Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Identifies the execution of a specific decoy PDF document, '000b67d70f3876965bb09fd37164b7ccrezervaci.pdf', within 5 minutes of its creation. This activity is associated with the 'Dragon Weave' campaign, where the document is used as a lure to distract the victim during an infection.
Correlates the extraction of the Hiring Portal zip file with the immediate execution of its payload. This rule detects the creation of files within a 'Hiring Portal' folder followed by the execution of 'setup.exe' from within a 'Hiring Portal' path within a 5-minute window on the same device. This behavior is indicative of the 'Screening Serpens' campaign.
Detects the Steam application wallpaper (wallpaper32.exe or wallpaper64.exe) launching a hidden executable named ._cache_GAME1.exe. This behavior is indicative of malicious wallpapers found on the Steam Workshop that use this method to execute malware.
Detects the creation of executable files (.exe, .com, .scr, .vbs, .js) that contain financial-themed keywords (e.g., GST, NEFT, RTGS, IMPS, Banking) in their filename. This pattern is commonly used in social engineering and phishing attacks to trick users into executing malicious payloads disguised as legitimate banking or financial documents.
Detects Microsoft Office applications (Word, Excel, PowerPoint) spawning command-line interpreters (PowerShell, CMD, WScript). This behavior is characteristic of malicious macros or exploitation attempts where Office applications execute shell commands to facilitate second-stage payload delivery or system compromise.
Detects the creation or modification of a 'setup.mjs' file within a '.vscode' directory. This script can act as a local payload execution point when developers open infected projects, potentially leading to arbitrary code execution.
Detects automated execution of hidden workspace scripts triggered upon opening IDE folders, specifically looking for bash or sh processes executing 'vendor/run-update.sh' initiated by VS Code or Cursor.
Detects downloads of CVE exploit proof-of-concept code
Detects opening of macro-enabled Office documents potentially containing malware
Detects the creation or modification of a local VSCode workspace extension (package.json) that maps a keybinding to the 'workbench.extensions.installExtension' command while explicitly setting 'skipPublisherTrust' to true. This technique is used to bypass VSCode's publisher trust mechanisms and silently install malicious extensions.
This rule detects suspicious process creation events where common scripting or command-line interpreters (powershell.exe, cmd.exe, cscript.exe, wscript.exe, regsvcs.exe) are spawned by Microsoft Office applications (winword.exe, excel.exe, powerpnt.exe, outlook.exe). This behavior is often indicative of malicious activity, such as macro-enabled malware attempting to execute payloads.
Correlates user interaction with a .one file resulting in Microsoft OneNote extracting and launching a hidden .cmd or .exe payload from the temporary OneNote directory.
Detects users interacting with Tax-themed phishing lures (e.g., W2, 1099, Tax Return) where Microsoft Word executes a macro that drops an executable to disk.
This rule detects inbound emails that have failed SPF and/or DKIM authentication checks and presents evidence of post-delivery user interaction. Authentication failures on inbound email are a strong indicator of email spoofing or unauthorized sending infrastructure, commonly associated with phishing campaigns targeting organizational users.
Unlike basic phishing detections that alert on email receipt alone, this rule correlates authentication failures with downstream activity to identify attacks that have progressed beyond the initial delivery phase of the MITRE ATT&CK kill chain. Specifically, the rule looks for three post-delivery indicators tied to the suspicious email:
URL Click Activity — A recipient clicked a link contained within the flagged email, suggesting potential engagement with a malicious payload or credential harvesting site
Malicious Attachment Match — An attachment delivered by the flagged email matched a known malicious SHA-256 hash present in the Threat Intelligence table, indicating a known-bad payload was delivered to the recipient
Endpoint File Creation — A file was created on an endpoint whose SHA-256 hash matches an attachment from the flagged email, suggesting the attachment was saved or executed on a host device
Any email triggering one or more of these conditions is surfaced with full metadata including sender, recipient, subject, SPF/DKIM/DMARC results, and the associated IOC for analyst review.
Unlike basic phishing detections that alert on email receipt alone, this rule correlates authentication failures with downstream activity to identify attacks that have progressed beyond the initial delivery phase of the MITRE ATT&CK kill chain. Specifically, the rule looks for three post-delivery indicators tied to the suspicious email:
URL Click Activity — A recipient clicked a link contained within the flagged email, suggesting potential engagement with a malicious payload or credential harvesting site
Malicious Attachment Match — An attachment delivered by the flagged email matched a known malicious SHA-256 hash present in the Threat Intelligence table, indicating a known-bad payload was delivered to the recipient
Endpoint File Creation — A file was created on an endpoint whose SHA-256 hash matches an attachment from the flagged email, suggesting the attachment was saved or executed on a host device
Any email triggering one or more of these conditions is surfaced with full metadata including sender, recipient, subject, SPF/DKIM/DMARC results, and the associated IOC for analyst review.
Shebangs (#!) are native to Unix-like operating systems (macOS and Linux). Standard Windows consoles (Command Prompt and PowerShell) do not natively use them. However, they do work on Windows when using tools such as the Python Launcher, Git Bash, Cygwin, or Unix-like environments such as WSL. In simple terms, a Shebang tells the operating system which interpreter should execute a script. For example: #!/usr/bin/python3
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
The first thing that came to my mind was to hunt for cases where these kinds of files were received via email, and yes, I quickly found a few Python and ECM-related examples.
Targets an executable copied or launched beneath AppData Local Programs by a temporary-stage process. The UDM rule retains principal and target context for correlation.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
Detects the creation of archive files (ZIP, RAR, 7Z) or executables with specific naming conventions (GST_, Debit_, Invoice_, NEFT_, RTGS_) often associated with Remcos RAT loaders. This rule focuses on the initial file creation event on a device.
Detects the execution of .com files disguised as business documents, potentially indicating the presence of a Remcos RAT loader. The rule looks for .com file extensions or filenames starting with 'GST*.com' being executed with command-line arguments containing financial or business-related keywords (Debit, Invoice, GST, NEFT, RTGS, IMPS). It also filters for processes initiated by common archive utilities or explorer.exe, which are often used to open such malicious files.
Detects the execution of 'cmd.exe' with a command line that includes a reference to a .lnk file. This behavior is often associated with adversaries using shortcut files to execute malicious code, potentially as part of initial access or execution tactics.
Detects weaponized LNK shortcut execution where native Windows tools (more, type, findstr) are abused to carve out and execute specific line-range payloads hidden inside decoy PDF containers.
Page 67 of 86