Base64, ROT13, and Hex) in their command line arguments. This pattern is often used by malicious AI skill backdoors, such as ClawHub, to obfuscate payload execution and evade signature-based detection.
Page 49 of 81