Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
835 detections
Filters
Last updated
All Time
Detection languages
348
219
61
54
37
Contributors
197
144
98
85
71
Categories
536
141
108
105
98
Platforms
695
78
24
23
18
Products / Services
273
188
102
61
35
MITRE Techniques
18,116
15,636
12,583
8,393
6,223
835
CVEs
4
4
1
1
1
IDS Classtypes
9
2
1
IDS Protocols
9
1
Detects the download of a file with a double extension (e.g., invoice.pdf.exe). This is a common technique used to disguise malicious files and trick users into executing them.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
This rule detects instances of 'Code.exe' (the executable for Visual Studio Code) running from non-standard or suspicious file system locations. It specifically flags processes originating from temporary directories (like \Temp or \AppData\Local\Temp), the ScreenConnect Client directory, or Program Files (x86) which are not typical installation paths for VS Code. The rule aims to identify potential masquerading or execution of malicious code disguised as VS Code.
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
Detects execution of BADAUDIO malware downloader used by APT24
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns where a .ini file extension is used to disguise an executable, which is then launched via cmd.exe.
Detects malware masquerading as the 'init' process to evade detection. This rule specifically looks for processes named 'init' that do not have an instance ID of '1' and are not located in the standard '/sbin/init' or '/usr/lib/systemd/systemd' paths. It also flags processes in suspicious temporary directories.
Detects processes that masquerade as the 'init' process, a technique used by the GoBruteforcer malware. The rule identifies processes named 'init' while filtering out legitimate system init processes based on their process ID, parent process ID, and executable path.
Detects Windows executable downloads with document or image file extensions, a common malware delivery technique
Detects processes with document file extensions spawning command shells (cmd.exe or powershell.exe), indicating malware execution
This detection aims to identify suspicious popup activity on devices by analyzing process events that launch notifications. The query focuses on detecting referrers that generate multiple unique popup URLs, which could indicate potentially malicious behavior.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
Detects cmd.exe spawning processes with document file extensions, indicating a PE binary masquerading as a document
Detects the PeerBlight Linux backdoor masquerading as the '[ksoftirqd]' kernel thread. This is a defense evasion technique used by the malware to blend in with legitimate system processes.
Detects creation of suspicious files in /var/tmp consistent with FlexibleFerret malware staging behavior on macOS systems.
Detects curl command downloading payloads to /var/tmp, indicating potential initial delivery stage of FlexibleFerret malware.
Detects Go runtime executing scripts from temporary directories, indicative of FlexibleFerret backdoor.
Detects a potential BADAUDIO DLL Sideloading persistence attempt, a technique used by APT24. The rule looks for the creation of a DLL, an executable, and a script/shortcut file (VBS, BAT, LNK) in a common user directory within a short time frame.
This detection identifies instances where critical Windows kernel files (ntoskrnl.exe, ntoskml.exe, ntoskrnl64.exe) are executed or manipulated outside of standard system directories (e.g., C:\Windows\System32, C:\Windows\WinSxS). It focuses on processes exhibiting suspicious behaviours such as code injection, driver loading, hooking, or memory mapping/unmapping, while excluding benign system processes like services.exe, trustedinstaller.exe, and dism.exe. It also filters out temporary files created by common browsers (e.g., Chrome, Edge) to reduce false positives. This activity is indicative of potential malicious kernel-level manipulation, such as unauthorised drivers, rootkits, or other advanced persistent threats attempting to bypass security controls.
Detects the execution of legitimate tools (like sshd, tor, obfs4proxy) or their renamed counterparts from user-writable directories, specifically within AppData folders. This technique is associated with Operation SkyCloak to establish persistence and covert communication channels by masquerading as legitimate software.
Detects the renaming of an existing computer account to an account name that doesn't contain a '$' symbol, which is a key indicator of the CVE-2021-42287 (SamAccountName Spoofing) attack. This technique is often used to impersonate a Domain Controller.
This rule detects the ToxicEye Remote Access Trojan (RAT) based on specific byte patterns, configuration strings, and various other strings found within the malware's executable. The rule is split into three parts: one for identifying specific instruction sequences related to configuration settings (e.g., cryptocurrency addresses, file encryption types, installation paths, autorun settings, anti-VM capabilities), another for wide character strings indicative of ToxicEye's internal messages, C2 infrastructure, and data exfiltration targets, and a third for ASCII strings related to its internal components and functionalities. The combined conditions aim to provide high confidence detection of ToxicEye.
Page 32 of 40