Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,695 detections
Filters
Last updated
All Time
Detection languages
547
535
293
77
61
Contributors
401
223
219
189
154
Categories
727
561
461
367
323
Platforms
1,477
157
136
87
8
Products / Services
335
331
222
196
56
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
1,695
CVEs
3
1
1
1
1
IDS Classtypes
26
10
7
6
2
IDS Protocols
42
11
This rule detects potentially malicious activities on Linux systems, including the download of files via curl or wget from a specific IP address, execution of scripts named 'isp.sh', usage of hidden temporary files (e.g., .xlamb), detection of processes named 'lambsys', and execution of scripts within the /var/tmp directory after a chmod +x command. These patterns are often associated with stage-1 or stage-2 dropper behaviors, malware persistence, or post-exploitation activities.
Detects the loader using base64.b85decode combined with zlib.decompress to restore the original executable payload into memory.
This rule detects a multi-stage execution pattern where a PowerShell process (PteroLoader) executes with suspicious flags (encoded or hidden commands) and subsequently launches a child process that is not part of a common list of legitimate system processes. This behavior is indicative of potential malware staging or command-and-control activity, specifically targeting unauthorized child process creation following PowerShell obfuscation.
Detects the use of certutil.exe for potentially malicious activities including file encoding/decoding and downloading files from the internet. Attackers often abuse this legitimate Windows utility to deobfuscate payloads or pull malicious files onto a target system.
Detects the use of certutil.exe for potentially malicious activities including file encoding/decoding and downloading files from the internet. Attackers often abuse this legitimate Windows utility to deobfuscate payloads or pull malicious files onto a target system.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
Detects instances where PowerShell.exe is launched by the OneDrive synchronization process, potentially indicating an attempt to mask malicious command execution as a legitimate cloud storage process.
Detects the execution of PowerShell with encoded commands originating from suspicious process paths (outside Windows or Program Files directories). The rule includes logic to identify potential sandbox evasion by correlating the PowerShell activity with subsequent tasklist.exe execution within a short window, often characteristic of malware performing environment checks.
Detects the OXLOADER malware dropping a malicious copy of dui70.dll renamed as a random .ocx file into the user's temporary directory. The rule identifies subsequent loading of this dropped file via LoadLibraryA, which is indicative of module stomping techniques where malicious code in an added .xtext section is executed within the context of a legitimate system component.
Detects instances where an email client (Outlook, Thunderbird, Edge, Chrome, Firefox) spawns `cmd.exe` with highly obfuscated command-line arguments. This behavior is characteristic of phishing delivery chains, specifically mentioning Phantom Stealer, which often uses Base64, XOR, and Donut for obfuscation. The rule looks for specific keywords and patterns indicative of obfuscated commands, such as `-enc`, `-EncodedCommand`, `FromBase64String`, `certutil`, `^^`, `!x!`, and `set /p`.
Detects various activities associated with Operation Poisson Havoc Demon, including the loading of 'senti.dll' (a shellcode carrier), PowerShell execution spawned from 'explorer.exe' (indicating potential shellcode injection), execution of 'RevS.ps1' (a PowerShell reverse shell), and the presence of other suspicious files like 'PhantomBackdoor' and 'TencShell'.
Detects the execution of certutil with certain flags that allow the utility to download files from file-sharing websites.
Detects the malware reading seemingly benign .bmp files from disk, which actually contain the steganographically encoded secondary payload. This rule specifically looks for a process accessing a .bmp file and then loading an image from the 'C:\Users\Public' folder, indicating a potential steganographic attack where a malicious payload is hidden within a benign image file.
Detects instances where common web browsers (chrome.exe, firefox.exe, etc.) spawn command shells (cmd.exe, powershell.exe) to execute suspicious commands or perform file downloads, often indicative of an initial stage of a drive-by download or malicious script execution.
Detects suspicious Python process execution that combines network socket creation with memory manipulation imports (ctypes/mmap) or shellcode-like hex byte strings in the command line. This behavior is indicative of in-memory exploit delivery or staging, often used by adversaries to execute malicious code without writing it to disk. The rule also looks for inline Python execution (-c) with similar indicators.
Detects PowerShell process executions that include the string 'bubble' in combination with string manipulation functions ('replace', 'split') or a campaign-specific function ('otidiform'). This pattern is indicative of attempts to deobfuscate PowerShell commands, often used by adversaries to hide malicious code.
Identifies string splitting techniques used in Dropping Elephant downloaders to evade static PowerShell logging. The rule specifically looks for obfuscated substrings like 'iw''r', 'g''c''i', 'r''e''n', 'c''p''i', and 'g''cm sch' within PowerShell command lines.
Detects PHP or web server processes launching interpreters with encoded, Base64-decoded, or dynamically evaluated command content. This behavior is often indicative of web shell or backdoor execution. The rule specifically looks for web server processes (e.g., php.exe, w3wp.exe, httpd, nginx) as initiating processes, which then launch command interpreters (e.g., cmd.exe, powershell.exe, bash, python) with command lines containing obfuscation techniques like -EncodedCommand, FromBase64String, base64 -d, eval(), exec(), IEX, or Invoke-Expression.
Detects the execution of base64 decoded payloads in memory by interpreted languages such as Python or Node.js. This rule specifically looks for command-line arguments indicating base64 decoding or zlib decompression operations.
Identifies instances where a browser process is spawned directly with a Base64-encoded data: URI in its command line. This technique is used to load malicious HTML content without touching the disk or network, often associated with phishing attempts.
Detects file creation and execution patterns associated with SharkLoader malware. The rule monitors for the staging of malicious DLLs, encrypted beacon payloads, and API hooks in specific AppData subdirectories ('xwreg' and 'xgdf'), as well as the execution of 'SystemSettings.exe' from non-standard locations, which mimics legitimate Windows system processes to achieve persistence and evasion.
Page 50 of 81