Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
692 detections
Filters
Last updated
All Time
Detection languages
264
188
49
46
40
Contributors
172
97
71
63
41
Categories
372
145
94
90
86
Platforms
591
49
20
14
8
Products / Services
198
179
90
34
27
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
5
4
4
3
3
IDS Classtypes
14
4
1
IDS Protocols
6
6
4
3
Detects suspicious child processes spawned by gup.exe, which is the Notepad++ updater. This behavior can indicate an attempt to hijack the update process for malicious purposes, such as executing arbitrary code or installing unwanted software. The rule specifically looks for gup.exe spawning common scripting/execution tools (update.exe, AutoUpdater.exe, curl.exe, cmd.exe, powershell.exe, wscript.exe, cscript.exe, rundll32.exe) or processes from temporary or user application data directories, while excluding legitimate explorer.exe and Notepad++ installer processes.
Detects the execution of 'AutoUpdater.exe' or 'update.exe' with the '/closeRunningNpp' flag. This specific behavior has been observed in hijacked Notepad++ update flows where a malicious binary masquerades as the legitimate updater. 'AutoUpdater.exe' is not a legitimate Notepad++ file.
Detects the execution of suspicious binaries (update.exe, AutoUpdater.exe) from a temporary directory, where the parent process is the Notepad++ updater (gup.exe). Notepad++ does not use these filenames for legitimate updates, and this behavior is indicative of a hijacked update process.
Detects the execution of a process named 'code.exe' or 'lightshot.exe' from a temporary directory.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
This behavior was observed in a campaign involving a malicious VS Code extension, "ClawdBot Agent", which impersonates a legitimate AI coding assistant.
The extension drops and executes a weaponized ScreenConnect payload, masquerading it as a legitimate VS Code or Lightshot process to evade detection.
The execution is often spawned by the legitimate VS Code process.
Detects the creation of executable files (.exe, .dll) in the `%TEMP%\Lightshot` directory. This directory is used as a staging area by the malicious fake Clawdbot VS Code extension to drop its payloads, including a weaponized ScreenConnect client.
Detects VIMC UNITY campaign trojan/loader: PE with Java Control Panel (javacpl.exe) abuse context, OpenJDK build path (javacplexec/javacpl.pdb), and behavioral strings (logs.txt, XClient.exe, shost.exe). Delivered via email lure VIMC UNITY --LUMUT PORT LAYTIME with attachment VIMC UNITY.gz.
Identifies Windows executable files signed by Hong Kong-based entities associated with IPIDEA's trojanized software distribution (e.g., masquerading as OneDriveSync or Windows Update).
This rule detects suspicious command-line activity involving 'conhost.exe' running in headless mode, combined with specific keywords often associated with malware or malicious scripts. The presence of '--headless' with other suspicious strings like 'svchost.exe', 'certutil -decode', common temporary directories, or specific file extensions/initiating processes (cmd.exe, powershell.exe, curl) suggests an attempt to execute hidden or obfuscated malicious code. This pattern is frequently observed in various stages of an attack, including execution, persistence, and defense evasion.
Detects the execution of a VBScript file named 'windows_api.vbs' from common public or appdata directories, a characteristic behavior of the GOGITTER malware as part of the Gopher Strike campaign.
Detects the execution of executables with names like 'Updater.exe' from suspicious paths in the AppData\Local directory, which are associated with fake PDF converter malware families like PDFClick, Easy2Convert, and ConvertMate.
Detects the use of a renamed Rclone binary to exfiltrate data via FTP. This technique was observed in a Lunar Spider intrusion where the actor used 'sihosts.exe' (a renamed rclone.exe) to copy files to an actor-controlled FTP server.
Detects the creation of abnormally large Windows shortcut (.lnk) files. This is a known TTP of APT36 (Transparent Tribe), who embed PDF content within LNK files to inflate their size and masquerade as legitimate documents to deceive users. The rule specifically looks for .lnk files with a size greater than 1MB.
Detects when legitimate .NET utilities, often abused for process hollowing, make outbound network connections. This is anomalous behavior and may indicate that the process has been injected with malicious code to bypass defenses.
This rule detects suspicious network connections to known malicious URLs associated with a Docker Desktop malware campaign. It also identifies instances where 'DockerDesktop.exe' is executed or present in unusual file paths, suggesting potential masquerading or unauthorized deployment outside of its standard installation directory. The rule is broken into three parts: network events, file events, and process events. The network part looks for connections to specific malicious domains. The file and process parts look for 'DockerDesktop.exe' in folders other than the assumed legitimate installation path, indicating potential malicious activity.
Detects the PeerBlight Linux backdoor masquerading as the '[ksoftirqd]' kernel thread. This is a defense evasion technique used by the malware to blend in with legitimate system processes.
Detects process execution from a deeply nested path containing a long sequence of underscores, a technique used by the ValleyRAT campaign to hide malicious components.
Detects a process executing from a temporary directory that masquerades as the legitimate 'systemd-logind' service. This behavior is characteristic of the V3G4 Mirai-derived botnet, which uses this technique to evade detection.
Detects the FormBook RAT persistence mechanism where it copies itself to a disguised location (%APPDATA%\Roaming\word\word.exe) and creates a registry run key named 'svchost.exe' to ensure execution at user login. The rule correlates the file creation and registry modification events on the same device within a short time window.
Detects persistence and execution artifacts associated with the Latrodectus malware. This includes the creation of a misspelled registry run key ('sentinelssheduler') and the execution of a payload masquerading as SentinelOne from a non-standard AppData path.
Detects malformed DNG/TIFF image files used to deliver the LANDFALL Android spyware. These files contain an appended ZIP archive which holds the malicious components.
Detects the creation of a scheduled task using the "-XML" flag with a file that does not have the '.xml' extension. This behavior is suspicious because it attempts to masquerade the XML configuration file, potentially as a defense evasion technique during persistence establishment. Adversaries might use this to hide their scheduled tasks from casual inspection.
Page 29 of 33