Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the execution of Microsoft Edge via the command shell to open a PDF file. This pattern can be indicative of malicious activity where an attacker attempts to bypass direct execution or leverage a browser vulnerability to open a malicious PDF.
Detects a sequence of events where PowerShell is used to download files from 'nvidiadriver.net' or with filenames containing 'winPatch', followed by a suspicious file drop (specifically 'winPatch.zip' or 'update.vbs') in a temporary directory within a 30-minute window. This behavior is indicative of potential initial staging for a RAT or malicious script deployment.
Detects a multi-stage activity chain associated with BumbleBee malware. The rule correlates the execution of an MSI installer from user-writable directories (e.g., Downloads, Temp) with the creation of a 'msimg32.dll' file in a non-System32 directory, followed by the loading of this suspicious DLL into the 'consent.exe' process. This pattern is characteristic of BumbleBee's DLL sideloading execution technique.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
This rule detects the creation of executable or script files within common user-writable directories (Downloads, Desktop, Documents, Temp) when the file writer process is identified as '7z.exe'. This behavior is common in download-and-execute attack chains where an archive is extracted to place malicious payloads on the system.
Detects instances of ImageMagick utilities (magick.exe, convert.exe, mogrify.exe, identify.exe) spawning Ghostscript executables (gswin64c.exe, gs.exe, gswin32c.exe) from non-standard file paths or using specific command-line arguments often associated with exploitation attempts (such as -dSAFER or -dQUIET). This activity is consistent with attempts to exploit vulnerabilities like CVE-2023-34151 or similar ImageTragick-style attacks where ImageMagick is abused to execute arbitrary code via Ghostscript delegates.
Detects artifacts and execution patterns associated with the Grandoreiro banking trojan. This includes the identification of known Embarcadero Delphi DLLs (mingwm10.dll, libwebp.dll, libffi-6.dll, libpng15.dll) being dropped into or loaded from AppData local directories, as well as wscript.exe or cscript.exe spawning suspicious executables from the same path, which is consistent with its VBS dropper chain.
Detects instances where the OpenVPN Connect client (OpenVPNConnect.exe or openvpn.exe) spawns unexpected child processes. This behavior is indicative of an exploit targeting the OpenVPN Connect 'echo' script ACE vulnerability, where a malicious VPN server pushes configuration directives (e.g., script.win.user.disconnect) that trigger arbitrary command execution on the client, potentially bypassing script permissions.
Detects unexpected child process execution spawned by the Lunar Client Electron main process. This rule is designed to identify potential exploitation attempts, such as the lunar-modrinth-chain exploit, where malicious files (e.g., .mrpack entries) could lead to arbitrary code execution via shell.openExternal calls.
This rule monitors file creation events for RAR archives containing specific keywords in the filename related to military, intelligence, or drone-related topics in Ukrainian. It also flags specific file hashes associated with malicious activity. The rule is designed to detect the delivery or presence of targeted spearphishing attachments or documents used for information gathering or exploitation.
Detects a user mounting a deceptive .dmg file (e.g., posing as a crypto wallet or developer tool) resulting in the immediate execution of a hidden binary. The rule specifically looks for 'hdiutil attach' followed by a process execution from within a mounted volume that matches a common application or shell script path.
Detects WinRAR (winrar.exe) creating shortcut (.lnk) files within the Windows Startup directory or staging suspicious files within specific ProgramData directories. This behavior is indicative of potential persistence mechanisms or malicious staging of secondary payloads by WinRAR.
Detects the creation of files within Windows startup folders originating from a WinRAR process. This behavior is indicative of an adversary using WinRAR to extract or drop malicious persistence items, such as shortcuts (.lnk) or executables, into auto-start locations to maintain persistence across reboots.
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Detects host-based activity related to known UAC-0226 campaign artifacts, including specific decoy PDF filenames and malicious LNK file names found in command-line arguments or file system events (FileName, TargetFilename).
This rule monitors for the presence of specific, known malicious file hashes associated with the Rokarolla threat actor. It correlates both file system activity and antivirus detections across the environment to identify and alert on potential execution or storage of these malicious artifacts.
Detects the access of VPN configuration files (e.g., .ovpn, .vpn, vpn*.conf) by common Windows command interpreters (powershell, pwsh, cmd, wscript, mshta) or archivers (WinRAR). This behavior is often indicative of automated credential harvesting or malicious configuration exfiltration, as legitimate VPN clients are explicitly excluded from this rule.
This rule detects a multi-stage attack sequence starting with WinRAR creating an LNK file in the Windows Startup directory for persistence, followed by the execution of a minimized command prompt, and finally a PowerShell script executing hidden content from the ProgramData directory using IEX (Invoke-Expression).
Detects a PDF, SVG, HTML, or presentation attachment containing a QR code or extracted URL that leads into an enterprise authentication workflow. This rule is designed to identify phishing attempts where adversaries embed QR codes or malicious URLs within common document types to direct users to fake enterprise login pages for credential harvesting.
Detects instances where Microsoft Excel (excel.exe) initiates the creation of potentially executable files (e.g., .exe, .dll, .bat, .ps1, .vbs, .js, .hta). This behavior is often indicative of malicious macros or document-based payloads attempting to drop secondary stages of an attack.
Page 62 of 86