Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
258 detections
Filters
Last updated
All Time
Detection languages
114
59
26
14
14
Contributors
78
29
27
23
19
Categories
170
137
66
57
39
Platforms
207
22
19
9
2
Products / Services
97
54
31
25
11
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
CVEs
2
1
1
IDS Classtypes
5
1
IDS Protocols
6
Detects the execution of the Windows binary 'certutil.exe' using flags commonly abused by adversaries to download files from remote URLs or decode base64-encoded files. It excludes instances where certutil is executed by Microsoft-signed processes from the System32 directory to reduce false positives.
Detects the use of the built-in Windows utility 'certutil.exe' with arguments commonly used to download remote content (-urlcache -split -f) or decode base64 encoded files (-decode, -decodehex), when the output or operation occurs within temporary system directories such as Temp, AppData, or ProgramData, and the process is not signed by Microsoft.
Detects the iterative XOR decryption routine signature used to decode the Donut payload in memory prior to execution, specifically looking for large memory write operations initiated by 'setup.exe'.
Parses PowerShell command lines to identify scripts extracting PGP private key blocks from arbitrary files to decode nested stagers.
Detects the unique XOR decryption routine logic utilizing the actor's embedded Session messenger identifier as the key string. This rule specifically looks for file creation or modification events of '.pth' files, correlated with process command lines containing 'contact [alphanumeric] on session'.
Traces the behavior of Vidar resolving its Win32 APIs dynamically in memory using a byte-by-byte XOR reconstruction loop. This rule specifically looks for `WriteProcessMemoryApiCall` events where the target process is `RegAsm.exe` and the buffer size written is less than 256 bytes, which is indicative of small, dynamic code injection or modification often seen in malware unpacking or API resolution.
Hunts for PowerShell scripts natively importing cryptographic classes (AesManaged, CryptoStream) to decrypt secondary payloads directly in memory.
Maps the execution of a VBScript payload decrypting the subsequent stages using hardcoded arrays. This rule specifically looks for VBScript commands that use the 'Split' function in conjunction with 'ChrW', which is a common pattern for obfuscated VBScript decoding routines.
Detects execution of PowerShell spawned by script engines (wscript.exe, cscript.exe) using 'certutil -decode' to process files within the 'ProgramData' directory. This pattern is characteristic of the NUKESPED staging phase, often attributed to the Kimsuky threat actor, where obfuscated or encoded payloads are decoded into executable form using built-in system utilities.
Identifies the Python loader generating the decryption key using hashlib.sha512 over an embedded parameter.
Detects the creation or modification of 'endpointdlp.dll' and 'data.bin' files on disk, which are key indicators of the MLTBackdoor infection chain prior to DLL sideloading. This rule focuses on the initial staging of these malicious components.
Detects certutil abuse for payload download or base64 decode
This rule detects HTTP traffic where the URI contains the string "FromBase64String" (case-insensitive). This string is often associated with PowerShell or .NET code that decodes a Base64 encoded string, which can then be executed. This technique is commonly used by attackers for defense evasion to obfuscate malicious payloads.
This rule detects HTTP traffic where the URI contains both 'certutil' and '-decode' (case-insensitive). This pattern is indicative of an attacker using the Windows built-in 'certutil.exe' utility to decode a file downloaded via HTTP, often as part of a defense evasion or payload extraction technique. The 'flow:to_server,established' indicates that the detection is looking for this pattern in requests going from the internal network to an external server, suggesting a client-initiated download or interaction.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of the DPAPI cmdlet ConvertTo-SecureString alongside the HKCU:\Printers path. This technique binds the encryption to the active user session to hinder forensic analysis.
This rule detects the presence of an XOR decoding routine within a downloaded script. It specifically looks for the keywords "XOR" and "fromCharCode" (case-insensitive) in the file data of HTTP traffic flowing to the client. This combination is often used by malicious scripts to deobfuscate their payload.
Detects PowerShell script logic associated with GammaSteel's fileless registry staging encryption, specifically the use of ConvertTo-SecureString alongside the HKCU:\Printers path. This technique is used by Gamaredon to bind payload encryption to the active user session and hinder forensic analysis.
Detects the Deno runtime executing an in-memory script passed as a Base64-encoded Data URI, effectively bypassing disk monitoring. This technique is utilized by threat actors (e.g., DinDoor) to execute fileless malware payloads.
Detects PowerShell executing certutil.exe to decode base64 files, specifically when a hidden window style is used. This behavior is indicative of the JSE dropper routine employed by the Kimsuky threat group to decode malicious payloads to disk.
Darktrace researchers identified a Twill Typhoon–linked China‑nexus campaign targeting APJ customers. The activity observed includes CDN impersonation, legitimate binaries, and DLL sideloading to deploy a modular .NET RAT.
Detects the usage of certutil.exe to download files, or encode/decode data. This behavior is commonly associated with Living Off The Land Binaries (LOLBins) exploitation to bypass security controls.
Page 8 of 13