Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
3,229 detections
Filters
Last updated
All Time
Detection languages
1,679
638
186
183
172
Contributors
781
591
426
265
151
Categories
2,241
2,013
731
383
305
Platforms
2,603
874
438
69
42
Products / Services
935
630
365
185
162
MITRE Techniques
18,116
15,638
12,586
8,396
6,226
3,229
CVEs
20
13
13
12
9
IDS Classtypes
11
7
2
2
1
IDS Protocols
17
3
Detects execution of files from Downloads, Temp, or AppData folders by browsers, indicating potential FileFix attacks where malicious files are downloaded and immediately executed.
Detects Windows Management Instrumentation Command-line (WMIC) execution from browsers, often used in ClickFix attacks for remote process creation or system manipulation.
Detects Windows Script Host execution of suspicious file types from browsers, often used in FileFix attacks to execute malicious VBScript or JScript files.
The following EQL query can be used to hunt for XMRIG executions within your environment.
This rule detects exploitation attempts against SharePoint servers, specifically targeting CVE-2025-53770 (ToolShell). It has two parts: one for suspicious process creation (cmd.exe spawning powershell.exe from w3wp.exe) and another for malicious web request patterns in IIS logs (POST requests to /_layouts/15/ToolPane.aspx with specific query parameters and referrer).
CVE-2025-53770 Exploitation hunt
This rule detects a specific DLL hash (3d3837eb69c3b072fdfc915468cbc8a83bb0db7babd5f7863bdf81213045023c) associated with the SLOW#TEMPEST campaign. This file is the loader DLL responsible for executing the malware's payload. The rule looks for this hash in both executed processes and files on disk.
This detection looks for reverse shell string patterns on an ESXi host, which may indicate that a threat actor is attempting to establish remote control over the system. It specifically identifies patterns commonly used in bash, python, and other shell commands to initiate reverse connections.
This rule detects instances where common web browsers (e.g., Chrome, Edge, Firefox) launch specific Living Off The Land Binaries (LOLBins) or scripting interpreters. The LOLBins and interpreters include `cmd.exe`, `powershell.exe`, `rundll32.exe`, `regsvr32.exe`, `msiexec.exe`, `mshta.exe`, `hh.exe`, `certutil.exe`, and `bitsadmin.exe`. This activity can indicate malicious intent, such as drive-by downloads, exploit kit activity, or initial access attempts where an attacker leverages a browser to execute system utilities for further compromise.
Detects execution of the Interlock RAT PHP variant and associated activity by looking for specific execution parameters, initial download commands, and known malicious file hashes, domains, and IP addresses.
This rule detects the execution of common command-line utilities (wget, curl, nc, bash, python, perl, php, sh) within web server directories. This activity is highly suspicious as it could indicate an attacker attempting to download malicious files, execute web shells, or perform other post-exploitation activities on a compromised web server.
This package searches endpoint processes for cscript executing a wsf file which has been attributed to the Serpentine#Cloud campaign.
This is a brittle detection narrowly defined to this particular campaign but is nonetheless useful.
This is a brittle detection narrowly defined to this particular campaign but is nonetheless useful.
This package searches for evidence of Windows Shortcut (.lnk) files executing code to download a .wsf file from a remote WebDAV share hosted on a trycloudflare[.]com subdomain. This package searches in both web logs and endpoint process logs.
An ongoing malware campaign tracked as SERPENTINE#CLOUD has been identified as leveraging the Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts.
For initial access, the threat actors are luring users to execute malicious .lnk files (shortcut files) disguised as documents to silently fetch and execute remote code.
These payloads use cmd.exe to silently retrieve additional stages over WebDAV (via Cloudflare Tunnel subdomains) and invoke WSF or batch-based droppers.
trycloudflare[.]com allows a threat actor to expose a tunnel to the internet using legitimate infrastructure that will likely blend into benign traffic. trycloudflare dynamically generates subdomains formed of random words and so it's not enough to just look for such connections since they are also used by developers in testing. Therefore this search looks for further procedures attributed to the campaign.
An ongoing malware campaign tracked as SERPENTINE#CLOUD has been identified as leveraging the Cloudflare Tunnel infrastructure and Python-based loaders to deliver memory-injected payloads through a chain of shortcut files and obfuscated scripts.
For initial access, the threat actors are luring users to execute malicious .lnk files (shortcut files) disguised as documents to silently fetch and execute remote code.
These payloads use cmd.exe to silently retrieve additional stages over WebDAV (via Cloudflare Tunnel subdomains) and invoke WSF or batch-based droppers.
trycloudflare[.]com allows a threat actor to expose a tunnel to the internet using legitimate infrastructure that will likely blend into benign traffic. trycloudflare dynamically generates subdomains formed of random words and so it's not enough to just look for such connections since they are also used by developers in testing. Therefore this search looks for further procedures attributed to the campaign.
This is a general rule meant to capture malicious MSHTA abuse pattern agnostic of the attack style or name (i.e., ClickFix, FakeCaptcha, FakeUpdates, ClearFake, etc.)
Detects suspicious command-line activity associated with the "ClickFix" social engineering technique.
Threat actors trick users into pasting and executing malicious commands that typically use scripting engines or built-in utilities to download and run subsequent payloads.
This rule identifies patterns seen in recent NetSupport RAT, Latrodectus, and Lumma Stealer campaigns using this vector.
Threat actors trick users into pasting and executing malicious commands that typically use scripting engines or built-in utilities to download and run subsequent payloads.
This rule identifies patterns seen in recent NetSupport RAT, Latrodectus, and Lumma Stealer campaigns using this vector.
This analytic detects outbound network connections initiated by command-line tools such as `curl` or `wget` as observed in Cisco Secure Firewall Threat Defense logs. It specifically looks for allowed connections where the `EVE_Process` or `ClientApplication` fields indicate the use of these utilities. While these tools have legitimate uses, adversaries frequently abuse them to download malicious payloads, retrieve additional tools, or establish staging infrastructure on compromised systems. Detection of this activity may indicate the download phase of an attack chain or the retrieval of command-and-control utilities.
Detects network connections to Cloudflare's trycloudflare.com domain by processes commonly abused by threat actors for payload delivery or command and control (C2), indicating potential misuse of Cloudflare Tunnels.
Detects suspicious script download attempts initiated by a Java process, indicative of potential JDWP exploitation leading to Remote Code Execution (RCE). Attackers often leverage exposed JDWP interfaces to execute commands like downloading and running malicious scripts.
Detects suspicious command-line strings within the 'TypedPaths' registry key, specifically targeting entries associated with web browsers. This behavior is indicative of the "FileFix" technique, where users are tricked into pasting malicious commands into browser file upload dialogs. The rule looks for common command-line utilities like 'cmd', 'curl', 'powershell', 'bitsadmin', 'certutil', 'mshta', and 'regsvr32' within the 'url1' value of the 'TypedPaths' key, combined with the presence of a '#' character, which often signifies a comment or a separator in such malicious constructs.
KQL Query
Detects PowerShell creating executable files or script files. This rule specifically looks for PowerShell processes (powershell.exe, powershell_ise.exe, pwsh.exe) writing files with common executable or script extensions to disk, while filtering out common temporary file locations and PowerShell module paths to reduce false positives.
Page 130 of 154