Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
This rule detects the execution of potential trojanized ManageEngine OpManager MSI installer files (ManageEngine-OpManager.msi or opmanager.msi) by msiexec.exe when initiated by processes other than standard system binaries like explorer.exe, svchost.exe, or msiexec.exe itself. This behavior is indicative of an attacker attempting to execute a malicious installer package, which may be part of a supply chain compromise or an attempt to install a malicious payload masquerading as legitimate software.
This rule detects the execution of potential trojanized ManageEngine OpManager MSI installer files (ManageEngine-OpManager.msi or opmanager.msi) by msiexec.exe when initiated by processes other than standard system binaries like explorer.exe, svchost.exe, or msiexec.exe itself. This behavior is indicative of an attacker attempting to execute a malicious installer package, which may be part of a supply chain compromise or an attempt to install a malicious payload masquerading as legitimate software.
Detects the execution of known Gamaredon (Shuckworm/ACTINIUM) VBScript-based payloads, including PteroVDoor, PteroPSDoor, PteroPaste, PteroDee, and PteroCache, executed via wscript.exe or cscript.exe. It also monitors for suspicious child process spawning behavior where these scripts or WinRAR launch mshta.exe, which is a common pattern observed in Gamaredon staging and lateral movement activities.
Detects the execution of mshta.exe from common initial access vectors like document viewers (WinRAR), web browsers (Outlook, Thunderbird), or the Windows Shell (explorer.exe). Additionally, detects instances where mshta.exe subsequently spawns wscript.exe or cscript.exe, which is indicative of a multi-stage script execution chain often used to execute malicious payloads.
This rule detects when Microsoft Office applications (Word, Excel, Equation Editor, PowerPoint) spawn common LOLBAS processes such as mshta, wscript, cscript, powershell, or cmd. It includes additional filtering for command-line arguments containing indicators of HTA or RTF exploitation patterns, which are typical of malicious Office documents attempting to execute secondary payloads.
Detects the creation of archive files (ZIP, RAR, 7Z) or executables with specific naming conventions (GST_, Debit_, Invoice_, NEFT_, RTGS_) often associated with Remcos RAT loaders. This rule focuses on the initial file creation event on a device.
Detects indicators of abuse involving remote monitoring and management (RMM) tools like AnyDesk and N-able. The rule identifies suspicious LNK files masquerading as software configuration, configuration files placed in non-standard locations, the addition of RMM components to Windows Registry run keys, and the execution of RMM agents with silent flags, all of which are common tactics for establishing persistence and unauthorized remote access.
This rule detects multiple indicators associated with the deployment of unauthorized or malicious Remote Monitoring and Management (RMM) tools, specifically focusing on impersonated shortcut files, suspicious command-line execution patterns, registry-based persistence mechanisms, and the presence of configuration files for remote access software like AnyDesk.
This rule monitors for processes that start after a delay (between 30 and 600 seconds) following the launch of common web browsers (Chrome, Edge) or PDF readers (Acrobat, Foxit). The rule excludes common background processes associated with these applications, focusing on potential delayed execution of malicious payloads or secondary stage activity after a user has opened a document or navigated a malicious site.
This rule detects the creation of synchronization objects with names matching specific patterns often associated with malicious setups or obfuscated file naming conventions. It joins these object creation events with process rollup data to provide context on the originating process, including command line arguments and file paths.
Detects instances where common PDF reader applications (Adobe Acrobat, Foxit Reader) spawn a web browser or command interpreter process with an HTTP/HTTPS URL in the command line. This behavior is highly indicative of a user interacting with a malicious link or call-to-action embedded within a PDF document, frequently associated with credential harvesting phishing campaigns.
Detects instances where common video conferencing and collaboration applications (such as Microsoft Teams, Zoom, Webex, or Slack) initiate a command shell (cmd.exe, powershell.exe, or wscript.exe). This behavior is often indicative of social engineering or phishing attacks where an adversary executes malicious code via a meeting invite or chat message.
Detects the use of the Tiny C Compiler (TCC) to compile or execute shellcode associated with BeepRAT malware. The rule monitors for characteristic TCC command line arguments ('-nostdlib', '-run') and specific file names ('temp.bin', 'config.ini.c') within the TCC deployment path that are indicative of staging and executing malicious code while attempting to bypass defensive mechanisms like AMSI, ETW, and WLDP.
Detects instances where the 7z.exe process launches an executable or script file, often indicative of an adversary bypassing Mark-of-the-Web (MotW) protections by manually extracting malicious payloads from a downloaded archive.
This rule detects suspicious usage of Windows Script Host (wscript.exe or cscript.exe) by monitoring for the execution of VBScript files containing keyword-heavy command lines related to common phishing themes (e.g., 'Invoice', 'Payment', 'Urgent'). It flags when a specific device executes three or more such scripts within a one-hour window, which is indicative of potential bulk file processing or automated malicious activity typical of dropper or downloader malware.
Detects multiple executions of WScript.exe or CScript.exe within a single hour on the same device where the command line arguments contain document-related keywords such as Invoice, Bill, or Payment, and the file extension ends in .vbs or .vbe. This pattern often indicates mass execution of malicious scripts often delivered via email attachments or phishing lures.
Identifies self-extracting archives (SFX) natively dropping the initial VBS payload into temporary paths.
Detects the execution of financial-themed executable files (masquerading as .com or .scr) that are launched directly from common email client processes. This rule aims to identify phishing attempts where users are tricked into opening malicious attachments disguised with financial keywords.
This rule detects the execution of a user-mode EDR Killer executable from common temporary or public directories (Temp or Public) immediately preceding the creation of a known ransomware or payload file (executable, MSI, batch, or PowerShell script). The detection logic looks for process command lines containing keywords like '-kill', '-bypass', or '-edr' for the EDR Killer, followed by a file creation event within a 5-minute window on the same device.
Detects anomalous child process creation or .lnk file interaction by the LunarClient process. This rule monitors for indicators of potential supply chain compromise or malicious activity where the gaming client spawns shells, scripting interpreters, or network utilities, or generates shortcut files to facilitate further execution.
This rule detects multiple stages of activity associated with BaqiyatLock ransomware and Remcos RAT. It identifies the execution of known BaqiyatLock/Remcos files, attempts to bypass User Account Control (UAC) via ms-settings registry hijack, creation of files with the '.bqtlock' extension indicative of BaqiyatLock encryption, and network communication with 'icanhazip.com' for external IP discovery, which is a common reconnaissance step.
Page 61 of 86