Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
This rule detects network connections to domains known to host and distribute malicious file converter applications that install Remote Access Trojans (RATs).
This rule detects potential malware execution and persistence by correlating suspicious script and HTA activity with known malicious infrastructure. It flags mshta, wscript, and cscript executing remote HTA or script content, related network connections and downloads, temporary file artefacts, connections to listed suspicious domains and IPs, attempts to add Windows Defender exclusions, and fake browser update style process launches that retrieve executables over HTTP.
Detects Bash /dev/tcp with HTTP request construction - high fidelity detection for payload download via raw sockets
Detects network traffic indicative of the Diaoyu Loader downloading second-stage payloads from GitHub. The loader masquerades these payloads as image files within a WordPress-like directory structure.
This rule detects when 'explorer.exe' spawns PowerShell, and the PowerShell command line contains indicators of network communication for downloading content. Specifically, it looks for HTTP/HTTPS URLs or common PowerShell cmdlets and aliases used for web requests and file downloads (e.g., 'iwr', 'Invoke-WebRequest', 'wget', 'curl', 'DownloadString', 'DownloadFile', 'WebClient', 'Net.WebClient', 'BitsTransfer', 'Start-BitsTransfer', 'Invoke-RestMethod'). This behavior can indicate the execution of a download cradle, often used in initial access or command and control phases to retrieve additional malicious payloads.
Detects the execution of a command shell by the Java Runtime to run a batch file from a typical malware staging directory. This behavior is a core TTP of the Stan Ghouls group, used to execute their malicious Java-based loaders which in turn drop and run the NetSupport RAT.
Detects a command line pattern where `curl` is used to download a payload, which is then piped to `base64` for decoding and `gunzip` for decompression. This technique is commonly used by macOS infostealers like DigitStealer and MacSync to execute malware in memory without writing it to disk.
This rule detects activity associated with the Chrysalis backdoor used by the Lotus Blossom threat group. It correlates multiple high-confidence indicators to identify potential compromise.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
The detection focuses on three key behaviours:
Known malicious artifacts
File and process activity where the SHA256 hash matches confirmed Chrysalis malware samples.
Malicious network communications
Outbound connections to known Chrysalis command-and-control IP addresses or domains.
Suspicious svchost execution
Execution of svchost.exe from non-standard Windows directories, combined with unusual command-line arguments such as -nostdlib and -run, strongly suggests masquerading or malicious payload execution.
Detects the execution of a command shell by the Java Runtime to run a batch file from a typical malware staging directory. This behavior is a core TTP of the Stan Ghouls group, used to execute their malicious Java-based loaders which in turn drop and run the NetSupport RAT.
Detects PowerShell or Batch scripts attempting to download files from known malicious C2 domains (darkgptprivate.com, getintwopc.site). This activity is a fallback mechanism associated with the 'OpenClaw Agent' malware campaign
Detects the legitimate Notepad++ updater process (GUP.exe) spawning suspicious child processes. This behavior was observed during the Notepad++ supply chain attack where the updater was used to launch malicious payloads. The rule specifically looks for GUP.exe as the parent process and child processes with filenames like 'update.exe', 'install.exe', 'AutoUpdater.exe', 'curl.exe', or 'cmd.exe'.
Detects Microsoft Office applications establishing outbound network connections to non-private, non-Microsoft IP addresses. This behavior can be indicative of exploitation of vulnerabilities like CVE-2026-21509, where an embedded OLE object or malicious macro attempts to download a payload or beacon out.
This rule detects post-exploitation activities originating from the `telnetd` process, specifically targeting scenarios following an Inetutils Telnetd authentication bypass. It identifies three main categories of malicious activity: reconnaissance, SSH key injection for persistence, and malware deployment. Reconnaissance activities are detected by commands like `uname -a`, `id`, `cat /proc/cpuinfo`, or `cat /etc/passwd` executed via common shells (`/bin/sh`, `/bin/bash`, `/bin/ash`). SSH key injection is identified by `echo` commands attempting to write SSH public keys (e.g., `ssh-rsa`, `ssh-ed25519`) into `~/.ssh/authorized_keys` or `/root/.ssh/authorized_keys`. Malware deployment is detected by `nohup` commands executing `curl` or `wget` to download and pipe content to interpreters like `python`, `python3`, `sh`, or `bash`.
Detects network connections from the Notepad++ updater process (gup.exe) to domains that are not part of the official update infrastructure. The primary attack vector for this threat involves intercepting GUP traffic to redirect downloads to malicious third-party servers.
Detects the Notepad++ updater (gup.exe) spawning suspicious child processes such as shells or network tools. Legitimate updates should only spawn explorer.exe or the Notepad++ installer itself. This behavior has been observed in targeted attacks where the update process is hijacked to deliver malware and facilitate hands-on-keyboard activity.
Detects exploitation attempts and worm-like scanning behavior targeting Next.js applications, characteristic of the EtherRAT malware. The rule identifies web requests with the 'x-middleware-subrequest' header (CVE-2025-29927) or scanning of sensitive paths like '/_next/data/' from internal sources.
Detects the anomalous execution of Node.js from non-standard, user-writable directories or when spawned by a shell process. This behavior is indicative of the Tsundere Bot backdoor, often used by TA584. The rule specifically looks for node.exe running from common user-writable or temporary directories (AppData\Local, Users\Public, Temp) or when initiated by command-line shells like powershell.exe or cmd.exe.
Detects when a potentially malicious file (such as a macro-enabled document, executable, or script) is created within a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious files in these locations to ensure they are opened by the user without security warnings (like Protected View or macro-blocking), facilitating code execution. This rule correlates file creation events with trusted paths dynamically enumerated from the device's registry.
Detects the use of the finger.exe utility to download remote data and pipe it directly into a command interpreter for execution. This LOLBin technique is used by threat actors like KongTuke to download and execute subsequent stages.
Detects network connections initiated by Microsoft Office applications that may indicate CVE-2026-21509 exploitation. The Shell.Explorer.1 embedded browser component can establish outbound connections to attacker-controlled servers without user awareness. This rule monitors for Office processes making HTTP/HTTPS connections, especially to non-Microsoft and non-CDN destinations.
Detects when a potentially malicious file (such as a macro-enabled document, executable, or script) is created within a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious files in these locations to ensure they are opened by the user without security warnings (like Protected View or macro-blocking), facilitating code execution. This rule correlates file creation events with trusted paths dynamically enumerated from the device's registry.
Page 95 of 121