Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
1,235 detections
Filters
Last updated
All Time
Detection languages
566
292
81
73
60
Contributors
327
202
141
86
72
Categories
730
429
291
252
179
Platforms
1,209
21
17
3
2
Products / Services
388
374
201
58
53
MITRE Techniques
18,116
15,638
12,587
8,397
6,227
1,235
CVEs
15
8
4
2
2
IDS Classtypes
3
IDS Protocols
3
1
This detection identifies potential persistence and execution activity associated with a supply chain compromise involving a malicious npm package
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
The activity focuses on:
Registry-based persistence via:
HKCU\Software\Microsoft\Windows\CurrentVersion\Run
HKLM\Software\Microsoft\Windows\CurrentVersion\Run
Suspicious execution of a batch file located in:
C:\ProgramData\system.bat
Attackers used these mechanisms to establish persistence and execute follow-on payloads after initial compromise via a trojanized npm dependency. This detection correlates both registry modification events and process execution telemetry to identify early-stage persistence behavior.
Detects network connections to malicious domains, associated IPs, execution of related malicious file hashes, registry persistence, and postinstall script executions related to UNC1069 NPM/Axios supply chain attacks deploying SILKBELL and WAVESHAPER.V2. Categorized into risk-scored scenarios.
Detects scripts modifying Windows registry run keys for establishing persistence
This rule detects various indicators of compromise associated with the GlassWorm malware. It monitors for network connections to known GlassWorm remote IPs and domains, process activity involving specific GlassWorm filenames, folder paths, command line arguments (including wallet addresses and command terms), and registry modifications for persistence (Run/RunOnce keys with GlassWorm-related values). The rule correlates multiple evidence types to reduce false positives.
Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.
This detection rule identifies activity related to the TeamPCP Telnyx PyPI backdoor, specifically targeting versions 4.87.1 and 4.87.2 of the 'telnyx' package. It looks for command-line executions involving 'pip install telnyx==4.87.1' or 'pip install telnyx==4.87.2'. Additionally, it detects network connections to the IP address 83.142.209.203 on port 8080 requesting 'ringtone.wav' or 'hangup.wav', which are indicators of the backdoor's communication. The rule also identifies persistence mechanisms by looking for 'msbuild.exe' in the Windows Startup folder path '\Microsoft\Windows\Start Menu\Programs\Startup\msbuild.exe'.
Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.
Detects Windows registry run keys executing processes out of suspicious paths, for establishing persistence
This query hunts for .lnk (shortcut) files that are either newly created or have the hidden attribute set, located in common Windows startup folders. Attackers often place LNK files in these locations to establish persistence.
This query hunts for .lnk (shortcut) files that are either newly created or have the hidden attribute set, located in common Windows startup folders. Attackers often place LNK files in these locations to establish persistence.
Detects the creation of a file named "msbuild.exe" within the Windows Startup folder. This behavior matches the persistence and masquerading techniques used by the TeamPCP threat actor following the compromise of the telnyx PyPI package.
Detects registry modifications to the Run key via reg.exe that include the conhost.exe executable with the undocumented --headless parameter. This technique is used by EtherRAT for persistent, stealthy execution of its Node.js payloads.
This rule detects attempts to establish persistence by modifying the Windows Registry 'Run' key to execute 'conhost.exe' in headless mode. This technique is often used by adversaries to maintain access and execute malicious payloads upon user login, while attempting to hide the execution by using a legitimate Windows binary in a less common mode.
This rule detects various activities associated with the Kimsuky JavaScript dropper, including DNS requests to known malicious domains, creation of specific files (Themes.js, L298306.tmp), execution of certutil.exe or script.exe for decoding/encoding, suspicious command-line arguments for system information or task listing, and persistence mechanisms via scheduled tasks or registry modifications related to 'Themes.js' or 'Windows Theme Manager'.
Detects the creation of batch or command scripts in the Windows Startup folder. This is a common persistence technique used by malware like VOID#GEIST (spol.bat) to ensure execution on user logon. The rule specifically looks for file creation events of .bat or .cmd files in the Startup folder, initiated by processes commonly associated with malicious downloads or script execution such as cmd.exe, powershell.exe, curl.exe, cscript.exe, and wscript.exe.
Detects persistence mechanisms associated with malware signed by TrustConnect Software PTY LTD. The malware establishes persistence by creating a specific Run key or by registering a service masquerading as Adobe Acrobat Reader.
Detects trojanized VPN processes spawning suspicious child processes (like rundll32, regsvr32, mshta, wscript, powershell, cmd) or writing RunOnce persistence in the registry, or loading malicious DLLs (dwmapi.dll, inspector.dll). The detection specifically targets processes signed by "Taiyuan Lihua Near Information Technology", which has been associated with Storm-2561 activity.
Detects the creation of registry Run or RunOnce keys that point to executables mimicking popular VPN clients. This technique is used by threat actors like Storm-2561 to establish persistence for their malicious payloads, which are often fake VPN clients designed for credential theft. The rule specifically looks for these executables being run from non-standard locations, such as user profiles, instead of the legitimate 'Program Files' directory.
Detects the persistence mechanism used by the Tickler backdoor, associated with the threat actor APT33. The malware creates a Run registry key with the value name 'SharePoint.exe' to execute its payload on system startup.
This rule set detects components of the StegaBin supply-chain attack targeting npm packages. The first rule, 'stegabin_npm_loader', identifies malicious JavaScript loaders that utilize Pastebin for steganography and Vercel API paths for command and control. It looks for specific strings indicating Pastebin usage, Vercel API endpoints, and unique markers related to the steganographic decoding or payload. The second rule, 'StegaBin_VSCode_Tasks_Persistence', focuses on persistence mechanisms within VSCode's tasks.json files. It detects configurations that automatically execute malicious code upon folder opening, specifically looking for the 'runOn': 'folderOpen' property and references to the 'ext-checkdin.vercel.app' domain and associated API paths. Together, these rules aim to identify both the initial loader and the persistence mechanism used by the StegaBin campaign.
Detects the creation of a registry run key named 'OneDrive' that points to an executable located within the user's AppData ClickOnce cache directory. This is a specific persistence technique used by the SloppyLemming actor to execute the BurrowShell loader.
Page 44 of 59