Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,793 detections
Filters
Last updated
All Time
Detection languages
906
306
118
108
97
Contributors
444
386
346
85
62
Categories
1,048
468
403
377
369
Platforms
1,572
128
100
89
54
Products / Services
733
484
148
100
76
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
1,793
CVEs
6
5
5
4
3
IDS Classtypes
32
4
2
IDS Protocols
32
4
1
1
Detects when a potentially malicious file (such as a macro-enabled document, executable, or script) is created within a directory configured as a Microsoft Office Trusted Location. Attackers may place malicious files in these locations to ensure they are opened by the user without security warnings (like Protected View or macro-blocking), facilitating code execution. This rule correlates file creation events with trusted paths dynamically enumerated from the device's registry.
Detects when a Microsoft Office application (Word, Excel, PowerPoint, Outlook, Publisher, Visio, Access) spawns a suspicious child process. The child processes include commonly abused Windows utilities such as PowerShell, cmd, wscript, cscript, mshta, rundll32, certutil, bitsadmin, and regsvr32. This behavior can indicate malicious code execution originating from an Office document, often associated with phishing or document-based malware.
Detects the execution of a hidden PowerShell window that uses Invoke-WebRequest to download and then execute a second-stage PowerShell script. This behavior is characteristic of the IClickFix framework's "ClickFix" social engineering tactic used to deliver malware like NetSupport RAT.
Detects instances where Visual Studio Code spawns a shell process to download a remote script via tools like 'curl' or 'wget' and pipe it directly into the Node.js runtime. This technique has been observed in the "Contagious Interview" campaign, where threat actors abuse VS Code's 'tasks.json' to execute malicious payloads in memory.
Detects a Windows script host (wscript.exe or cscript.exe) spawning a Java process to execute a JAR file, a behavior observed in STRRAT malware delivery chains.
Detects executable files with names containing PDF-related keywords (e.g., 'pdf', 'convert', 'editor') being dropped in the Downloads folder by a web browser process. This behavior is typical of users downloading potentially unwanted or malicious PDF converters, often delivered via SEO poisoning or malvertising campaigns.
Detects the execution of a piped command chain typical of 'ClickFix' lures used by the MacSync infostealer. The malware tricks users into pasting a command into the terminal which uses curl to download a payload, decodes it with base64, and pipes it directly into a shell (zsh, sh) or osascript for execution, bypassing macOS security controls like Gatekeeper.
Detects the execution of the TamperedChef payload 'PDF Editor.exe' from its specific, non-standard installation directories within user profiles.
Detects a malicious PDF dropper that uses specific objects and patterns indicative of malware activity.
Detects commands accessing a remote WebDAV share hosted on a trycloudflare.com domain. This technique has been observed in AsyncRAT campaigns where a malicious Internet Shortcut (.url) file initiates the connection to download and execute further payloads.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns where a .ini file extension is used to disguise an executable, which is then launched via cmd.exe.
Detects the creation of abnormally large Windows shortcut (.lnk) files. This is a known TTP of APT36 (Transparent Tribe), who embed PDF content within LNK files to inflate their size and masquerade as legitimate documents to deceive users. The rule specifically looks for .lnk files with a size greater than 1MB.
Detects a ClickFix attack chain involving an email client opening a browser to a suspicious domain, followed by a file download, and subsequent execution via cmd.exe from explorer within a short timeframe. This chain of events is indicative of a social engineering attack designed to trick users into executing malicious files.
Detects cmd.exe spawning processes with document file extensions, indicating a PE binary masquerading as a document
Detects the execution of a batch file from a common user directory (e.g., Downloads, Desktop) that immediately launches an executable file. This pattern was observed in a Webrat malware campaign where a `start_exp.bat` file was used to launch the primary malicious payload, `rasmanesc.exe`, tricking users into running it after extracting a fake exploit archive.
Detects the execution of a process from a newly connected external media device on Windows. This rule correlates the detection of a new Plug and Play (PnP) device with a drive letter (excluding C:\) and subsequent process creation from that drive letter. It requires Plug and Play auditing to be enabled.
Detects Microsoft Excel spawning an executable in a typical malware staging directory directory. This behavior is a strong indicator of a malicious XLL loader used by the Paper Werewolf (GOFFEE) group to drop the EchoGather backdoor.
Detects when AppLocker prevents the execution of an Application, DLL, Script, MSI, or Packaged-App from running.
This rule detects 3 types of suspicious activities: first, the presence of files matching a list of known malicious SHA256 hashes associated with Sha1-Hulud; second, suspicious process behavior involving file deletion commands and third traffic towards potential C2.
This rule detects various activities associated with the Sha1-Hulud campaign, including the creation of malicious files (setup_bun.js, bun_environment.js) identified by their SHA256 hashes or filenames within .npm directories. It also identifies the execution of malicious preinstall scripts involving 'node' and 'setup_bun.js'. Furthermore, the rule looks for persistence mechanisms related to GitHub Actions, specifically the creation of 'discussion.yaml' within '.github/workflows' or 'run.sh'/'config.sh' within '/.dev-env/'. Finally, it detects destructive commands used as a fallback, targeting both Linux (using 'find', 'shred', 'xargs', 'delete') and Windows (using 'del', 'rd' on '%USERPROFILE%').
Page 73 of 86