Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
2,521 detections
Filters
Last updated
All Time
Detection languages
1,049
575
259
163
130
Contributors
536
485
323
178
133
Categories
1,256
974
852
701
406
Platforms
1,929
373
346
244
20
Products / Services
759
507
254
248
210
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
2,521
CVEs
7
5
4
4
4
IDS Classtypes
201
41
5
4
1
IDS Protocols
175
38
21
9
7
Detects PowerShell processes spawned by Visual Studio Code or Cursor IDEs that use suspicious flags like '-WindowStyle Hidden' and commands typical of download cradles. This behavior is associated with malicious extensions that execute second-stage payloads.
Detects network connections to known C2 servers and payload delivery URLs associated with a PureRAT campaign. This activity is linked to a Vietnamese threat actor using AI to generate their toolset.
Detects a Python process, potentially renamed, injecting code into the InstallUtil.exe utility. This behavior is a known TTP used by a Vietnamese threat actor in PureRAT campaigns, where a Python loader fetches a payload and injects it into a legitimate .NET utility to execute shellcode and evade defenses.
Detects network connections to known infrastructure associated with the EncystPHP web shell campaign. This IP (45.234.176.202) was observed distributing the 'c' and 'k.php' droppers.
Detects the execution of Node.js (node.exe) when spawned by PowerShell or the Command Prompt from a user-writable directory. This behavior is characteristic of the Tsundere Bot delivery chain used by threat actors like TA584 (Storm-0900), who use a PowerShell script to install and run the Node.js-based malware.
This rule detects attempts to establish persistence by modifying the 'RunMRU' registry key to execute malicious commands. It specifically looks for the presence of common scripting and download utilities (powershell, pwsh, mshta, certutil, bitsadmin, curl, wget) combined with indicators of remote execution or code download (http, iex, Invoke-Expression, DownloadString, iwr, Invoke-WebRequest) within the registry data.
Detects Remcos RAT payloads and commands
Detects the execution of PowerShell with command-line arguments containing keywords indicative of in-memory download and execution, such as '-enc' or '-EncodedCommand' used in conjunction with 'IEX' (Invoke-Expression) or 'DownloadString'. This pattern is a common TTP for initial access and second-stage payload delivery, and was observed in the exploitation of CVE-2025-55182 (React2Shell).
Detects execution of BADAUDIO malware downloader used by APT24
Detects the execution of a DLL that contains specific cryptographic function calls (SystemFunction036 or RtlGenRandom) and is launched by common DLL loading mechanisms (rundll32.exe, regsvr32.exe, or mshta.exe). This pattern is indicative of the BADAUDIO malware, a first-stage downloader used by APT24, which is known for using SystemFunction036 for cryptographic operations and being delivered as a DLL.
Detects file creation events for specific files downloaded by the Turla Kazuar v3 loader. The malware downloads a set of files into the %LOCALAPPDATA%\Programs\HP\Printer\Driver directory including hpbprndi.exe (a legitimate signed Hewlett-Packard printer driver installer used as a loader with SHA256: 34b7df7919dbbe031b5d802accb566ce6e91df4155b1858c3c81e4c003f1168c), hpbprndiLOC.dll (the actual Kazuar v3 loader DLL that implements COM-based.
Detects the use of PowerShell to download and/or expand a Python environment from the official python.org website. This technique has been observed in AsyncRAT campaigns to stage a legitimate interpreter for executing malicious Python code, bypassing defenses that might block known malicious executables.
Detects suspicious commands written to the Windows RunMRU registry key, which stores the history of commands executed via the Windows Run dialog (Win+R). This activity is often associated with the "ClickFix" social engineering technique, where users are tricked into pasting and running malicious commands. The rule identifies various suspicious indicators, including fake verification messages, PowerShell commands with obfuscation or download cradles, mshta, wscript, curl, wget, rundll32, bitsadmin, ssh proxy abuse, and obfuscated command line arguments.
This query detects when a user downloads a potentially malicious or unauthorized file type (e.g., executable, script, archive) from the internet using a web browser. It leverages endpoint file creation events from data mapped to the Elastic Common Schema (ECS).
Detects a multi-stage process execution chain characteristic of the 'ClickFix' technique. This involves 'explorer.exe' spawning a headless 'conhost.exe', which subsequently executes a Living Off the Land Binary (LOLBin) such as 'curl', 'pwsh', 'powershell', or 'mshta' to download a payload from an HTTP/HTTPS source. This chain indicates an attempt to bypass traditional security controls and execute malicious code.
Detects PowerShell making DNS requests for domains associated with less-reputable/uncommon TLDs. This behavior is not typical for legitimate administrative scripts and can indicate an attempt to download a payload from a malicious source.
This rule detects several suspicious activities often associated with post-exploitation and defense evasion. It identifies PowerShell commands used for recursively searching for msbuild.exe, tampering with Windows Defender settings (disabling real-time monitoring or adding exclusions), and downloading files from the internet to common temporary or application data directories. Additionally, it flags msbuild.exe executing suspicious .proj files from temporary directories, and any executable launched from temporary or program data folders by PowerShell or MSBuild. The rule also includes detection for persistence via .url file creation in the Startup folder and the dropping of specific suspicious files (.proj, pins.dat, staxs.exe, tybd7.exe) by PowerShell or MSBuild in temporary or program data directories.
Detects PowerShell processes using base64-encoded commands that establish outbound network connections within 5 minutes, indicating potential tool transfer or C2 activity. This rule correlates two base rules: one for base64-encoded PowerShell process creation and another for PowerShell network connections.
Detects PowerShell download cradles using Invoke-RestMethod or Invoke-WebRequest piped to Invoke-Expression for fileless malware execution.
Detects code.exe file creation in non-standard locations such as user home directories or temp folders, indicating potential staging of VS Code CLI for malicious purposes
This rule detects the use of bitsadmin to download specific Python scripts ('libsystemhealthcheck.py' or 'libcryptopydatasize.py') from the 'inspectguarantee.org' domain. This activity is associated with the COLDDRIVER (Star Blizzard) threat group, which uses BITSAdmin for ingress tool transfer.
Page 96 of 121