Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
258 detections
Filters
Last updated
All Time
Detection languages
114
59
26
14
14
Contributors
78
29
27
23
19
Categories
170
137
66
57
39
Platforms
207
22
19
9
2
Products / Services
97
54
31
25
11
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
Detects PowerShell command lines that perform suspicious string manipulation using the .Replace() method on specific obfuscated characters, followed by a Base64 decoding operation. This pattern is commonly used by attackers to reassemble and decode fragmented or obfuscated payloads on the fly to evade static analysis.
Detects the use of the Windows command shell 'copy' utility to concatenate separate files, such as 'header.doc' and 'body.doc', into an executable file named 'Windowsupdate.exe'. This technique is commonly used by adversaries to reassemble malicious payloads that were split to evade signature-based detection or bypass security controls.
Detects suspicious execution of the certutil.exe utility for file operations, specifically targeting the copying of certutil or the decoding of files with naming patterns (kid*.exe, kid*.tmp, kid*.bat) within the \Users\Public\Downloads\ directory. This pattern is commonly associated with file staging and deobfuscation of malicious payloads.
Detects the suspicious copying of the Windows certutil.exe binary to an alternate location (e.g., /Users/Public/Downloads/) followed by execution with decoding or caching flags. This behavior is indicative of an adversary attempting to use certutil as a LOLBin to decode or reassemble malicious payloads, a tactic frequently observed in Kimsuky-related LNK malware campaigns.
Detects PowerShell command execution containing specific strings associated with the Veil framework XOR decoding routine, including a hardcoded key and the use of the -bxor operator for payload deobfuscation.
Detects instances where wscript.exe spawns powershell.exe with command-line arguments indicative of stealth or obfuscation, such as hidden windows or encoded commands. This behavior is frequently associated with malicious script execution lures, such as JavaScript-based droppers or ClickFix-style campaigns that use PowerShell to stage and execute in-memory payloads.
Detects instances where wscript.exe spawns powershell.exe with command-line arguments indicative of stealth or obfuscation, such as hidden windows or encoded commands. This behavior is frequently associated with malicious script execution lures, such as JavaScript-based droppers or ClickFix-style campaigns that use PowerShell to stage and execute in-memory payloads.
Detects PowerShell command lines that simultaneously utilize .NET cryptography classes (TripleDES or AES) for decryption and runspace pipeline creation. This pattern indicates an in-memory execution technique where malicious payloads are decoded and executed directly within the PowerShell process, effectively bypassing disk-based security controls.
Detects PowerShell scripts attempting to evade detection through programmatic runtime creation using Runspaces (RunspaceFactory, CreatePipeline, AddScript) combined with cryptographic operations or dynamic string substitution techniques. This behavior is often associated with obfuscated malware payloads attempting to execute code in memory.
Detects the presence of a hardcoded X25519 public key associated with the 'indexed-btree' npm malware loader. This loader uses the key for ECDH key derivation to decrypt secondary payloads retrieved from an Ethereum smart contract, a technique used by malicious packages to hide their functionality.
Detects execution of PowerShell with a hidden window and base64-encoded command arguments that targets the file 'WindowsUpdate.log'. This pattern is associated with the CRPx0 (ClickFix) ransomware, where it attempts to drop or interact with a stager file disguised as a legitimate Windows update log file.
Detects the abuse of the Windows built-in utility 'certutil.exe' to download files or decode obfuscated payloads. Attackers frequently use certutil as a Living off the Land Binary (LOLBin) to bypass security controls by leveraging its native capabilities for file transfer (via URL cache) and base64 or hexadecimal decoding.
Detects the abuse of the legitimate Windows utility 'certutil.exe' to download files from external sources or to decode/deobfuscate files on the host, commonly used as a LOLBIN for malicious activities.
Detects the use of PowerShell commands that perform decryption (AES-256-CBC) and decompression (Gzip) of data, followed by the reflective loading of a .NET assembly into memory using [Reflection.Assembly]::Load. This behavior is indicative of fileless malware execution where a payload is hidden in an obfuscated or compressed format and unpacked at runtime.
Detects obfuscated PowerShell commands bypassing execution policy to download or execute 'configuration.ps1' or communicate with known malicious infrastructure associated with the ClickFix campaign. The rule specifically looks for caret-based obfuscation, bypass switches, and known IOCs in the command line.
This rule detects PowerShell script execution patterns indicative of the StealC 'ClickFix' infection chain. It specifically looks for the reflective loading of an obfuscated .NET assembly from memory, involving common .NET cryptographic and compression classes such as AesCryptoServiceProvider, GzipStream, and assembly loading methods like Assembly.Load. The rule uses markers and script length heuristics to identify payloads characteristic of this malware delivery technique.
This rule detects potentially malicious command execution patterns in Linux environments. It monitors for shell commands (bash, sh, echo, tee, cat) involving base64 decoding redirected to shell configuration files (e.g., .profile) or specific patterns involving 'gs-dbus' processes, which are often used by threat actors to decode obfuscated payloads or maintain persistence.
Detection of specific indicators associated with the GhostCode phishing kit, including scripts utilizing PBKDF2/AES-GCM for redirection decryption and a characteristic URL path pattern (/scanna/).
Detects the activity of the PIVOTPIPE .NET loader, which involves writing specific artifacts (core.pak, agent.json, pk.der, or sleepmask.o) to a temporary directory with the 'nb_' prefix or the creation of debug files containing strings associated with in-memory reflective loading of a remote access tool (RAT).
Detects HTTP traffic that contains an abnormal number of nested encoding layers, which is often used by attackers to evade network-based inspection signatures and WAF filters.
Detects suspicious command execution patterns commonly associated with ClickFix-style social engineering attacks. The rule identifies Terminal processes executing shell commands that retrieve remote content via curl, followed by base64 decoding and/or piping directly into a shell interpreter (zsh/sh/bash), which is a common technique for executing obfuscated malicious payloads.
Page 3 of 13