Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Targets an executable copied or launched beneath AppData Local Programs by a temporary-stage process. The UDM rule retains principal and target context for correlation.
Detects the specific TOTPGuardRunner execution where the 'doit' argument is passed, signaling the payload to bypass the fake GUI and execute the main implant natively. This rule looks for 'setup.exe' in the command line with the 'doit' parameter, initiated by 'svchost.exe'.
This rule detects when common document-handling applications (such as Microsoft Office suite or PDF readers) spawn known remote access and support tools. This behavior is highly indicative of vishing-based social engineering attacks, where a user is tricked into downloading and executing a remote management tool via a malicious document.
This rule detects potentially malicious PDF files that act as droppers. It looks for a valid PDF header combined with specific PDF object patterns (Catalog, Pages, Page, FlateDecode) and indicators of malicious activity. These indicators include commands to launch chrome.exe, launch actions, obfuscated JavaScript for data export, or an 'anonymous' author field, which can be used by malware families like win.cloudeye.
This rule detects instances where common productivity applications (like Office suite) or web browsers spawn child processes that create system mutexes. This is a common indicator of malicious activity where a benign-looking document or web-based threat launches secondary payloads or persistence mechanisms.
Detects the creation of multiple executable files (.exe or .dll) within a 6-hour window in non-standard directories (outside of Windows or Program Files). The rule identifies scenarios where a single filename has three or more distinct SHA256 hashes associated with it on a specific device, which may indicate iterative malware delivery, obfuscation techniques, or persistence mechanism testing.
Detects potentially unauthorized or suspicious usage of the Jam build tool (jam.exe or jamplus.exe). The rule flags when Jam is executed by non-standard parent processes, when suspicious command-line arguments are used, when Jam spawns unexpected child processes, or when Jam initiates network connections.
Detects the creation of multiple executable files (.exe or .dll) within a 6-hour window in non-standard directories (outside of Windows or Program Files). The rule identifies scenarios where a single filename has three or more distinct SHA256 hashes associated with it on a specific device, which may indicate iterative malware delivery, obfuscation techniques, or persistence mechanism testing.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns, where a file with a .ini extension is used for execution, often via cmd.exe.
Detects installation of common remote management products from Downloads, Temp, AppData, Desktop, or Public user paths with silent installation options. This activity is often associated with adversaries establishing persistence or gaining remote access.
Detects modifications to the .vscode/extensions.json file which may be used by attackers to recommend malicious extensions to victims opening the workspace. Attackers can abuse this in conjunction with automated keystrokes to bypass warnings and force extension installations.
Detects the initial Go-compiled dropper binary extracting and writing the intermediate .vbs file to the Temp folder.
This rule detects instances where common productivity applications (like Office suite) or web browsers spawn child processes that create system mutexes. This is a common indicator of malicious activity where a benign-looking document or web-based threat launches secondary payloads or persistence mechanisms.
Detects the execution of .com files disguised as business documents, potentially indicating the presence of a Remcos RAT loader. The rule looks for .com file extensions or filenames starting with 'GST*.com' being executed with command-line arguments containing financial or business-related keywords (Debit, Invoice, GST, NEFT, RTGS, IMPS). It also filters for processes initiated by common archive utilities or explorer.exe, which are often used to open such malicious files.
This rule detects the execution of executables (.exe) from non-standard directories, specifically excluding paths containing 'Windows' or 'Program Files'. This behavior can be indicative of various malware, including ransomware, attempting to evade detection by operating outside of typical system locations. While the rule's title suggests binary entropy analysis, the current KQL query focuses on process execution paths.
This rule detects the creation or modification of executable files (.com, .exe, .scr, .pif, .bat, .cmd) in common user directories (Documents, Downloads, Desktop) where the initiating process is a legitimate application like explorer.exe, winrar.exe, or 7z.exe. This pattern is often used in phishing attacks where malicious executables are disguised as benign documents.
This rule detects the execution of VBScript files (.vbs or .vbe) by wscript.exe or cscript.exe where the filename contains keywords commonly associated with phishing lures (e.g., 'Invoice', 'Bill', 'Statement', 'Report', 'Debit', 'Credit', 'Notice', 'Alert', 'Urgent', 'Payment'). The rule triggers if three or more such executions are observed within a one-hour window on a single device, indicating potential malicious activity often associated with phishing campaigns.
Detects the execution of specific file names used as fake installers for the OnyxC2 stealer, which are typically delivered in password-protected archives.
This rule detects the creation of specific disguised .lnk files (e.g., ChromeSetup.lnk, Firefox Installer.lnk, AnyDesk.lnk) which are known to be used by the DeepLoad malware for USB-based lateral movement.
This rule detects a potential HTML smuggling attack where a browser (Chrome or Edge) saves a file (specifically ISO, IMG, VHD, ZIP, or RAR extensions) via a JavaScript Blob, and that same file is executed by the user via Windows Explorer within a 10-minute window. This chain of events is indicative of a phishing technique used to bypass traditional security controls.
Page 66 of 86