Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
566
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
429
291
252
179
Platforms
1,209
21
17
3
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,235
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
Detects the creation of .vbs or .vbe files in the Windows Startup folder. This technique is actively used by Gamaredon (leveraging CVE-2025-8088) to drop the GammaDrop payload for persistence.
Detects RunOnce registry modifications calling wscript.exe to execute an .icl script silently. This is indicative of GammaLoad malware establishing persistence.
Detects the immediate persistence mechanisms (VBScript and Startup shortcut) established by KongTuke's ModeloRAT within minutes of initial execution. This rule specifically looks for PowerShell execution that contains commands to create both a VBScript file named 'scriptA.vbs' and a Startup shortcut named 'StartManagerB.lnk', which are highly specific indicators of this threat.
This rule detects the creation or modification of registry keys under 'HKCU\SOFTWARE\TitanPlus' or 'HKLM\SOFTWARE\TitanPlus' that contain specific IP addresses (38.180.25, 45.8.157, or 5.181.3) in their details. This activity is associated with Black Basta and Cactus ransomware for storing BackConnect C2 IP addresses.
Detects RunOnce registry modifications calling wscript.exe to execute an .icl script silently. This is indicative of GammaLoad malware establishing persistence.
Attackers distributed a malicious MSI installer disguised as a legitimate Sysinternals tool. Once executed, it installed EtherRAT, a Node.js-based remote access trojan. EtherRAT then deployed TukTuk C2, a framework designed to abuse SaaS services (Supabase, ClickHouse, Dropbox, GitHub Issues) and Cloudflare tunnels for resilient command-and-control.
https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
https://thedfirreport.com/2026/05/11/flash-alert-etherrat-and-tuktuk-c2-end-in-the-gentleman-ransomware/
Detects the creation or modification of a registry run key that establishes persistence by executing 'conhost' or 'node.exe' with '--headless' or '.cfg' arguments. This technique is often used by adversaries to maintain access to a system after a reboot or user login.
Detects behavioral characteristics of the Needle Rust desktop agent: an unsigned Rust PE in the 5-50MB range, executing from user-writable paths, and establishing the Run-key persistence the agent installs at HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run. The Rust panic-handler source paths (src/views/zelcore/app.rs, src/views/trezor/seed_panel.rs, src/views/ledger/screens/seed_recovery.rs) are also surfaced via the binary's data section and are extremely high-fidelity if visible in any command-line or memory-scan telemetry. This rule pairs the persistence registration with the agent execution context.
A fake version for the Claude AI website offers a malicious Claude-Pro Relay download that pushes a previously undocumented backdoor for Windows named Beagle.
The threat actor advertises Claude-Pro as a "high-performance relay service designed specifically for Claude-Code" developers.
Source: https://www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/
The threat actor advertises Claude-Pro as a "high-performance relay service designed specifically for Claude-Code" developers.
Source: https://www.bleepingcomputer.com/news/security/fake-claude-ai-website-delivers-new-beagle-windows-malware/
Detects creation or modification of the SafeBoot\Network\Remote Access Service registry key, a persistence mechanism used by the STAC6405 (VENOMOUS#HELPER) campaign. This ensures the SimpleHelp-based RAT survives Safe Mode with Networking reboots, which is a common remediation step for defenders. The specific 'Remote Access Service' subkey under SafeBoot\Network is a static Indicator of Compromise (IOC) for this campaign, as modifications to SafeBoot\Network are generally rare in benign Windows operations.
Detects Microsoft Edge launching in headless mode and loading an unpacked extension. This technique is utilized by UNC6692 to maintain persistence and execute the SNOWBELT malicious browser extension without user visibility.
Detects suspicious execution paths for svchost.exe, known malicious SHA256 hashes, or suspicious registry persistence mechanisms. Specifically, it looks for svchost.exe or a file named images.png executing from the 'Users\Public\Windows' directory, known malicious hashes, or a registry run key named 'Windows Update Service' under 'Software\Microsoft\Windows\CurrentVersion\Run'.
Detects the creation or modification of registry keys related to SyncRoots containing the hardcoded string 'SERIOUSLYMSFT', which is indicative of the RedSun exploit (CVE-2026-33825) abusing the Cloud Files API.
Detects potential suspicious behaviour using secedit.exe. Such as exporting or modifying the security policy
Detects modifications to User Shell Folders registry values via reg.exe or PowerShell, which could indicate persistence attempts.
Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup.
This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.
Attackers may modify User Shell Folders registry values to point to malicious executables or scripts that will be executed during startup.
This technique is often used to maintain persistence on a compromised system by ensuring that malicious payloads are executed automatically.
Detects modification of Windows Registry Classes keys used for persistence.
Adversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed.
Various legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths,
thus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
Adversaries modify these autostart extensibility points (ASEP) to execute malicious code when file types are opened or actions are performed.
Various legitimate software also uses these keys. Currently, this rule only filters out known legitimate software paths,
thus it is recommended to review and tune filters for your environment to reduce false positives before deploying to production.
Detects the creation of a shortcut (.lnk) file in the Windows Startup folder containing 'Edge' or 'msedge' in its name. This matches the persistence mechanism used by LucidRook and its droppers (like LucidPawn) which drop a disguised Microsoft Edge shortcut to execute a renamed DISM binary.
Detects suspicious behavior associated with an Adobe Reader zero-day exploit, including specific network connections, suspicious user-agent strings, registry persistence, and specific image loads (e.g., ntdll.dll or bootsvc.dll).
This rule detects the infected version of CPU-Z, a popular system information tool, which has been compromised and used as a vector for malware infection. The detection is based on specific indicators of compromise (IOCs) related to the malicious version of CPU-Z, like unusual command-line arguments, or known malicious behaviors associated with this tool. Specifically, it looks for `cpuz.exe` spawning `powershell.exe` with suspicious command-line arguments like `[Console]::In.ReadToEnd()` or `Invoke-Expression`, or `csc.exe` spawning `chrome.exe`.
Detects indicators associated with the axios npm supply chain compromise by identifying suspicious payload execution (wt.exe in ProgramData) and persistence via the Windows Run registry key (MicrosoftUpdate). The rule triggers when either behavior is observed, providing visibility into potential post-compromise activity on Windows endpoints.
This detection identifies potential persistence and execution activity associated with a supply chain compromise involving a malicious npm package
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
Page 43 of 59