Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
203 detections
Filters
Last updated
All Time
Detection languages
76
72
13
12
8
Contributors
34
27
25
20
18
Categories
89
65
45
23
22
Platforms
173
30
21
6
3
Products / Services
42
40
26
7
5
MITRE Techniques
18,116
15,638
12,585
8,395
6,225
CVEs
5
1
1
1
IDS Classtypes
4
3
IDS Protocols
4
2
1
This rule detects the delivery of a potential autostart payload as a startup script over HTTP. It looks for HTTP URIs containing keywords like 'startup', 'autostart', or 'autorun' (case-insensitive) and checks the file data for the 'MZ' header, indicating an executable file, within the first 2 bytes of the file content. This combination suggests an attempt to deliver an executable that could be configured for persistence.
Detects creation or manipulation of the ROTATE subdirectory within the Skylight Metrics Agent path by non-SYSTEM accounts. CVE-2026-7791 exploitation requires replacing the legitimate ROTATE directory with a junction point targeting the attacker's desired write location. The Skylight service then follows the junction during its log rotation, writing attacker-controlled files to the target with SYSTEM privileges. Any non-SYSTEM interaction with this specific path warrants investigation.
Huntress has observed Tiflux being used in attacks that aim to establish persistence, transmit screenshots, and run commands to collect system profiling information.
Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system.
Threat actors behind the rogue Tiflux incidents also installed UltraVNC, an open-source remote access tool, sideloaded other commercial RMMs, including Splashtop and ScreenConnect, and installed an outdated driver that can permit the threat actor to elevate their own privileges on an infected system.
This is a KQL detection based on the YARA rules by Jason Baker of GuidePoint Security in linked reference - Connected to the Akira ransomware exploits
Detects the modification of Group Policy Objects (GPO) to add a startup/logon script to users or computer objects.
Detects creation/modification of Assistive Technology applications and persistence with usage of 'at'
Detects scripts modifying Windows registry run keys for establishing persistence
Detects creation of known malicious files linked to axios compromise
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
Detects Windows registry run keys executing processes out of suspicious paths, for establishing persistence
Detects the creation or modification of .plist files on macOS systems. This activity can be indicative of various malicious behaviors, particularly those related to persistence or privilege escalation, as .plist files are often used to configure application settings, launch agents, or other system behaviors.
Detects Windows registry run keys executing processes out of suspicious paths, for establishing persistence
Detects scripts modifying Windows registry run keys for establishing persistence
This detection is designed to help you find activity related to BRICKSTORM espionage backdoor (appliances/vCenter). It is based on the specific threat intelligence in the reference, so it focuses on concrete, easy-to-verify signals rather than vague patterns. It uses exact indicators and tightly scoped behaviors described in the referenced threat intelligence. A match does not automatically prove a compromise, and it does not prove the activity was successful, but it is a strong reason to investigate because the signal lines up with published reporting. When this fires, start by confirming which host, account, or server produced the event and whether the behavior is expected for that system. If it is not expected, preserve the relevant logs and files, check for repeated attempts over time, and look for nearby signs such as new admin accounts, unusual remote access, or suspicious downloads. Treat a match as a scoping signal and pivot to other telemetry around the same host, account, and time window. Use the reference link to document why you treated the alert as significant and to support incident notes.
This rule detects the creation of processes that utilize specific mutex names associated with the Chrysalis backdoor. The detection is based on the presence of the mutex name 'Global\Jdhfv_1.0.1'. This activity is indicative of the Chrysalis backdoor operating on a system, likely for persistence or to ensure single instance execution.
This rule detects the creation of processes that utilize specific mutex names associated with the Gamarue backdoor. The detection is based on a direct match of the 'MutexName' field against a predefined list of known Gamarue mutexes. The rule aims to identify potential Gamarue backdoor activity on Windows systems by monitoring process creation events for these unique mutex identifiers.
This rule detects the creation of processes that utilize specific mutex names associated with the Phoenix backdoor. The detection is triggered when a process creates a mutex named 'sysprocupdate.exe'. This activity is indicative of the Phoenix backdoor attempting to ensure only a single instance of itself is running on a system, a common technique for malware persistence and control.
Detects PowerShell launched with ExecutionPolicy Unrestricted and stdin command execution (-Command -), matching behavior described in fake Windows 11 installer campaign.
This rule detects the creation of processes that utilize specific mutex names associated with the Yokai backdoor. The detection is based on the presence of the mutex name 'k1tpddvivh74fo1et725okr1c1'. This activity is indicative of the Yokai backdoor running on a system, potentially for persistence or to ensure a single instance of the malware.
This rule detects the creation of specific mutexes associated with the UDPGangster backdoor. The detection logic looks for the mutex name 'xhxhxhxhxhxpp'. The presence of this mutex name indicates potential UDPGangster backdoor activity on the system.
This rule detects suspicious entries in the RunMRU (Most Recently Used) registry key that indicate potential persistence mechanisms. It specifically looks for entries containing DNS-related tools (like nslookup, dig, host), other common system utilities (ping, tracert, ipconfig, powershell, cmd.exe, wmic, curl, wget, certutil, bitsadmin), or suspicious flags commonly associated with obfuscated or malicious commands (e.g., base64 encoding, web requests, common sensitive paths). The rule also correlates these registry modifications with subsequent process creations to confirm execution.
Page 6 of 10