Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects the creation of potentially suspicious files by OpenEDR's ITSMService process.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.
The ITSMService is responsible for remote management operations and can create files on the system through the Process Explorer or file management features.
While legitimate for IT operations, creation of executable or script files could indicate unauthorized file uploads, data staging, or malicious file deployment.
This rule detects network connections to domains and IP addresses associated with the malicious OpenClawCLI campaign, which uses social engineering to trick users into running obfuscated commands.
This rule correlates multiple indicators of compromise (IOCs) across file, network, and process events to detect potential advanced persistent threats (APTs) or sophisticated malware. It looks for specific file paths associated with tools like Lightshot, ScreenConnect, or suspicious VS Code extensions, combined with network connections to known malicious domains/IPs or unusual ports, and the execution of suspicious processes like 'Code.exe' outside of its legitimate VS Code path or 'ScreenConnect' related executables. A high threat score is assigned if multiple types of these indicators are observed on the same device and account within a 30-day window.
Detects the SolarWinds Web Help Desk service process (java.exe) launching shell or installer processes to download payloads from suspicious domains. This behavior is consistent with the exploitation of CVE-2025-26399 as reported by Huntress.
This detection identifies potential abuse of the Windows Package Manager (winget.exe) for malicious activities, including arbitrary command execution, execution from temporary directories, suspicious network egress, and installation of unsigned binaries from non-admin accounts.
PowerShell (parent explorer) launches WScript with minimized window and Invoke-WebRequest. Lampion campaign pattern per Microsoft blog.
Detects curl or wget execution where an HTTP/HTTPS URL points directly to a dot-quad IPv4 address or a hex-encoded IPv4 address, excluding RFC1918 private ranges, APIPA, and local loopback. Threat actors commonly use raw or hex IP literals to bypass domain-based filtering and download staged payloads.
Detects network connections to the Microsoft Graph API (graph.microsoft.com) from processes that are not common Microsoft Office applications. Threat actors, such as those behind the FINALDRAFT malware, have been observed using the Graph API for covert command and control (C2) communications, often by manipulating email drafts to send and receive commands. This allows them to blend their traffic with legitimate enterprise activity.
This rule detects the execution of msiexec.exe from cmd.exe with command-line arguments indicating a silent installation of a remote MSI package over HTTP or HTTPS. This behavior is indicative of post-exploitation activity, specifically observed in the context of SolarWinds Web Help Desk (WHD) exploitation where attackers use msiexec to download and install malicious payloads.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key Living Off The Land Binary (LoLBin) technique used in the CrashFix campaign. The detection specifically looks for 'ct.exe' in the command line, the unique 'confirm@' argument indicating a C2 address, and the piping of output to 'cmd' often launched via 'start'.
Detects the abuse of the Windows 'finger.exe' utility to download and execute commands, a technique observed in the CrashFix campaign. The rule looks for finger.exe (or its renamed variant 'ct.exe') piping output to cmd.exe.
Detects high-risk command execution (e.g., curl, wget, ssh) originating from AI agent runtime processes like OpenClaw/ClawdBot. This behavior is associated with threat actors using backdoored 'skills' to exfiltrate data or move laterally.
Let's create a detection rule for "XONER dropper (multi-key
download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips,
xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner
xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips,
xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner
xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
Let's create a detection rule for "XONER dropper (multi-key download/execution)" based on xoner.sh. The key IOCs are as follows:
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
- C2/Hosting: 165.232.165.152:8080
- Download path (pattern): /xoner_* (e.g., xoner_armv7l, xoner_mips, xoner_x86_64, etc.)
- Drop file name: xoner
- Action: Save to /tmp, /dev/shm, or /var/run → chmod 777 xoner → ./xoner xoner & execute → Delete file
Reported by Team_D4rkn3ttz
Detected by @bishop0218
This rule detects file and network indicators of compromise (IOCs) associated with the fake 'ClawdBot Agent' VS Code extension malware campaign. It looks for known malicious file hashes and network connections to C2 infrastructure, including specific C2 checks for ScreenConnect relay on port 8041.
Detects the PowerShell download cradle used by the Marco Stealer malware.
Detects attempts to deliver a Base64-encoded Java class to an Ivanti EPMM
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
server. This is characteristic of the "Sleeper Shell" campaign where attackers
plant a dormant in-memory backdoor. The rule looks for the Base64 string
'yv66vg', which corresponds to the 'CAFEBABE' Java magic bytes, in requests
targeting the known vulnerable path.
Detection content for the Notepad++ supply-chain compromise and the Chrysalis backdoor, attributed to Lotus Blossom. Detection rules use KQL only.
Detects PowerShell download cradles that use commands like Invoke-RestMethod, Invoke-WebRequest, iwr, irm, curl, wget, Net.WebClient, DownloadString, DownloadData, or Start-BitsTransfer to download content, immediately followed by execution via Invoke-Expression or IEX. This technique is often used for fileless malware execution.
Detects the abuse of finger.exe as a download cradle, a technique used by the CrashFix campaign. This involves cmd.exe launching finger.exe (or a renamed copy) to retrieve a payload from a remote server and pipe it directly into cmd.exe for execution.
This query utilizes the IOCs provided by Rapid7 and focuses on columns in the DeviceFileEvents, DeviceProcessEvents and DeviceNetworkEvents tables. This is a high FP query, however each event will require an investigation to its legitimacy. The query accounts for all devices that have installed notepad++ in the past 400d and only looking for IOCs within time of known compromise in order to save on resources. Some IOCs are commented out due to high FP rate.
Page 94 of 121