Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects delivery of macro-enabled Office documents via email clients
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
This rule detects instances where the WhatsApp Desktop application (WhatsApp.exe) spawns suspicious child processes commonly used for scripting or command execution, such as wscript.exe, cscript.exe, powershell.exe, cmd.exe, or rundll32.exe. It specifically excludes known legitimate update and service-related command lines to reduce false positives. This behavior could indicate a phishing attempt or malware execution originating from a compromised WhatsApp session.
This rule detects suspicious activity where a common archive utility (7z, WinRAR, unrar, winzip) extracts files, and within a 5-minute window, a VBScript interpreter (wscript.exe or cscript.exe) executes a script. This pattern is often associated with phishing attacks that deliver malicious VBScripts via archived files.
This rule detects a scenario where a user downloads a fake installer (e.g., setup, install, vpn executable) from a browser, and shortly after, the downloaded executable initiates a PowerShell process. This PowerShell process then attempts to fetch secondary payloads from known malicious hosting services like Discord or Pastebin using `Invoke-WebRequest` or `IEX`.
Detects execution of potentially masqueraded processes or the creation of suspicious files, including specific DLLs, configuration files, and activity within VMware folders, often indicative of staging malicious payloads or side-loading attempts.
Detects the execution sequence associated with TonRAT malware, including the launching of PowerShell from explorer.exe via malicious LNK files (often disguised as photo or image files) and the subsequent execution of a node.exe process from user-writable directories such as AppData or Temp.
Detects execution of the TinyRCT backdoor by monitoring for suspicious instances of 'PerfWatson2.exe' running from non-standard locations (outside of the expected Visual Studio program directories) and specific instances of 'chrome_setup.exe' originating from user download directories matching a known malicious SHA256 hash.
Detects potential DLL sideloading attempts where a malicious 'Mixed Reality.exe' loads a 'nvdaHelperRemote.dll' from the Windows Media Player directory, or the creation of these suspicious files by unrecognized processes, potentially linked to a dropper file 'COU_ITR-1_to_4_AY2026-27.exe'.
Detects endpoint activity associated with the Operation DragonReturn phishing campaign, including DNS resolution of known malicious domains, download of specific malicious ZIP archives, execution of extracted dropper files, and network communication with identified command-and-control infrastructure.
Detects the execution of processes associated with the malicious npm package 'apintergrationpost', which acts as a masquerade for a Linux RAT (Remote Access Trojan) labeled as MYRA. The rule monitors process launch events for command lines or file paths containing the package name.
Detects malicious multi-stage download behavior where a web browser spawns PowerShell to initiate an outbound network connection, characteristic of the 'ErrTraffic' Beer cluster often associated with ClickFix infection lures delivering malware such as DanaBot, Stealc, HijackLoader, SmokeLoader, or Vidar.
Detects a suspicious pattern consistent with the REF8372 OXLOADER malware delivery, where a batch file (BAT) is executed from the Downloads or Temp directories using cmd.exe, which then spawns PowerShell to download external content from link.storjshare.io.
Detects the execution of Windows script files (JS, VBS, HTA) using wscript.exe or cscript.exe from common staging areas like AppData, Temp, or ProgramData, specifically when the initiating process is not a signed Microsoft binary. This pattern is highly indicative of potential malicious script execution often used in phishing delivery or secondary payload stages.
Detects a deceptive 'Updater' or Adware installer dropping heavily packed, randomized executables into the %TEMP% directory, transitioning from nuisance to active malware. This rule correlates file creation events in the temporary directory with process creation events initiated by common installer/updater filenames.
Detects an end-user web browser downloading an .rdp (Remote Desktop Protocol) configuration file, a primary lure for Terminal Server phishing.
Detects the use of tar.exe to extract archives into common staging directories (Temp, AppData, Public, ProgramData), particularly when the process is initiated by suspicious parent processes such as Office applications, command shells, or download utilities, which is often indicative of malicious payload staging.
Detects renamed AutoHotKey binaries launched from user-writable paths by a browser or Teams parent process, spawning cmd or powershell as children. This activity is associated with UNC6692 ("Snow Flurries") impersonating IT helpdesk over Teams, luring victims to a fake "Mailbox Repair Utility" page, and delivering a renamed AHK binary + same-named script from an attacker S3 bucket to install the SNOWBELT extension.
Detects the automated installation of the malicious 'google-update-support' VSIX extension, which has been associated with the UNK_DeadDrop phishing campaign targeting developers.
Detects Office applications or PDF readers spawning scripting engines or network-connected processes, which is a common tactic used by the Lazarus Group in fake job offer social engineering campaigns targeting developers. This rule specifically looks for processes like winword.exe, excel.exe, powerpnt.exe, acrord32.exe, acrobat.exe, foxit reader.exe, msedge.exe, chrome.exe, or firefox.exe initiating the execution of scripting tools (cmd.exe, powershell.exe, pwsh.exe, wscript.exe, cscript.exe, mshta.exe) or network utilities (certutil.exe, bitsadmin.exe, curl.exe, wget.exe).
Detects browser processes launched with a specific combination of command-line flags used by Evelyn Stealer to hide its activity and bypass security. This combination includes headless mode, a disabled sandbox, and an off-screen window position.
Page 65 of 86