Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
258 detections
Filters
Last updated
All Time
Detection languages
114
59
26
14
14
Contributors
78
29
27
23
19
Categories
170
137
66
57
39
Platforms
207
22
19
9
2
Products / Services
97
54
31
25
11
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
Detects the execution of psql.exe to query the Veeam Backup & Replication PostgreSQL database for stored credentials. This pattern is associated with credential theft techniques utilized during ransomware operations (e.g., Bumblebee, Akira) where sensitive configuration or credential data is retrieved and potentially later decrypted via DPAPI.
Detects a PowerShell in-memory loader pattern that derives an AES key using Rfc2898DeriveBytes, decrypts an encrypted payload using System.Security.Cryptography.Aes, verifies the content with SHA256, and executes the decrypted code in-memory via [System.Management.Automation.ScriptBlock]::Create. This technique is often used to bypass file-based security controls by executing stage-two payloads directly in memory.
Detects the execution of JavaScript files using Windows Script Host (wscript.exe or cscript.exe) containing specific obfuscated patterns or indicators typically associated with malicious multi-stage dropper payloads. These patterns are indicative of obfuscated code attempting to evade static analysis and security controls during the initial execution phase.
Detects the use of PowerShell commands that leverage .NET AES cryptography with CBC mode to decrypt payloads in-memory, subsequently executing the resulting code directly via [System.Management.Automation.ScriptBlock]::Create. This technique is often used to bypass disk-based signature detection.
MacSync Stealer (formerly known as Mac.c) is a macOS information stealer offered as a Malware-as-a-Service (MaaS). On May 5, 2026, researchers identified a new C2 domain (jacksonvillemma[.]com) delivering the malware's Stage 2 loader. Notably, this new infrastructure was active just days after the operator's previous C2 domain was publicly exposed, highlighting the threat actor's agility in rotating their delivery architecture.
Detects the execution of JavaScript files using WScript or CScript that contain obfuscated 'eval()' calls, such as string concatenation (e.g., (0,this)["ev"+"al"]) or Unicode escaping. Adversaries often use these techniques to bypass signature-based detection for malicious script execution.
Detects an AI agent disclosing system-prompt or safety-policy content, or returning sandbox re-encrypted ciphertext-only output, immediately following a cryptographic-injection-style probe request in the same session — the safety-policy-bypass stage of Cryptographic Context Injection.
Detects C2Looper Rust-based backdoor by requiring at least 3 of 4 weak indicator categories: dynamic API resolution artifacts, v2 debug string, PE section layout, and Rust runtime strings; known hash is an optional fast-path only
Detects ad-hoc code-signing or quarantine-attribute removal on a binary delivered via the Screen Sharing file-copy channel or another network delivery within the preceding 30 minutes, indicating Gatekeeper-bypass preparation of a downloaded exploit tool.
Detects the hard-coded RC4 key fragment used by BTR.sys to decrypt its transaction structure when co-located within 0x4000 bytes of the FEE1DEAD magic value and Version 2 header field, targeting the encrypted transaction/ADS payload content independent of driver binary version.
Detects the execution of Python or Pythonw processes with command-line arguments that include base64 decoding followed by the exec() function. This pattern is commonly used by adversaries to execute obfuscated or encoded malicious code directly in memory to evade detection.
This rule detects the use of the Windows certutil.exe utility with flags commonly abused by adversaries for file downloads (-urlcache, -urlfetch) or file deobfuscation/decoding (-decode, -decodehex, -encode). It specifically targets LOLBIN (Living Off the Land Binary) behavior by monitoring process command line arguments, while providing allowances for common administrative tasks like PKI maintenance or CRL/OCSP updates to minimize false positives.
This rule detects potentially malicious activity leveraging the Windows Certutil utility for downloading, decoding, and executing files or payloads. It monitors process command line arguments to identify common download flags, hex/base64 decoding operations, evasion techniques, and interaction with high-risk file types or directories. The rule calculates a severity score based on the combination of these behaviors, such as downloading and decoding a file, or executing content from a temporary directory.
Detects an AI agent's code-execution sandbox decrypting attacker-supplied AES/PBKDF2 ciphertext immediately after fetching untrusted external content — the core trust-laundering mechanism behind Cryptographic Context Injection attacks.
Detects Abyssos RAT modules (DCFINDER, VULNSCAN, ELEVATE_SYS_TOKEN, RDPWRAP) by requiring a shared XOR/AES-CBC key alongside a temp-folder write using a module-specific short prefix (dcf, vul, plg, rdp) that is followed by execution via an anomalous export function name (abyss or the module-specific Get*Text/Json exports)
Detects dropper/staging scripts that curl-fetch a second-stage Mach-O payload to /tmp/helper or /tmp/update, chmod +x it immediately afterward in the same command sequence, ad-hoc/unsigned sign it, and strip quarantine attributes, while excluding scripts that verify a legitimate Developer ID signature
This rule detects potentially malicious command-line execution patterns often observed in 'ClickFix' or similar clipboard-based attack campaigns. It monitors for instances where standard Windows interpreters (PowerShell, cmd.exe, mshta.exe) are launched by legitimate shell processes (explorer.exe, rundll32.exe) and execute specific commands (like certutil for decoding) to process content found in suspicious or user-writable locations such as AppData or containing file extensions like .png (often used for steganography or file hiding).
KQL Query
Detects the execution of JavaScript files via Windows Script Host (wscript.exe or cscript.exe) where the command line contains an unusually long base64-encoded string. This pattern is often indicative of a dropper or loader script deobfuscating and executing a subsequent malicious payload in memory.
Detects the use of the Certutil utility to decode an encoded file (often obfuscated malicious code) followed by the execution of an MSI installer on the same device. This pattern is commonly used in multi-stage downloaders and installer-based attacks to reassemble or deobfuscate payload files.
This rule detects potentially malicious command-line execution patterns often observed in 'ClickFix' or similar clipboard-based attack campaigns. It monitors for instances where standard Windows interpreters (PowerShell, cmd.exe, mshta.exe) are launched by legitimate shell processes (explorer.exe, rundll32.exe) and execute specific commands (like certutil for decoding) to process content found in suspicious or user-writable locations such as AppData or containing file extensions like .png (often used for steganography or file hiding).
Page 4 of 13