Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,230 detections
Filters
Last updated
All Time
Detection languages
1,680
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,242
2,014
731
383
305
Platforms
2,604
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,124
15,647
12,595
8,404
6,230
3,230
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
This query detects activity associated with the BlueHammer, RedSun, and UnDefend toolset used in post‑exploitation campaigns (including "Nightmare Eclipse" intrusions). It identifies:
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
- Execution of suspicious binaries (FunnyApp.exe, RedSun.exe, undef.exe, z.exe) and command‑line flags (-h, -aggressive).
- File creation in unusual user directories (e.g., Pictures or two‑letter Downloads subfolders).
- BeigeBurrow tunneling via agent.exe.
- Reconnaissance commands (whoami /priv, cmdkey /list, net group).
- Network connections to known‑malicious IP addresses.
- Use of the REDSUN named pipe for privilege escalation.
The query combines process, file, and network events to surface potential hands‑on‑keyboard activity and follow‑on tooling
This rule detects the execution of suspicious filenames (FunnyApp.exe, RedSun.exe, undef.exe, z.exe, powershell.exe) from common user download or pictures directories. Adversaries often place malicious executables in these locations to evade detection and execute their payloads.
Detects the execution of common browser executables in headless mode with command-line arguments indicative of data exfiltration, malicious rendering (dump-dom), or external requests (http/data:text/html;base64,). This activity, especially when initiated by non-standard parent processes, can be a sign of automated web scraping, vulnerability scanning, or other malicious automated browser activity.
This query hunts for suspicious child interpreter processes spawned by Node.js/npm execution, consistent with malicious npm postinstall activity observed in supply chain attacks (including compromised Axios package delivery chains)
This rule detects attempts to mount a bind from a temporary directory or other sensitive system directories on Linux systems. This behavior can be indicative of an attacker trying to hide malicious activity or gain persistence by mounting a bind from a compromised location to a system directory.
This rule detects the execution of a 'curl' command on macOS that attempts to make a POST request to a file named 'salmonela' within the '/tmp/' directory. This pattern is highly suspicious and could indicate an attempt to exfiltrate data, upload malicious content, or interact with a temporary malicious script.
This rule detects the execution of the 'make' command with a '-f' flag pointing to a makefile located in common temporary or writable directories. This behavior can be indicative of an adversary attempting to execute arbitrary commands or escalate privileges by leveraging the 'make' utility to process a malicious makefile from a non-standard location.
This rule detects multiple TTPs (Tactics, Techniques, and Procedures) associated with advanced adversaries, including QEMU virtualization abuse for defense evasion, creation of malicious scheduled tasks (specifically 'TPMProfiler'), rogue account or service creation (e.g., 'CtxAppVCOMService' or 'AppMgmt' service via 'sc.exe'), port forwarding/tunneling commands (using 'ssh' or 'portproxy' with specific ports), credential access attempts via 'vssuirun.exe' or printing 'NTDS.dit', and potential DLL sideloading involving 'ADNotificationManager.exe' and 'vcruntime140_1.dll'. It also includes IOCs for specific IPs, domains, and file hashes.
Detects the creation of a process named 'wt.exe' within the 'ProgramData' directory, which is an unusual location for a legitimate executable and could indicate malicious activity. Exclusions are in place for common administrative tools and specific endpoint naming conventions to reduce false positives.
This rule detects suspicious command execution patterns involving the Lua interpreter on Linux systems. It specifically looks for Lua interpreter processes executing commands that run suspicious functions. These functions can be abused by adversaries to execute arbitrary commands, establish network connections, or load dynamic libraries, indicating potential malicious activity.
This rule detects the execution of specific suspicious scripts, 'dra.ps1' or 'handala.bat', via common Windows command shells such as PowerShell (powershell.exe, pwsh.exe) or Command Prompt (cmd.exe). This activity could indicate malicious execution of known adversary scripts.
Detects the execution of processes from common user-writable directories such as Desktop, Downloads, AppData, Documents, and the Public folder. Adversaries often place and execute malicious payloads in these locations to evade detection and leverage user permissions. This rule helps identify potentially unauthorized or malicious software execution.
Detects php/perl/ruby one-liner execution patterns combined with network or shell invocation primitives, consistent with trusted interpreter abuse and execution guardrail bypass.
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
This rule detects a suspicious attack chain, potentially related to 'ClickFix' or similar social engineering campaigns. It correlates multiple events within a 5-minute window: a browser being launched from an email client, a file download from a browser into the Downloads directory, and a command prompt being launched from explorer.exe executing a command that references the Downloads directory. Additionally, it looks for network connections initiated by common document types, which could indicate malicious document activity.
Detects instances where the legitimate system information tool CPU-Z (cpuz.exe, cpuz_x64.exe, cpuz_x32.exe) is observed launching PowerShell. This activity is highly suspicious as CPU-Z is not expected to execute scripting environments like PowerShell and could indicate an attempt to execute malicious code or further reconnaissance using a seemingly benign process.
Detects execution of Impacket's MSSQL client tool, commonly used for lateral movement against Microsoft SQL servers using compromised credentials. Includes detection of proxychains usage and Python-based execution patterns.
Detects when a built-in utility is used to decode and decrypt a payload after a macOS disk image (DMG) is executed. Malware authors may attempt to evade detection and trick users into executing malicious code by encoding and encrypting their payload and placing it in a disk image file. This behavior is consistent with adware or malware families such as Bundlore and Shlayer.
Detects Stracciatella which executes a Powershell runspace from within C# (aka SharpPick technique) with AMSI, ETW and Script Block Logging disabled based on PE metadata characteristics.
Detects when a shell program such as the Windows command prompt or PowerShell is launched with system privileges from a uncommon parent location.
This rule detects when the Obsidian application (obsidian.exe) spawns common shell or scripting interpreters such as PowerShell, cmd.exe, sh, bash, zsh, or osascript. This activity could indicate malicious code execution originating from a potentially compromised or weaponized Obsidian instance, or an attempt to leverage Obsidian's capabilities for unauthorized command execution. The inclusion of 'osascript' specifically addresses observed macOS attack chains (REF6598).
Page 114 of 154