Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,119
15,639
12,589
8,399
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
This rule detects the creation of an SVG file in common user-writable/temporary directories, followed closely (within 60 seconds) by the execution of common scripting interpreters (cmd.exe, powershell.exe, wscript.exe) by a web browser. This behavior is often associated with browser-based exploitation or malicious file downloads where an attacker uses an SVG or accompanying file to trigger secondary malicious processes.
Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.
Detects the creation of multiple executable files (.exe or .dll) within a 6-hour window in non-standard directories (outside of Windows or Program Files). The rule identifies scenarios where a single filename has three or more distinct SHA256 hashes associated with it on a specific device, which may indicate iterative malware delivery, obfuscation techniques, or persistence mechanism testing.
This rule detects executable files being created or launched within the 'AppData\Local\Programs' directory by a temporary-stage process. This behavior is often indicative of malware attempting to establish persistence or execute from a user-specific location, leveraging temporary directories for initial execution or staging.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
This rule detects the creation of an SVG file in common user-writable/temporary directories, followed closely (within 60 seconds) by the execution of common scripting interpreters (cmd.exe, powershell.exe, wscript.exe) by a web browser. This behavior is often associated with browser-based exploitation or malicious file downloads where an attacker uses an SVG or accompanying file to trigger secondary malicious processes.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
Detects the execution of VBScript (wscript.exe or cscript.exe) where the command line contains strings indicative of known malware families such as Xworm, Remcos, DarkCloud, Phantom, Masslogger, or Agent Tesla. This rule aims to identify potential phishing attempts or initial access vectors leveraging VBScript for malware delivery.
Infostealer distributed via fake open-source tool impersonation sites
Lightweight remote access trojan deployed in recruiter-themed social engineering
ClickFix style social engineering cluster delivering Mistic and ModeloRAT
This rule detects the creation or execution of files named 'winupdate.exe' and specific patterns of Python script execution within user-writable 'AppData' subdirectories, specifically targeting the '.cache' folder. This behavior is indicative of potential malware staging or execution, often associated with obfuscated payloads or unauthorized software running in non-standard user locations.
Detects unauthorized ISO or virtual disk mounting activity combined with the creation of a working directory using the 'RP_' prefix under the system temporary folder. This pattern is indicative of the RoguePlanet exploit staging process, which often uses NTFS junction redirection to bypass security controls like Windows Defender quarantine.
Detects network connections from suspicious process paths (e.g., AppData, Temp, Downloads) or processes/command-lines associated with Roblox-related game executors (e.g., Solara, Yuta) to DeepSeek domains. This rule helps identify potentially malicious tools or scripts attempting to communicate with external infrastructure often used by such utilities.
Detects DLL sideloading and suspicious executable execution patterns associated with Obsidian Sandstorm's recruitment-themed spearphishing campaigns. The rule monitors for unsigned or untrusted DLLs loaded by processes in user-writable directories, and the execution of binaries directly from extracted archive paths containing recruitment-related keywords (e.g., job, resume, payroll).
Detects malicious artifacts and behaviors associated with TA4922 (Atlas RAT, SilentRunLoader, RomulusLoader), including known malicious file hashes, DLL sideloading patterns masquerading as legitimate graphics libraries, and unauthorized execution of Python interpreters from user-writable directories.
Detects execution of QEMU binaries (e.g., qemu-system-x86_64.exe) that exhibit suspicious characteristics, including command-line references to disk images or databases, execution from user-writable directories (Temp, AppData, etc.), or spawning from unusual parent processes like script interpreters or remote access tools.
Commodity .NET keylogger and remote access trojan
Detects Microsoft Outlook spawning a command-line interpreter (cmd.exe or powershell.exe) followed by a network connection originating from that interpreter within a 5-minute window. This behavior is highly suspicious and often indicative of malicious macro execution or exploit delivery via email attachments leading to command-and-control activity.
Detects exploitation of CVE-2025-8088, where WinRAR writes a nested .vbs payload directly to the Startup folder via NTFS ADS path traversal.
Detects execution of winget.exe with configuration arguments pointing to external or potentially suspicious file extensions like .jpg or .txt. This behavior is indicative of an adversary attempting to execute arbitrary code or scripts masquerading as configuration files, leveraging the Windows Package Manager 'configure' functionality to bypass security controls or execute malicious payloads.
Page 59 of 86