Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,676 detections
Filters
Last updated
All Time
Detection languages
10,192
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,284
2,977
2,237
1,833
1,458
Platforms
10,387
1,109
809
155
98
Products / Services
10,676
9,759
6,693
4,421
3,749
MITRE Techniques
3,817
3,132
1,799
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
This detection identifies the execution of a process from a directory that also contains a zero-byte file named 'pic1.png'. This specific behavior is a known execution guardrail for the 'Diaoyu' loader, used by the TGR-STA-1030 group to evade automated sandbox analysis.
Detects the execution of specific Python scripts (modes.py, extentions.py, or udp.pyw) using the silent pythonw.exe interpreter. This activity is associated with the ModeloRAT malware, which is used in the CrashFix campaign, indicating potential persistence or execution of malicious payloads.
Detects the use of the Windows 'finger' utility, often renamed to 'ct.exe', to download and pipe remote commands to cmd.exe. This is a key Living Off The Land Binary (LoLBin) technique used in the CrashFix campaign. The detection specifically looks for 'ct.exe' in the command line, the unique 'confirm@' argument indicating a C2 address, and the piping of output to 'cmd' often launched via 'start'.
This rule detects anomalous process executions originating from the SolarWinds Web Help Desk application. It monitors for any child processes spawned by the Web Help Desk application that are not part of a predefined allowlist of expected executables (java.exe, pg_dump.exe, reg.exe, conhost.exe, WerFault.exe) or command lines (mysqldump). This can indicate compromise or misuse of the application to execute arbitrary code.
This rule detects the creation of a zero-byte file named 'pic1.png' followed by the execution of any process from the same directory within a specified time window. This behavior is indicative of the DiaoYu Loader, which uses a zero-byte 'pic1.png' as a guardrail or check before executing its malicious payload.
Detects the use of QEMU with port forwarding (`hostfwd`), a technique observed being used by attackers to create a persistent, virtualized environment for C2 and lateral movement, often via a scheduled task. The rule looks for the creation of scheduled tasks that launch QEMU with port forwarding or the direct execution of QEMU with port forwarding by common parent processes associated with scheduled tasks or remote administration.
Detects network connections to domains and IPs associated with the Notepad++ supply chain attack. These indicators are linked to the distribution of Cobalt Strike and the Chrysalis backdoor.
This rule detects suspicious activity related to Notepad++ updater (gup.exe or update.exe) executing reconnaissance commands or loading suspicious DLLs. Specifically, it looks for the updater process initiating common reconnaissance tools like cmd.exe, powershell.exe, or curl.exe with commands such as 'whoami', 'tasklist', 'systeminfo', 'netstat', 'ipconfig', or 'curl' that include redirection for staging. Additionally, it correlates this activity with the loading of suspicious DLLs (e.g., log.dll) from unusual locations like AppData or Temp folders, potentially indicating DLL sideloading.
This rule detects suspicious activity related to Microsoft Distributed Transaction Coordinator (MSDTC) where the OracleOciLibPath registry value is modified, followed by msdtc.exe loading an unsigned oci.dll within a 4-hour window. This behavior can indicate an attempt to hijack the DLL loading process for persistence or privilege escalation, potentially by an attacker replacing the legitimate Oracle OCI library with a malicious one.
This rule detects file and network indicators of compromise (IOCs) associated with the fake 'ClawdBot Agent' VS Code extension malware campaign. It looks for known malicious file hashes and network connections to C2 infrastructure, including specific C2 checks for ScreenConnect relay on port 8041.
Detects process, network, and file events associated with the fake 'ClawdBot Agent' VS Code extension. This malware drops weaponized ScreenConnect (Code.exe) and a Rust-based DWrite.dll loader. The rule covers Lightshot staging paths, relay C2 (bulletmailer.net:8041), extension C2 domains (getintwopc.site, clawdbot.getintwopc, darkgptprivate.com), and known payload hashes.
Detects a specific persistence mechanism where a scheduled task named 'TPMProfiler' is used to run QEMU, establishing an SSH backdoor. This technique was identified by Huntress in post-exploitation activity related to SolarWinds WHD exploitation. The rule identifies both the execution of QEMU with SSH port forwarding command-line arguments and the creation of the malicious scheduled task.
Detects a specific data exfiltration pattern observed in the Notepad++ supply chain attack. An attacker uses curl.exe to upload a file containing reconnaissance data to the temp.sh file sharing service. Subsequently, a beacon is sent to the C2 where the User-Agent string of the HTTP request contains the temp.sh URL for the exfiltrated data.
Detection content for the Notepad++ supply-chain compromise and the Chrysalis backdoor, attributed to Lotus Blossom. Detection rules use KQL only.
This rule detects various activities associated with the ClawdBot campaign, which uses a fake VS Code extension to drop the ScreenConnect RAT. Detection logic includes suspicious network activity fetching malicious payloads (config.json, lightshot files, zoomupdate.msi) from known malicious domains or Dropbox, identification of known malicious file hashes, outbound connections to ScreenConnect C2 servers on port 8041, creation or start of ScreenConnect services, file dropping/staging in temporary directories, and execution of Code.exe or ScreenConnect binaries from temporary paths.
This rule detects the presence or execution of known malicious file hashes associated with the ClawdBot campaign. It monitors file creation/modification events, process creation events, and module/image load events across devices for specific SHA256 hashes. The identified hashes correspond to components like 'Code.exe', 'zoomupdate.msi', 'DWrite.dll', 'extension.js', and 'run.bat', which are known to be part of the ClawdBot malware.
This rule detects network connections to domains known to host and distribute malicious file converter applications that install Remote Access Trojans (RATs).
Detects file activity under Chrome Extensions folder where the extension ID matches a known malicious ID list pulled from a GitHub markdown feed. Flags devices that may have installed or loaded malicious browser extensions.
This rule detects potential malware execution and persistence by correlating suspicious script and HTA activity with known malicious infrastructure. It flags mshta, wscript, and cscript executing remote HTA or script content, related network connections and downloads, temporary file artefacts, connections to listed suspicious domains and IPs, attempts to add Windows Defender exclusions, and fake browser update style process launches that retrieve executables over HTTP.
Detects indicators of compromise related to trojanized ScreenConnect installers and abuse of ScreenConnect C2 configuration. This rule identifies suspicious process executions of ScreenConnect components, known malicious hashes associated with ScreenConnect malware, ScreenConnect processes launched by installer executables (msiexec), network connections to ScreenConnect relay domains, DNS resolutions for ScreenConnect relays, modifications to 'system.config' files within ScreenConnect directories indicative of C2 configuration, and malicious registry artifacts related to ScreenConnect installation.
Detects the execution of known Remote Monitoring and Management (RMM) tools or related lures from suspicious user-writable directories like Downloads or Temp folders. Adversaries trick users into downloading RMM tools into these locations to bypass typical software installation monitoring.
Page 455 of 509