Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects the spawning of suspicious child processes such as PowerShell, cmd, or rundll32 from common productivity applications like Microsoft Office or PDF readers. This pattern is often indicative of macro-based execution, malicious document payloads, or living-off-the-land techniques used to initiate secondary stages of an attack.
Detects the execution of ClickOnce application reference shortcuts (.appref-ms) which point to malicious remote URIs. This rule specifically looks for process command lines containing '.appref-ms' and initiated by 'explorer.exe'.
Detects the spawning of suspicious child processes such as PowerShell, cmd, or rundll32 from common productivity applications like Microsoft Office or PDF readers. This pattern is often indicative of macro-based execution, malicious document payloads, or living-off-the-land techniques used to initiate secondary stages of an attack.
This rule detects the creation of .lnk files in common suspicious directories (such as startup folders, Temp, or Downloads) followed by the execution of common scripting or command interpreters (powershell.exe, mshta.exe, wscript.exe, cmd.exe) with long command lines within a 10-minute window. This behavior is often indicative of an adversary attempting to achieve persistence or execute malicious payloads via user interaction.
This rule detects the creation of an SVG file in common user-writable/temporary directories, followed closely (within 60 seconds) by the execution of common scripting interpreters (cmd.exe, powershell.exe, wscript.exe) by a web browser. This behavior is often associated with browser-based exploitation or malicious file downloads where an attacker uses an SVG or accompanying file to trigger secondary malicious processes.
Identifies anomalous executables running directly from the Steam workshop/content/431960 folder, excluding legitimate wallpaper executables. This folder is known to be abused by adversaries to distribute malicious software disguised as Steam Wallpaper Engine content.
This rule detects a multi-stage attack chain on macOS involving a browser or mail client spawning a shell to download a file (DMG) via curl/wget, followed by the mounting of that disk image, execution of an application bundle from the mounted volume, and a subsequent outbound network connection from that application. This behavior is indicative of a user-initiated malware execution chain.
This rule detects multiple executions of VBScript or VBE files via wscript.exe or cscript.exe within a one-hour window, where the command line contains keywords commonly associated with malicious documents or phishing attempts (e.g., 'Invoice', 'Bill', 'Urgent', 'Payment'). This behavior can indicate user execution of a malicious script, often delivered via phishing.
Identifies LNK shortcut files contained in ISOs executing the Fox Tempest signed payload, bypassing initial scrutiny. This rule specifically looks for 'explorer.exe' initiating a process with a command line containing '.lnk' and then joins this with image load events where the initiating process's signature status is 'Valid'. This combination aims to detect the execution of malicious LNK files that launch signed binaries, a technique used by threat actors like Fox Tempest.
Detects the execution of the primary Rust-based payload named 'Подтверждение заказа продукции ЦАИ.exe' extracted from the ZIP archive, associated with the Silent Rotor campaign.
Detects archive utilities extracting an LNK (shortcut) file directly to disk, specifically in Downloads or Temp folders, which is a common initial access vector preceding script execution.
This rule monitors for potentially malicious process activity characterized by either cmd.exe executing commands with PDF-related arguments, or specific executables often associated with installers or update mechanisms (GoogleUpdateStepup, AutoUpdate, AnyConnect-win) being executed or spawning processes. This behavior is indicative of potential application masquerading, software installer abuse, or malicious document execution.
Detects various indicators of SharkLoader activity, including the deployment of decoy MSI files, execution of suspicious masqueraded processes, use of double-extension files, and the creation of malicious DLL components in specific AppData subdirectories.
This rule detects potentially malicious behavior where a PDF reader or command-line utility (executing a PDF) spawns msiexec.exe shortly after, when the parent process is running from a suspicious directory (e.g., AppData, ProgramData, or other temp locations). This pattern is commonly associated with dropper activity where a malicious PDF is opened and subsequently triggers an MSI installer to deploy malware.
Detects the creation of files with specific filenames (e.g. SystemSettings.dll, DscCoreR.mui, SyncRes.dat) within anomalous AppData subdirectories 'xwreg' or 'xgdf', followed by the execution of a process from those same directories within a 5-minute window. This behavior is indicative of SharkLoader malware staging its components and initiating execution.
Detects execution of PowerShell commands using WScript.Shell to create shortcuts, specifically looking for indicators related to 'vile_Decryptor.lnk' or 'vile_icon.ico'. This pattern is frequently observed in malware deployment or dropper activities aiming to establish persistence or facilitate user-driven execution.
Detects the initial Go-compiled dropper binary extracting and writing an intermediate .vbs file to the Temp folder. The VBScript file name will consist of 10 or more lowercase alphabetic characters.
Detects anomalous child process creation from the Lunar Minecraft Client or its associated Java processes (java.exe/javaw.exe). This rule identifies potential supply-chain exploitation, where malicious mods or the client itself spawn shell interpreters (e.g., cmd.exe, powershell.exe, wscript.exe) or other suspicious binaries from the application's directory, which is characteristic of the lunar-modrinth-chain-poc exploit.
Detects activity associated with N-able Take Control and AnyDesk remote monitoring and management (RMM) tools, including silent execution, suspicious LNK file creation, and persistence via registry modifications.
Identifies the execution of ClickOnce .application or .appref-ms files launched from temporary or download paths, specifically when 'dfsvc.exe' is involved and the command line contains a path within 'AppData\Local\Temp' ending with '.application'.
Detects WinRAR.exe writing HTA files into the Windows Startup directory via traversal sequences in weaponized archives.
Page 64 of 86