Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
693 detections
Filters
Last updated
All Time
Detection languages
264
188
50
46
40
Contributors
172
97
71
63
41
Categories
372
146
94
90
86
Platforms
592
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
This detection identifies potential process masquerading where a binary’s original file name metadata is wt.exe (Windows Terminal), but the actual running process name differs.
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Adversaries often tamper with PE metadata or rename binaries to evade detection and blend into legitimate processes. In this case, attackers may:
- Modify the OriginalFileName field in the PE header to wt.exe
- Execute a malicious binary under a different filename
- Attempt to bypass allowlists or detection logic relying on trusted binaries like Windows Terminal
This detection flags inconsistencies between:
actor_process_image_name (actual process name)
actor_process_file_original_name (PE metadata)
Detects the creation of files within a specifically misspelled 'Photoes' directory located in ProgramData. This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger to store XOR-encrypted keystroke logs (.trn files).
Detects the creation of an executable named 'msbuild.exe' or its associated '.lock' file inside the Windows user Startup folder by Python or CI/CD processes. This technique was observed in the TeamPCP campaign compromising the Telnyx Python SDK, where a fake MSBuild binary was dropped for stealthy persistence and the lock file was hidden via 'attrib +h'.
This rule detects instances where 'dllhost.exe' is spawned by an unusual parent process. Typically, 'dllhost.exe' is spawned by 'svchost.exe' or 'services.exe'. The rule specifically looks for 'dllhost.exe' processes whose parent is neither 'svchost.exe' nor 'services.exe', indicating a potentially malicious or unexpected execution chain.
Detects file creation, modification, or execution events involving the path '/Library/Caches/com.apple.act.mond', which is the hardcoded drop location for the macOS C++ RAT deployed by the Axios supply chain attack.
This rule detects the execution of 'lockapphost.exe' when its parent process is not 'svchost.exe'. 'lockapphost.exe' is a legitimate Windows process responsible for displaying the lock screen and login UI. If it is spawned by an unusual parent process, it could indicate an attempt to bypass the lock screen or manipulate user interface components for malicious purposes, potentially related to persistence or defense evasion.
Detects the creation of a file named "msbuild.exe" within the Windows Startup folder. This behavior matches the persistence and masquerading techniques used by the TeamPCP threat actor following the compromise of the telnyx PyPI package.
This rule detects network connections made by a specific executable ('v20svc.exe') to domains ending with 'app-metrics-cdn.com' and containing specific URL paths ('/api/upload', '/api/upload-json', '/api/upload-complete', '/api/listener/heartbeat'). This combination of indicators is associated with the Venom Stealer malware, often delivered via fake Avast scan websites.
Detects the execution of processes from the '/tmp/pglog' path or where the binary is named 'pglog'. Threat actor TeamPCP utilizes this specific filename to masquerade their downloaded malicious secondary payload as a legitimate PostgreSQL process, following the compromise of the litellm PyPI package.
Detects the loading of 'libcurl.dll' from suspicious or temporary directories such as ProgramData, Users\Public, or Temp. This behavior is associated with DLL side-loading techniques, such as those used by the BRUSHLOGGER keylogger which masquerades as 'libcurl.dll' to execute malicious code and capture keystrokes.
This rule detects processes executing from the `/tmp/pglog` path or with the filename `pglog` within `/tmp/`, which is a known technique used by the TeamPCP threat actor to masquerade malicious binaries as legitimate PostgreSQL processes for post-exploitation activity.
Detects malicious DLLs masquerading as libcurl.dll by identifying a low number of curl_easy_* exports combined with BRUSHLOGGER keylogger string artifacts. Designed to catch DLL side-loading attempts.
Detects the creation or modification of files within the misspelled 'Photoes' directory (e.g., \ProgramData\Photoes\). This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger for storing keystroke log files.
Detects the creation or modification of files within the misspelled 'Photoes' directory (e.g., \ProgramData\Photoes\). This directory is utilized by the BRUSHWORM backdoor for its main installation and by the BRUSHLOGGER keylogger for storing keystroke log files.
Detects persistence mechanisms associated with malware signed by TrustConnect Software PTY LTD. The malware establishes persistence by creating a specific Run key or by registering a service masquerading as Adobe Acrobat Reader.
Detects the execution of files signed by "TrustConnect Software PTY LTD", a certificate issuer observed signing malware that impersonates legitimate workplace applications to deploy RMM backdoors. This rule identifies processes launched from binaries associated with this suspicious certificate.
Detects execution of a binary from common staging directories shortly after
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
creation. Maps to the CursorJack PoC where run.bat drops p.exe to %TEMP%
before execution. Rule is parent-agnostic for broader coverage but should be
correlated with Cursor process activity for highest confidence.
This rule detects network traffic containing specific User-Agent strings used by the BurrowShell implant and the Rust-based keylogger to masquerade as legitimate Windows Update or browser traffic. These User-Agent strings are 'Windows-Update-Agent/10.0.10011.Client-Protocol/2.50' and 'Mozilla/5.0 (compatible; SecureNet/1.2)'.
Detects instances of svchost.exe running with an unusual or uncommon command line parameter by excluding known legitimate or common patterns.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
This could point at a file masquerading as svchost, a process injection, or hollowing of a legitimate svchost instance.
This detection rule identifies a persistence mechanism observed in the Dead#Vax campaign. It detects the Windows Script Host (wscript.exe) being launched by the Task Scheduler engine (taskeng.exe or svchost.exe) to execute a VBScript from a suspicious, user-writable directory such as AppData or a specific ProgramData path like 'ProgramData\IntelDriver'. This behavior is indicative of malicious persistence.
Detects the creation of a registry run key named 'OneDrive' that points to an executable located within the user's AppData ClickOnce cache directory. This is a specific persistence technique used by the SloppyLemming actor to execute the BurrowShell loader.
Page 27 of 33