Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects curl or wget download followed by chmod and execution, consistent with staged malware delivery used by malicious OpenClaw skills distributing AMOS.
This rule helps you find files that may be part of the EmEditor watering hole incident by looking for a small set of very specific clues that were described in public reporting. It searches for lookalike website names and a repeated campaign marker that appeared in the attacker’s network paths. A match does not automatically prove malware, but it is a strong hint that the file should be reviewed, especially if it is a script, configuration, or installer related content. If you get a hit, confirm where the file came from and whether it is expected for that machine. If it is unexpected, save the file for analysis, check for other related downloads, and look for signs of credential theft or surveillance activity. Also search for the same marker across endpoints, because campaigns often reuse the same identifier on multiple victims. The intent is to give defenders an easy, reliable starting point for triage using human readable clues.
Detects downloads of the Huorong themed archive name reported in a ValleyRAT delivery chain.
This detection is designed to help you find activity related to COLDRIVER new ROBOT malware chain (NOROBOT/YESROBOT/MAYBEROBOT). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
Detects a phishing delivered JScript stage that spawns a hidden PowerShell instance (often via WMI Win32_Process.Create)
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
which decodes Base64 and fetches the next stage from URLs observed in the SANS ISC diary 32738. The chain is associated
with a malicious image download and a subsequent Remcos RAT payload.
Detects a Java process spawning a command shell to download a file using the certutil.exe utility. This behavior was observed in the exploitation of Apache ActiveMQ (CVE-2023-46604), where the threat actor used this technique to download a secondary payload.
Detects the Java process, commonly associated with Apache ActiveMQ, spawning certutil.exe to download a file from a remote URL. This behavior is a strong indicator of initial compromise via vulnerabilities like CVE-2023-46604.
Detects creation or modification of goon.zip, an attacker staging archive reported by Unit 42 in a Muddled Libra intrusion.
Detects script engines using common download or decoding primitives that frequently appear in staged malware delivery.
Detects PowerShell executing curl.exe to download a batch script (.bat or .cmd), consistent with the Dohdoor multi stage chain described by Cisco Talos.
This rule detects suspicious Spring bean XML content, specifically looking for indicators related to the exploitation of Apache ActiveMQ CVE-2023-46604. It targets XML payloads that attempt to execute commands using 'ProcessBuilder' and download files via 'certutil -urlcache' from an HTTP source, consistent with observed attack patterns.
Detects a PowerShell process initiating a network connection to download an image or text file from domains associated with a Remcos RAT campaign. In this campaign, PowerShell is used to download a steganographic image containing the next stage payload.
This rule detects attempts to download Android Application Package (APK) files directly to an endpoint. This activity is often associated with 'quishing' (QR code phishing) attacks, where users are tricked into scanning a malicious QR code that leads to a direct APK download, bypassing official app store security checks. The rule specifically looks for network connection success events where the remote URL or additional fields contain '.apk'.
Detects the execution of an executable from a subdirectory under %ProgramData% that matches the 'knz_' naming convention used by the MIMICRAT loader. MIMICRAT uses this directory to stage its Lua-based loader (zbuild.exe). The rule specifically looks for unsigned executables to reduce false positives.
Detects successful content injection leading to process execution
Detects the creation of files matching SHA256 hashes of known malware (SparkRAT, VShell, webshells) observed in the CVE-2026-1731 exploitation campaign. This rule specifically looks for file creation events where the SHA256 hash of the created file matches one of the predefined malware hashes.
Detects PowerShell one-liners used by TrustConnect/DocConnect to download and execute secondary payloads. These commands are provided as a 'Quick Deploy' feature in the MaaS C2 panel and typically use Invoke-RestMethod (irm) piped to Invoke-Expression (iex) from known malicious domains.
This detection identifies suspicious command-line pipelines commonly used in "ClickFix" attacks. It specifically searches for the use of 'curl' or 'wget' to download a payload that is immediately executed via a shell, often hidden within a subshell `$(...)` or piped directly to an interpreter. This "download and execute" pattern is a high-fidelity indicator of a successful ClickFix lure, where a user has been tricked into running a malicious command.
This detection identifies a command-line pattern characteristic of "ClickFix" attacks on macOS. It looks for a shell process (like zsh, bash, sh) that is spawned by a known terminal application and executes a command involving echoing a string, decoding it with 'base64 -D', and piping it into another shell for execution. This technique is used by adversaries to trick users into running malicious code, bypassing standard OS protections.
Detects PowerShell one-liners using Invoke-RestMethod (irm) or Invoke-WebRequest (iwr) piped to Invoke-Expression (iex) to download and execute the TrustConnect or DocConnect RAT.
This rule detects the creation of specific JSP web shell filenames (1.jsp, 401.jsp, 403.jsp) and suspicious CSS files in the Ivanti EPMM web application directory. This activity is indicative of post-exploitation persistence following the exploitation of vulnerabilities like CVE-2026-1281 or CVE-2026-1340.
Page 92 of 121