Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This rule detects attempts to download the 'clawd.bot' or 'openclaw.ai' installation scripts using various command-line tools. It specifically looks for the use of 'curl', 'wget', 'aria2c', 'fetch', 'powershell', 'pwsh', 'certutil', 'bitsadmin', or 'mshta' when their command lines contain either 'clawd.bot/install.sh' or 'openclaw.ai/install.sh'. This activity is indicative of potential malware deployment or initial access attempts related to the OpenClaw/Clawd threat.
FileFix is a sophisticated social engineering attack, emerging in mid-2025, that abuses the Windows File Explorer address bar to execute malicious PowerShell commands. It is an evolution of the "ClickFix" technique, shifting from the Run dialog (Win+R) to the Explorer address bar (Ctrl+L).
Detects msiexec.exe executing with /i to install an MSI package from a remote HTTP/HTTPS domain, excluding internal RFC1918 networks, loopback, and APIPA addresses. This pattern is commonly used for remote payload installation and malware staging over the web.
This rule detects suspicious process creation events where `explorer.exe` (Windows Explorer) launches various scripting or utility executables (`powershell.exe`, `cmd.exe`, `wscript.exe`, `mshta.exe`, `rundll32.exe`, `regsvr32.exe`, `installutil.exe`, `wmic.exe`, `certutil.exe`, `msdt.exe`). The detection is specifically triggered when the command line of the launched process contains indicators of network communication (e.g., `http://`, `https://`, `iwr`, `invoke-webrequest`, `curl`, `wget`, `bitsadmin`, `downloadstring`, `downloadfile`), encoded commands (`-e` or `-encodedcommand` with base64-like strings), or UNC paths (`\\`). It also specifically looks for `certutil` being used with `-urlcache`, `-decode`, or `-f` flags. The rule includes exclusions for common legitimate activities such as downloads from `chocolatey.org`, `nuget.org`, `aka.ms`, `cmd.exe` launching a browser to a URL, and `certutil -hashfile` operations.
Detects PowerShell downloading XWorm V6 binary from github.com, spawned by wscript.exe
This rule detects the execution of specific download utilities (curl, wget, aria2c, fetch, PowerShell, certutil, bitsadmin, mshta) attempting to download 'install.sh' from either 'clawd.bot' or 'openclaw.ai'. This activity is indicative of potential malware or unauthorized script downloads, possibly bypassing network security controls.
Detects suspicious web requests to the Tomcat Manager on Dell RecoverPoint appliances. This technique is used by UNC6201 to exploit CVE-2026-22769 and upload malicious WAR files.
Detects the creation of JSP web shells or suspicious CSS files in the specific directory used by Ivanti EPMM for application distribution, a common post-exploitation step observed in this campaign.
Detects the execution of 'cmd.exe' initiated by common Microsoft Office applications, scripting engines, or msiexec.exe, where the command line includes 'curl' for downloading a '.pdf' file and also attempts to delete files using 'del /s /q'. This behavior is often associated with initial access, download of malicious payloads, and cleanup activities by adversaries. The rule specifically looks for command lines that interact with 'Users\Public', 'conhost.exe', or use the '--headless' flag, which can indicate automated or background execution.
Detects the creation of specific .sys files in the C:\Windows\System32\drivers\ directory. These filenames are used by the BADIIS malware installer to stage malicious DLLs before they are moved to other locations for execution.
This rule detects HTTP requests for 'install.sh' from the domains 'clawd.bot' or 'openclaw.ai'. These domains are associated with the OpenClaw/Clawd malware, indicating an attempt to download a malicious installation script.
This rule set detects attempts to download an 'install.sh' script from the domains 'clawd.bot' or 'openclaw.ai' using various methods. The first rule, 'openclaw_curl_install_script', specifically targets command-line tools like curl, wget, aria2c, and fetch. The 'openclaw_powershell_download' rule focuses on PowerShell commands (Invoke-WebRequest, iwr, Invoke-RestMethod, irm) used for downloading. The 'openclaw_aria2c_fetch_download' rule is redundant with the first rule, as it also targets aria2c and fetch. The 'openclaw_lolbin_download' rule identifies the use of Living Off The Land Binaries (LOLBins) such as certutil, bitsadmin, and mshta for the same download activity. Finally, the 'openclaw_http_install_sh' rule detects direct HTTP network requests to the 'install.sh' path on these domains. Collectively, these rules aim to identify potential initial access or execution attempts involving a suspicious installation script from specific domains.
This rule detects the execution of a bash or sh script that contains multiple identifiers related to OpenClaw installation. It specifically looks for command lines ending with '/bash' or '/sh' and containing 'openclaw', combined with additional OpenClaw-specific strings such as 'run_remote_bash', 'OPENCLAW_INSTALL_SH_NO_RUN', 'OPENCLAW_USE_GUM', 'All your chats, one OpenClaw', '.openclaw/openclaw.json', or 'openclaw.ai/install.sh'. This content-based detection aims to identify OpenClaw install script execution even if the script is renamed.
This rule detects suspicious Python command-line executions that attempt to import the 'requests' library, use 'exec()', and make HTTP/HTTPS requests. This pattern is commonly observed in malicious Python scripts used for command and control, data exfiltration, or downloading additional payloads.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects Notepad.exe initiating outbound network connections, specifically over SMB (port 445) or to public IP addresses over HTTP/S. This behavior is highly anomalous and can indicate an attempt to exploit CVE-2026-20841 to trigger an NTLM relay attack for credential harvesting or to download a remote payload.
Identifies Node.js or Python processes attempting to download configuration-like files (e.g., .env, .env.example) from GitHub's raw content domain. This pattern is characteristic of the second-stage payload delivery in the Lazarus Group's Graphalgo campaign.
This rule alerts on outbound network activity initiated by gup.exe where the destination URL is not associated with expected Notepad++ update endpoints.
Detects a sequence of events associated with a malicious Notepad++ update. This malicious process executes reconnaissance commands.
Detects the use of curl.exe to upload data to the temp.sh file-sharing service. This technique has been observed in post-compromise reconnaissance activities, including those following Notepad++ compromises.
Page 93 of 121