Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects RtkNGUI64.exe creating a mutex named as an 8-character hex string, consistent with the backdoor's CRC-32(USERNAME+USERDOMAIN+COMPUTERNAME) per-victim beacon ID used for single-instance checking.
Consolidated detection for RtkNGUI64.exe spawning cmd.exe to execute CMD= tasking (SYSTEM/PUT/TIME verbs). Merges two previously separate rules that detected the same underlying signal via different tasking-mechanism angles.
Detects access-token duplication combined with CreateProcessAsUserA spawning the non-standard synchost.exe process outside System32 under a target interactive session.
Detects execution of the typosquatted process synchost.exe (distinct from the legitimate svchost.exe) when unsigned or running outside System32.
Detects msagent.sys driver load correlated with subsequent protection (reduced handle access rights) of an unsigned, non-standard synchost.exe process within a 1-hour window.
Detects the unsigned/untrusted AutoIt interpreter binary OptiDrive.exe staged under the masquerade path %LOCALAPPDATA%\DriveOptimize Technologies\, mimicking legitimate 'DriveOptimize Technologies' software.
Detection for reported campaign delivering a trojanized, non-digitally signed TrueConf client installer to users connecting to a compromised TrueConf server.
Detects a renamed AutoHotkey interpreter executable (masquerading as another binary via its version-info OriginalFileName field) running from a Temp, Downloads, or AppData folder with no command-line arguments and a co-located, same-named .ahk script file created within an hour, consistent with the AutoHotkey stager technique used by UNC6692 to deploy the Edgecution malware suite.
CornFlake is a newly identified Remote Access Trojan (RAT) attributed to a campaign dubbed CaptiveCrunch, attributed to the APT29 (Cozy Bear, Midnight Blizzard) sub-cluster tracked as Storm-2945. Real intrusion and sandbox dynamic analysis identifies the RAT landing initially as a file called edge_update.exe which, upon execution, copies itself to a binary named svchost32.exe, masquerading as the legitimate svchost.exe binary to evade detection.
Notes: Detection uses the case operator to match surfaced artifacts against source MSRC article and live sandbox detonation artifacts. MSRC reports the malicious svchost32.exe landing in %APPDATA%\svchost32\svchost32.exe, however live sandbox analysis observes the file path being %LOCALAPPDATA%\Microsoft\svchost32\svchost32.exe. Case statement checks against both to be safe, as neither should exist in a standard environment.
Also, remember that IoCs such as file names are low on the pyramid of pain. Taking into account MSRC's article showing the attackers using a handful of different lures, the edge_update.exe process name is likely only one of many for the initial implant. I would expect the svchost32.exe process to be slightly higher fidelity, but defenders should not assume that this detection being in place means they are fully covered from CornFlake RAT.
Notes: Detection uses the case operator to match surfaced artifacts against source MSRC article and live sandbox detonation artifacts. MSRC reports the malicious svchost32.exe landing in %APPDATA%\svchost32\svchost32.exe, however live sandbox analysis observes the file path being %LOCALAPPDATA%\Microsoft\svchost32\svchost32.exe. Case statement checks against both to be safe, as neither should exist in a standard environment.
Also, remember that IoCs such as file names are low on the pyramid of pain. Taking into account MSRC's article showing the attackers using a handful of different lures, the edge_update.exe process name is likely only one of many for the initial implant. I would expect the svchost32.exe process to be slightly higher fidelity, but defenders should not assume that this detection being in place means they are fully covered from CornFlake RAT.
Detects creation of an abstract Unix domain socket matching the Kimwolf v7 single-instance mutex naming convention (@*boxv7/@*boxv4/@*boxv5) by a process running from a non-system, application-data path.
Detects post-exploitation persistence artifacts on Windows endpoints managed by N-able N-central consistent with abuse of CVE-2026-18577, including a new Windows service named Cloudflared, registry Services key creation for Cloudflared, a file named svchost.exe written under a user's Documents folder, or process execution of cloudflared.exe or a Documents-located svchost.exe.
This rule detects two potentially malicious behaviors: 1) The creation or installation of a Windows service using the 'Cloudflared' executable, which can be leveraged for unauthorized tunneling or persistence. 2) The execution of an executable named 'svchost.exe' located within a user's Documents folder, which is a common indicator of file masquerading to evade detection.
KQL Query from file: Cloudflared Persistence & svchost.exe Masquerading Post-N-central CVE-2026-18577
Detects creation or modification of files under hidden, Apple-mimicking Application Support directories (.com.apple.accountsd, .com.apple.metadata.mds) that back a masquerading LaunchAgent -- the persistence mechanism AMOS stealer uses to survive reboot as AccountsHelper/mdworker_shared.
Detects CountLoader copying conhost.exe, powershell.exe, and mshta.exe into user-writable directories with p/c/m OneDrive-style name prefixes and patched PE metadata (OriginalFileName), running outside standard system directories.
This rule detects two potentially malicious behaviors: 1) The creation or installation of a Windows service using the 'Cloudflared' executable, which can be leveraged for unauthorized tunneling or persistence. 2) The execution of an executable named 'svchost.exe' located within a user's Documents folder, which is a common indicator of file masquerading to evade detection.
KQL Query from file: Cloudflared Persistence & svchost.exe Masquerading Post-N-central CVE-2026-18577
Detects the creation of a scheduled task named 'WindowsUpdate' or 'BootUpdate' that triggers the execution of 'fsociety.exe' with SYSTEM privileges. This pattern is indicative of the TOKYOCORE malware establishing persistence on a Windows host.
Detects the HeptaX keylogger by identifying a specific sequence of suspicious process behaviors: installation of WH_KEYBOARD_LL or WH_MOUSE_LL hooks, creation of a specific "Microsoft_SysInternal_logger-v2.0" mutex, elevating the process priority class to high or realtime, and writing log files to a directory masquerading as a OneDrive folder within ProgramData.
Detects a user-mode process sending IOCTL 0x222418 to a kernel driver to overwrite the file-name buffer in a process's image FILE_OBJECT, spoofing the reported process image path.
Detects STAC4749 persistence mechanisms including Run key values disguised as Realtek or WinAudio audio components, mklink-%.vbs scripts used to create Startup folder shortcuts, and hidden Startup folder .lnk files disguised as SecurityHealth or OneDriveUpdate.
Page 12 of 33