Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,683 detections
Filters
Last updated
All Time
Detection languages
10,199
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,287
2,979
2,238
1,835
1,458
Platforms
10,394
1,109
809
155
98
Products / Services
10,683
9,759
6,695
4,421
3,750
MITRE Techniques
3,820
3,136
1,801
1,573
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This rule detects network communication with known command and control (C2) infrastructure associated with the OysterLoader malware. It identifies C2 activity by looking for connections to specific domains and IP addresses, as well as requests to particular API paths within the RemoteUrl field.
Detects the execution of icacls.exe to grant 'Full Control' permissions to the 'Everyone' group for the 'C:\ProgramData\SimpleHelp' directory. This tactic is used by the SimpleHelp RAT to ensure it can operate without permission restrictions and facilitate persistence.
Detects the creation of specific .sys files in the C:\Windows\System32\drivers\ directory. These filenames are used by the BADIIS malware installer to stage malicious DLLs before they are moved to other locations for execution.
Detects file activity associated with the LunarApplication malware, either by the known installer hash or by creation of files/directories within its installation path. This rule combines a high-fidelity hash with a specific folder path.
Detects the creation of JSON files within the '%LOCALAPPDATA%\Arkanix_lol\' directory. This folder is used by the Arkanix Stealer to stage stolen data before exfiltration, making this activity a strong indicator of infection.
This rule detects the execution of processes associated with a JWrapper-packaged SimpleHelp Remote Access Trojan (RAT). The execution from the specific 'ProgramData\JWrapper-Remote Access' directory is a strong indicator of the malicious activity described in the Cofense report. The rule specifically looks for 'Remote AccessWinLauncher.exe', 'windowslauncher.exe', and 'winpty-agent64.exe' being executed from 'C:\ProgramData\JWrapper-Remote Access'.
Detects potential exploitation attempts against a buffer overflow vulnerability (CVE-2026-2329) in Grandstream VoIP phones. This rule identifies web requests targeting the vulnerable API endpoint '/cgi-bin/api.values.get' with an overly long query string (>64 bytes) or the use of multiple colons (>=3) which could indicate a ROP chain attempt. The detection is based on DeviceNetworkEvents from Microsoft Defender for Endpoint.
Detects the dynamic creation of a scheduled task where cmd.exe first writes an XML task definition file to disk, which is then immediately used by schtasks.exe to create the task. This is a characteristic behavior of the APT28 "Operation MacroMaze" campaign.
Detects the creation of a Windows service followed by the use of "sc.exe sdset" to apply a highly restrictive security descriptor. This specific TTP is used by the REF4033 group (UAT-8099) to harden their malicious 'WalletServiceInfo' service, making it difficult for administrators to stop or delete.
This rule detects the execution of 'notepad.exe' specifically when it is launched from the WindowsApps directory (excluding version '11.2510') and its command line arguments include the string '.md'. This combination suggests an attempt to open or process Markdown files using a specific, potentially non-standard, version of Notepad. This could indicate unusual user activity, a misconfigured application, or potentially malicious activity involving Markdown files, such as data exfiltration or execution of embedded content.
This rule detects various activities associated with the 'CrashFix' variant of the 'Clickfix' malware, which deploys a Python-based Remote Access Trojan (RAT). The detection logic covers several stages of the attack:
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
1. **Browser Extension Installation**: Identifies the creation of a specific malicious Chrome extension file (.crx) with a unique identifier.
2. **Command and Control (C2) Traffic**: Monitors network connections to known malicious URLs and IP addresses associated with the malware's C2 infrastructure.
3. **Malicious Hashes**: Detects the execution of processes with specific SHA256 hashes known to belong to the CrashFix malware.
4. **LOLBIN Abuse**: Identifies the use of living-off-the-land binaries (LOLBINs) like 'finger.exe' and 'ct.exe' in suspicious command-line combinations, potentially for discovery or execution.
5. **Malicious IP Communication**: Looks for network connections initiated by 'ct.exe' with the 'confirm' argument, indicating communication with potentially malicious remote IPs.
6. **Python TTPs**: Detects Python execution patterns, specifically 'pythonw.exe' running 'modes.py' and making outbound network connections to non-local IPs, indicative of the Python RAT.
7. **Persistence via Registry Run Key**: Monitors for registry modifications related to 'pythonw.exe modes.py', suggesting persistence mechanisms.
8. **Persistence via Scheduled Task**: Identifies the creation of scheduled tasks that execute 'run.exe' and 'udp.pyw', another persistence method.
Detects the creation or execution of files, often in C:\ProgramData, with a file description of 'SimpleHelp Remote Access Client' but using non-standard or renamed filenames. This is indicative of threat actors deploying the SimpleHelp RMM tool for persistence, as observed in campaigns exploiting CVE-2026-1731 in BeyondTrust.
Detects files being written to USB-mounted removable drives. The rule enriches these alerts with USB device identifiers such as VID_PID, InstancePathId, and SerialNumberId, gathered from fleet-wide Plug and Play (PnP) events. This enrichment allows security analysts to cross-reference the detected USB devices against an organization's approved device exclusion list, potentially managed by solutions like Microsoft Intune, to differentiate legitimate data transfers from potential data exfiltration attempts.
This rule detects suspicious `conhost.exe` processes executing with the `--headless` argument and other indicators commonly associated with malware or malicious activity. The presence of `--headless` suggests an attempt to hide the console window, while additional command-line arguments like `svchost.exe`, `certutil -decode`, paths within `Users\Public` or `AppData`, and specific file extensions (`.ico`, `.png`) or keywords (`MRB_`, `DA_NEW_VER_`, `BOT`) further indicate potential compromise. The rule also looks for initiating processes like `cmd.exe`, `powershell.exe`, `curl`, or `start` which are often used to launch malicious payloads.
This rule identifies command-line arguments that contain both a Markdown (.md) file extension and a suspicious URI scheme. This pattern is indicative of an attempt to exploit vulnerabilities, such as CVE-2026-20841, where specially crafted files are opened via the command line to trigger malicious links or actions through specific URI handlers.
Detects when fodhelper.exe, a legitimate Windows utility, is used to spawn processes other than cmd.exe or conhost.exe. This behavior is commonly associated with UAC bypass techniques where fodhelper.exe is abused to execute arbitrary commands with elevated privileges without a UAC prompt.
Detects a Python process spawning pip to install multiple libraries (requests, pycryptodome, psutil) in a short time frame, a behavior associated with the Arkanix Stealer's Python loader.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
Detects the creation of multiple files with the same GUID-like name but different extensions (VBS, BAT, CMD, HTM, XHTML) within a short time frame in the user profile directory. This pattern is characteristic of the APT28 "Operation MacroMaze" dropper behavior.
This rule detects outbound network connections to known command and control (C2) infrastructure. Specifically, it looks for connections to suspicious URLs (meeting.bulletmailer.net, clawdbot.getintwopc.site, darkgptprivate.com, getintwopc.site) or specific IP addresses (179.43.176.32, 178.16.54.253), or connections on a specific port (8041) which has been associated with ScreenConnect C2. The rule also attempts to identify the specific threat indicator based on the matched URL, IP, or port.
Detects outbound network traffic to known infrastructure used in OpenClaw malicious skill delivery or credential exfiltration. These IOCs were identified in the NSFOCUS report on OpenClaw security risks.
Page 453 of 509