Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,127
15,648
12,596
8,407
6,231
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the initial script execution phase of the Red Lamassu JFMBackdoor infection chain, specifically PowerShell downloading components into the TEMP directory. This rule looks for PowerShell execution that uses common download commandlets (Invoke-WebRequest, iwr, wget, Net.WebClient) to save specific Red Lamassu payload filenames (FLTLIB.dll, scr.mui, flt.bin, fltMC.exe) into a temporary directory.
Detects PowerShell utilizing Invoke-WebRequest (iwr) to download a payload and subsequently executing it via Start-Process using rundll32 with the specific 'Begin' export function. This execution pattern is the primary secondary stage for the recent Ghost CMS ClickFix campaigns delivering information stealers.
This rule detects the download of executable files (such as .exe, .dll, .bat, .ps1, .vbs, .hta) over HTTP. It specifically looks for the 'MZ' header, which is characteristic of Windows executables, and checks the HTTP URI for common executable file extensions. This activity is often associated with initial access or command and control techniques where adversaries download malicious payloads.
Detects the use of bitsadmin.exe to download the Argamal RAT encrypted payload file (zaesdl.dat) from remote sources like GitHub. This activity is indicative of an adversary attempting to transfer malicious tools into a compromised environment.
Detects web requests containing the specific user-agent or custom secret headers used by the Moika campaign beacon to retrieve its stage 2 payload.
Identifies PowerShell executing scripts or expressions from the ProgramData directory, which may indicate malicious staging or backdoor execution. This rule specifically looks for PowerShell processes where the command line includes 'C:\ProgramData\' and also contains keywords like 'IEX', 'Invoke-Expression', or '.ps1', suggesting the execution of a script or expression.
Detects the usage of the Windows Package Manager (WinGet) to install the Deno runtime environment. Threat actors (e.g., the operators behind the DinDoor backdoor) abuse native package managers to silently install runtimes required for their payloads without triggering alerts.
Detects web requests containing the specific user-agent or custom secret headers used by the Moika campaign beacon to retrieve its stage 2 payload.
Detects the execution of scripts or commands containing the highly specific string 'firedalazer'. This string is hardcoded into the Miasma (a Shai-Hulud variant) dropper scripts to locate and fetch the 5th stage malicious payload from a specific GitHub commit.
Detects the creation of files by the "node.exe" process within the ".vscode-server" directory, specifically targeting paths related to user history. This activity could indicate remote file creation via the Visual Studio Code tunnel feature, which might be used for unauthorized access or data transfer.
Detects mshta.exe spawning PowerShell with hidden execution, web download, archive extraction, and staged process launch behavior, indicative of the UAC-0184 threat actor.
Identifies the use of curl to send POST requests to the Kubernetes API targeting the creation of pods. This can indicate an attacker using a stolen ServiceAccount token to deploy malicious or privileged containers.
Detects network connections or web requests to the specific malicious GitHub repository paths used to host the 5th and 6th stage payloads of the Miasma malware (a Shai-Hulud variant).
This rule detects suspicious activity involving PowerShell downloading content (using Invoke-WebRequest, iex, or DownloadString) followed by the creation of specific suspicious files (Browser Update.exe, update.zip, update.msi) on the same device within a 10-minute window. This correlation suggests a potential ingress of malicious tools or updates.
Detects the initial PowerShell command users are instructed to paste and run from the Windows Run dialog following a Microsoft Teams social engineering lure to deploy ModeloRAT. This rule specifically looks for PowerShell execution that downloads content from 'dropbox.com' using 'iwr' (Invoke-WebRequest), extracts an archive using 'Expand-Archive', and targets the 'appdata' directory.
Detects the ClickFix paste-and-run initial-access primitive used by KongTuke and other groups. This involves `explorer.exe` spawning PowerShell with defense-evasion arguments (`-NoProfile`, `-ExecutionPolicy Bypass`, `-WindowStyle Hidden`) and a downloader chain targeting cloud file-sharing services. The combination of `explorer.exe` parent (user typing into Run dialog), hidden execution flags, `Invoke-WebRequest`, and `Expand-Archive` in one command line is the defining fingerprint of the technique.
Detects the usage of certutil.exe to download files, or encode/decode data. This behavior is commonly associated with Living Off The Land Binaries (LOLBins) exploitation to bypass security controls.
Detects network connections, DNS queries, or web requests to domains associated with the Mini Shai-Hulud supply-chain attack.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
This attack compromised multiple npm and PyPI packages (such as TanStack, Mistral AI, and UiPath) with a payload that exfiltrates harvested credentials to the Session messaging protocol's file server and downloads additional stages from attacker-controlled domains.
One KQL to catch them all ... DirtyFrag or CopyFail (Fileless or ElfBinary execution)
This rule detects a potential privilege escalation attempt on Linux systems. It looks for two main indicators: first, the execution of the 'su' command from a user's home directory by a process whose executable was recently created in a user's home directory and identified as an ELF binary. Second, it identifies systems where public-facing network connections were made by processes using common remote file transfer utilities (curl, wget, lftp, axel, aria2, scp, rsync, ftp) to fetch code, followed by the execution of a process with 'algif-aead' in its command line, which could indicate fileless execution after remote code fetching. The combination suggests an attacker might be fetching malicious code, potentially compiling it, and then using it to escalate privileges via 'su' or executing it filelessly.
Detects instances where 'curl.exe' is used to download content related to Node.js, specifically looking for 'nodejs.org' or 'node-v' in the command line. This could indicate an adversary attempting to download and execute a Node.js runtime or related tools on a compromised system.
Page 85 of 121