Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects Explorer.exe spawning PowerShell to fetch a polymorphic server-side payload where the URL contains randomized alphanumeric parameters preventing static caching.
Correlates the ClickFix execution directly to the creation of the NetSupport RAT files (client32.exe) in public directories, specifically when PowerShell is used to access the clipboard.
Maps the Python interpreter dropping PE files (.exe) into temporary directories, a behavior associated with stage 2 loaders embedded in AI models.
Detects executables located in potentially suspicious directories initiating network connections towards file sharing domains.
Detects a network connection initiated by programs or processes running from suspicious or uncommon files system locations.
Detects PowerShell using Net.WebClient to download an MSI payload. This technique is often used by adversaries to download and execute malicious installers.
Detects msiexec.exe silently downloading and installing an MSI payload from an external URL. This behavior is often indicative of malicious activity where an attacker uses msiexec to fetch and execute a malicious installer without user interaction.
Detects the use of the Windows built-in 'tar' utility to extract files into the C:\Users\Public\AccountPictures directory. This behavior has been observed in APT37 NarwhalRAT campaigns during its setup phase, indicating potential ingress tool transfer or staging of malicious files.
Targets API request content containing shell separators together with command interpreters or transfer utilities. The UDM rule retains principal and target context for correlation.
Identifies downstream ClickFix where users paste and execute PowerShell or CMD commands via the Explorer Run menu, specifically looking for commands that include Invoke-WebRequest, IEX, or mshta, and are associated with network connections to 'wigetticks.com' or 'wizzleticks.com'.
Detects browser network events fetching secondary stage loaders from api.wizzleticks.com, specifically when initiated by cmd.exe, powershell.exe, or mshta.exe. This indicates a potential supply chain attack where a legitimate process is used to download and execute malicious content.
Detects mshta.exe downloading malicious HTA logic from the 'wizzleticks.com' domain. This activity is often associated with initial access or execution phases of an attack, where mshta is abused to fetch and execute remote scripts or HTA files.
Looks for curl or wget downloading a payload followed by node or bun immediately executing a .js or .mjs file. This pattern is indicative of supply chain attacks, particularly those targeting JavaScript ecosystems like npm.
This rule detects network connections to the 185.235.137.0/24 subnet, which is associated with XenoRAT command and control (C2) infrastructure. The detection specifically looks for these connections being initiated by 'mshta.exe' or 'powershell.exe', indicating potential malware activity or C2 communication.
Detects if 'install-persistent.php' or 'class-wc-subscription-diagnostics.php' files are modified by tools like powershell.exe, certutil.exe, or cmd.exe, indicating potential alternative persistence methods or backdoor installation.
Detects download of attacker tools via C2 ingress transfer channels
Detects remote PowerShell execution initiated by processes associated with Remcos RAT or Optimax. The rule specifically looks for PowerShell or cmd.exe processes executing commands containing 'IEX', 'Invoke-Expression', 'DownloadString', or a specific IP address (62.102.148.212), where the initiating parent process is identified as 'Remcos' or 'Optimax'. This indicates a potential compromise and execution of malicious code via a known RAT.
This rule detects the creation of common media file types (audio and video) within user-specific application data, temporary, or user profile directories. This activity could be indicative of various malicious behaviors, including data exfiltration, staging of malicious payloads, or the dropping of decoy files by malware.
Detects network connections to the '/avast_update' endpoint, which is associated with the RMMProject malware for fetching secondary DLL payloads.
Detects rundll32.exe loading davclnt.dll triggered by a .wsh script for WebDAV access. This activity can be indicative of an adversary attempting to force authentication to capture credentials or to facilitate ingress tool transfer.
Detects PowerShell execution initiated by Remote Monitoring and Management (RMM) tools, specifically 'IDriveRemotePC.exe' or 'RemotePC.exe', when the PowerShell command line contains keywords indicative of downloading and executing remote content (e.g., 'DownloadString', 'IEX', 'Invoke-Expression', 'http', 'https', 'ftp'). This behavior is often associated with initial access or staging phases of an attack, such as ransomware deployment.
Page 80 of 121