Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects instances where Microsoft Excel (excel.exe) initiates the creation of potentially executable files (e.g., .exe, .dll, .bat, .ps1, .vbs, .js, .hta). This behavior is often indicative of malicious macros or document-based payloads attempting to drop secondary stages of an attack.
Detects the creation of files with extensions (.scf, .url, .lnk) commonly used for shortcut-based exploitation or social engineering within sensitive user or system directories (e.g., Desktop, Downloads, Temp, NETLOGON, SYSVOL). The rule excludes file creations performed by known reputable software publishers to reduce noise.
Detects the execution of common command-line utilities (cmd, powershell, wscript, cscript, mshta, certutil) directly spawned by Microsoft Office applications (Word, Excel, PowerPoint, Outlook). This is a common indicator of macro-based attacks or other exploit delivery chains where Office documents are used to execute malicious payloads.
Detects the creation of files with extensions (.scf, .url, .lnk) commonly used for shortcut-based exploitation or social engineering within sensitive user or system directories (e.g., Desktop, Downloads, Temp, NETLOGON, SYSVOL). The rule excludes file creations performed by known reputable software publishers to reduce noise.
Detects the creation or modification of potentially malicious files such as autorun.inf or scripts (.lnk, .vbs, .hta, .bat, .cmd, .ps1) on removable or network drive letter paths (D-Z). This activity is indicative of attempts to facilitate malware execution via removable media, bypassing standard system binaries by excluding Microsoft-signed processes.
This rule detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run JavaScript (.js) or VBScript (.vbs) files located in common user-writable directories such as Temp, AppData, Downloads, or Documents. This pattern is commonly associated with the execution of malicious scripts dropped as part of phishing attacks or initial access vectors.
Generic detection for MSI-based installer droppers
Detects PowerShell execution with a command line indicative of a download cradle, initiated from the user's shell (explorer.exe). This behavior is characteristic of the "ClickFix" social engineering technique where a user is tricked into copying and running a malicious command from a webpage.
Detects the execution of command interpreters (cmd.exe, powershell.exe, rundll32.exe) initiated by explorer.exe when the parent process command line or the child process command line indicates activity involving files located in user-writable 'Temp' or 'Downloads' directories, specifically targeting LNK files. This behavior is commonly associated with malicious shortcut files used as initial vectors for execution.
This rule detects a suspicious sequence of file creation events occurring within a 60-second window in a temporary directory. The pattern involves the creation of a .lnk file, a .pdf file, and an executable (.exe or .dll). This behavior is characteristic of malicious activity where a shortcut file is used to lure a user into opening a document that subsequently executes a malicious payload.
Detects the execution of command interpreters (cmd.exe, powershell.exe, rundll32.exe) initiated by explorer.exe when the parent process command line or the child process command line indicates activity involving files located in user-writable 'Temp' or 'Downloads' directories, specifically targeting LNK files. This behavior is commonly associated with malicious shortcut files used as initial vectors for execution.
This rule monitors for processes named 'setup.exe' executing from user-writable directories (e.g., AppData, Downloads, Temp) that load unsigned or non-Microsoft DLLs from the same suspicious directories. This pattern is commonly associated with DLL side-loading or malicious installation attempts where a process attempts to load illegitimate code from local user space.
Detects the MYRA RAT utilizing npm postinstall scripts to silently install surveillance, build, or media capture tools (such as ffmpeg or grim) via apt-get in a non-interactive mode. This behavior is indicative of a supply chain attack or malicious dependency execution during package installation.
Detects potential activity associated with the AMOS infostealer, where common terminal commands (cp or mv) are used to manipulate or replace legitimate Ledger Live or Trezor Suite cryptocurrency wallet applications located in the /Applications directory on macOS.
Detects Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launching common shell or utility processes (cmd, powershell, wscript, cscript, mshta, regsvr32, rundll32). This behavior is a common indicator of macro-based attacks or malicious document execution where Office applications are abused to launch secondary payloads or execute code.
Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.
Detects Microsoft Office applications (Word, Excel, PowerPoint, OneNote) launching command-line interpreters (cmd.exe, powershell.exe, wscript.exe, cscript.exe). This pattern is often associated with macro-based malicious code execution.
Detects the execution of Windows Script Host (wscript.exe or cscript.exe) to run script files (.vbs, .js, .wsf, .hta) located in commonly abused writable directories such as Temp, AppData, Downloads, or ProgramData. This behavior is indicative of a malicious actor executing scripts that have been dropped onto the system as part of a phishing campaign or other attack vector.
Detects instances where common Microsoft Office applications (Word, Excel, PowerPoint, Outlook) launch suspicious child processes often associated with malicious command execution, such as command shells, scripting interpreters, or system utilities.
Detects the use of 'hdiutil' to mount disk images with the '-nobrowse' flag, initiated by common command-line or scripting interpreters. The '-nobrowse' flag prevents the mounted volume from appearing on the desktop or in Finder, which is a common technique used by attackers to mount malicious disk images stealthily to facilitate execution of payloads while avoiding user detection.
Detects the creation of executable files in the AppData\Roaming folder, excluding common legitimate applications, when the file's version information (internal file name, product name, or file description) matches known indicators for the TuglaInsaatci malware. This rule specifically looks for files named 'oacY.exe' or containing 'TuglaInsaatci' in their version info, indicating potential self-copying or masquerading behavior of the malware.
Page 63 of 86