Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,123
15,646
12,594
8,402
6,230
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the execution of PowerShell commands associated with the ClickFix social engineering tactic. This involves downloading and executing remote payloads, often followed by creating a .lnk file in the Startup folder for persistence.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects ClickFix PowerShell payloads
This rule detects the creation or modification of executable files (.com, .exe, .scr, .pif, .bat, .cmd) in common user directories (Documents, Downloads, Desktop) where the initiating process is a legitimate application like explorer.exe, winrar.exe, or 7z.exe. This pattern is often used in phishing attacks where malicious executables are disguised as benign documents.
Detects user execution of malicious files downloaded via email link clicks
Detects a suspicious command line execution from explorer.exe involving syswow64\cmd.exe with specific variable substitution obfuscation patterns often associated with APT37's LNK-based NarwhalRAT delivery. The rule correlates this command execution with the subsequent launch of Python or userscreen.exe within a 5-minute window, a pattern indicative of second-stage payload delivery.
Detects potential malware execution chains characteristic of AMOS (Atomic macOS Stealer) and related 'ClickFix' campaigns. The rule monitors for the silent downloading of a disk image (.dmg) file to the /tmp directory using curl with quiet flags, followed immediately by the mounting of that image using hdiutil with the -nobrowse flag to bypass user notification and Gatekeeper security prompts.
Detects suspicious bash one-liners executed within macOS Terminal typically associated with the AMOS (Atomic macOS Stealer) 'ClickFix' campaign. The rule monitors for a sequence involving temporary file creation, downloading a disk image (DMG) from a known malicious domain ('svs-verificationdate.beer'), and silently attaching the DMG via hdiutil.
Detects the Montana Empire Android malware, either through a direct SHA256 hash match or through structural characteristics of the APK file (such as the presence of 'post.apk') combined with specific embedded strings commonly found in the attacker's fraudulent mobile landing pages used for social proof.
This rule monitors process creation events (Sysmon Event ID 1) to identify suspicious executables that masquerade as common software updaters (GoogleUpdateStepup, AnyConnect, AutoUpdate) or attempt to run the Windows SystemSettings.exe binary from non-standard directories. It further flags these instances when they are launched with specific command-line indicators such as cmd.exe or PDF file paths, which are common patterns for droppers or malicious execution chains.
Detects the SNOWLIGHT dropper executing or loading modules as 'wusvc.exe' (a common masquerading name) from a user Downloads directory. This behavior is indicative of a reconnaissance phase where the dropper attempts to resolve 'GetUserNameA' from 'advapi32.dll' to identify the current system user.
Detects network communication with known SNOWLIGHT dropper C2 infrastructure (IP 38.60.253.35, port 8084), as well as unauthorized network activity originating from the Windows Update service (wusvc.exe) and suspicious file execution of a known malicious hash associated with this activity.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
Detects the execution of `cmd.exe` with the `/c` argument to open a PDF file, originating from specific `AppData` subdirectories. This behavior is consistent with the SharkLoader dropper, often associated with the StrikeShark campaign, which uses decoy PDF documents to initiate its infection chain.
This rule detects the creation, modification, or renaming of files that are explicitly named after known security research projects, proof-of-concept exploits, or common testing artifacts (e.g., pedit_cow_demo, packet_edit_meme). These files are often associated with exploit development or security testing activities.
Detects the creation of executable or script files within the Windows Startup folder where the parent process is WinRAR.exe. This activity is a common indicator of an adversary leveraging a self-extracting archive or malicious file extraction to achieve persistence by placing a payload in the user's startup directory.
Correlates a spoofed internal email delivering an attachment that subsequently launches PowerShell on the endpoint. Specifically, it looks for emails where the sender's domain is 'yourcompany.com' but SPF authentication fails, and then links this to a device where 'powershell.exe' is executed with specific command-line arguments indicative of web requests or encoded commands.
Detects the creation of executable files (.exe, .com, .scr, .vbs, .js) that contain financial-themed keywords (e.g., GST, NEFT, RTGS, IMPS, Banking) in their filename. This pattern is commonly used in social engineering and phishing attacks to trick users into executing malicious payloads disguised as legitimate banking or financial documents.
Detects instances where common productivity applications (such as Microsoft Office suite, Outlook, or script engines like mshta/wscript) spawn PowerShell or PowerShell Core. The rule specifically looks for suspicious command line arguments often associated with malicious payloads, such as encoded commands, download instructions, or specific indicators related to Ptero-family malware.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command-line interpreters (PowerShell, CMD, WScript). This behavior is characteristic of malicious macros or exploitation attempts where Office applications execute shell commands to facilitate second-stage payload delivery or system compromise.
This rule detects when common document-handling applications (such as Microsoft Office suite or PDF readers) spawn known remote access and support tools. This behavior is highly indicative of vishing-based social engineering attacks, where a user is tricked into downloading and executing a remote management tool via a malicious document.
Page 58 of 86