Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
811 detections
Filters
Last updated
All Time
Detection languages
339
195
76
50
47
Contributors
208
105
95
70
69
Categories
492
482
95
95
87
Platforms
626
161
82
25
5
Products / Services
203
160
110
86
67
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
811
CVEs
6
6
5
5
5
IDS Classtypes
20
2
2
1
IDS Protocols
20
3
Detects a specific data exfiltration pattern observed in the Notepad++ supply chain attack. An attacker uses curl.exe to upload a file containing reconnaissance data to the temp.sh file sharing service. Subsequently, a beacon is sent to the C2 where the User-Agent string of the HTTP request contains the temp.sh URL for the exfiltrated data.
This rule detects a highly suspicious activity where the Notepad++ updater process (GUP.exe) spawns the Windows Command Shell (cmd.exe) to execute various reconnaissance commands. This behavior is specifically linked to the Chrysalis backdoor, which was involved in a supply chain attack targeting Notepad++. The presence of commands like 'whoami', 'tasklist', 'systeminfo', 'ipconfig', and 'net' (with user, view, or group arguments) indicates an adversary attempting to gather information about the compromised system and network.
Detects a sequence of system reconnaissance commands followed by data exfiltration to temp.sh, a TTP used in the Notepad++ supply chain attack.
Detects DKnife attempting to discover network information by sending a POST request with a specific password hash to a router management interface. This activity is associated with the DKnife framework, a China-nexus gateway-monitoring tool.
The malware used the legitimate curl.exe to upload data to temp[.]sh. This is a high-fidelity indicator as legitimate business processes rarely upload data to ephemeral pastebins via command line.
This query hunts for the specific "reconnaissance batch" behavior observed in this campaign: a process piping netstat, systeminfo, or tasklist output into a text file (specifically a.txt as seen in the report, though looking for any single-letter text file is a good heuristic).
This rule looks for the GUP.exe process (the legitimate updater) spawning unexpected child processes like cmd.exe or the known malicious AutoUpdater.exe.
Detects a sequence of reconnaissance commands (whoami, tasklist, systeminfo, netstat) executed by the command prompt and piped to a text file. This specific TTP was used in the Notepad++ supply chain attack to gather system information for exfiltration.
Detects PowerShell execution using Get-CimInstance to query Win32_ComputerSystem, Win32_BIOS, Win32_BaseBoard, or other WMI classes commonly checked by malware to detect virtual machine or sandbox environments. This technique is frequently used by malware families to evade analysis in virtualized security research environments.
Detects PowerShell scripts that query the system's total physical memory and compare it against common low-resource thresholds (e.g., < 4GB). This is a known sandbox evasion technique used by malware to identify and avoid analysis environments, which are often configured with limited RAM.
Detects the SmarterMail service process ('MailService.exe') spawning command-line interpreters to execute reconnaissance commands. This behavior is highly indicative of remote code execution following the exploitation of vulnerabilities like CVE-2026-23760.
This detection rule identifies the execution of WinPEAS (Windows Privilege Escalation Awesome Script), a post-exploitation reconnaissance tool used to discover privilege escalation paths on Windows systems. WinPEAS performs a wide range of local enumeration checks, including service misconfigurations, permission issues, token privileges, and more. Its usage is commonly observed during red team assessments and by adversaries seeking to elevate privileges after gaining initial access. WinPEAS checks are well-documented in the HackTricks knowledge base.
Detects the initial VBScript loader used in Turla's Kazuar v3 campaign. The loader script (8RWRLT.vbs) is executed via wscript.exe and creates a folder structure mimicking HP printer drivers at %LOCALAPPDATA%\Programs\HP\Printer\Driver. The script downloads multiple files from a remote C2 server including hpbprndi.exe (a legitimate signed HP driver), hpbprndiLOC.dll (the actual Kazuar loader), and encrypted payload files (jayb.dadk, kgjlj.sil, pkrfsu.ldy). The loader uses WinHttp.WinHttpRequest.5.1 COM object to download files while ignoring SSL certificate errors, and establishes persistence by creating a registry entry in HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. This rule specifically looks for wscript.exe processes with command lines containing both the HP printer driver path and hpbprndi references, which are strong indicators of the Kazuar v3 loader execution.
Detects Windows Management Instrumentation (WMI) queries performed by wscript.exe that include specific reconnaissance-related keywords such as 'Win32_OperatingSystem', 'Win32_Process', 'LastBootUpTime', and 'PROCESSOR_ARCHITECTURE'. This activity is indicative of system reconnaissance, potentially by malware like Turla Kazuar v3 VBScript loader.
Detects multiple WMI or PowerShell commands used by a Lumma Stealer loader to perform anti-VM and anti-sandbox checks. This includes querying for video controller details, refresh rates, and disk drive models.
Detects use of the sysinfo system call in Linux, which provides a snapshot of key system statistics such as uptime, load averages, memory usage, and the number of running processes.
Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.
Malware or reconnaissance tools might leverage sysinfo to fingerprint the system - gathering data to determine if it's a viable target.
Detects suspicious behavior where a Node.js-based application, potentially EvilAi malware, launches cmd.exe to query MachineGuid from the registry or system model via PowerShell. This activity indicates potential fingerprinting or persistence activity, often originating from the \AppData\Local\Programs\ directory with medium integrity.
Detects creation of .host file in temp directories by FlexibleFerret malware for identifying machines on macOS systems.
Detects system information discovery commands
Detects attempts to query system information directly from the Windows Registry.
Detects a PowerShell script used by Gootloader for reconnaissance. This script collects environment variables with a specific length limit, operating system details, and information about running processes.
Page 30 of 39