Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
10,676 detections
Filters
Last updated
All Time
Detection languages
10,192
119
110
99
60
Contributors
2,820
2,800
1,768
504
492
Categories
4,284
2,977
2,237
1,833
1,458
Platforms
10,387
1,109
809
155
98
Products / Services
10,676
9,759
6,693
4,421
3,749
MITRE Techniques
3,817
3,132
1,799
1,571
1,307
CVEs
36
21
12
11
10
IDS Classtypes
2
2
1
1
IDS Protocols
2
Detects suspicious commands written to the Windows RunMRU registry key, which stores the history of commands executed via the Windows Run dialog (Win+R). This activity is often associated with the "ClickFix" social engineering technique, where users are tricked into pasting and running malicious commands. The rule identifies various suspicious indicators, including fake verification messages, PowerShell commands with obfuscation or download cradles, mshta, wscript, curl, wget, rundll32, bitsadmin, ssh proxy abuse, and obfuscated command line arguments.
Detects a script process (wscript.exe/cscript.exe) creating files in a specific HP-themed path and then creating a Run key for persistence, indicative of the Turla Kazuar VBScript dropper.
Detects the execution of a Python script characteristic of the AsyncRAT polymorphic APC injector. This involves python.exe running a script with arguments for an input binary file (-i *.bin) and a key file (-k *.txt).
Detects a suspicious process chain involving wscript.exe spawning powershell.exe, which then spawns MSBuild.exe. This specific chain is characteristic of the SHADOW#REACTOR malware campaign, indicating potential execution of malicious code via trusted utilities.
Detects the modification of the registry to disable RDP Restricted Admin mode. This allows attackers to access plaintext credentials from the remote machine. This TTP is associated with the threat actor UAT-8837.
This rule detects when Microsoft Office applications (Word, Excel, PowerPoint) create INI files within the `C:\ProgramData\` directory. This behavior can be indicative of malicious activity, such as macro-enabled documents dropping configuration files or payloads, or other forms of malware attempting to establish persistence or store data in a less scrutinized location.
This rule detects files matching known SHA256 hashes associated with the VoidLink malware framework. This is a high-fidelity indicator with a very low chance of false positives.
This rule detects indicators associated with the 'Office Assistant' supply chain attack. It identifies malicious browser extensions by their IDs in file paths or names, and also detects known malicious file MD5s and C2 communication domains. The rule correlates file events and network events to provide a comprehensive view of the attack.
Detects the creation and subsequent execution of a masqueraded binary named "CertificationKit.ini" in the C:\ProgramData directory. This technique has been observed in recent MuddyWater campaigns where a .ini file extension is used to disguise an executable, which is then launched via cmd.exe.
This detection identifies outbound network traffic to domains, IP addresses, or a specific port known to be associated with the PHALT#BLYX campaign's infrastructure. The campaign uses these for malware delivery and DCRat command and control (C2). The rule specifically looks for connections to known malicious IPs or domains, or connections on port 3535 (used by DCRat) originating from processes associated with the malware (staxs.exe, tybd7.exe, aspnet_compiler.exe).
vvs-stealer
KQL
This rule detects activities associated with the VVS Stealer malware, as described in the Palo Alto Networks Unit 42 blog. It identifies the malware through specific SHA256 hashes of known VVS Stealer executables, network connections to hardcoded Discord webhook URLs used for exfiltration, persistence mechanisms via creation of executables in Windows startup folders, creation of '_vault.zip' files (likely containing stolen data), and suspicious Discord-related process activity indicative of the stealer's operation.
Detects a multi-stage process execution chain characteristic of the 'ClickFix' technique. This involves 'explorer.exe' spawning a headless 'conhost.exe', which subsequently executes a Living Off the Land Binary (LOLBin) such as 'curl', 'pwsh', 'powershell', or 'mshta' to download a payload from an HTTP/HTTPS source. This chain indicates an attempt to bypass traditional security controls and execute malicious code.
This rule identifies processes that trigger three or more STATUS_INVALID_PAGE_PROTECTION (0xC0000045) errors within a one-second interval. This specific behavior is caused by a recurring programming flaw in the pkr_mtsi packer, where it attempts to call NtProtectVirtualMemory with invalid memory protection constants.
Detects instances where msbuild.exe is used to execute project files (.proj) from suspicious or uncommon directories. Adversaries may abuse MSBuild to proxy execution of malicious code, often placing these project files in temporary or public user directories to evade detection.
This rule detects the presence of known malicious browser extensions, specifically "Zoom Stealer Extension" and "Shady Panda Extension", by looking for their unique Extension IDs within file paths or file names on devices. It identifies the first and last seen timestamps, the names of the extensions, their IDs, associated campaigns, and the browsers they target, summarizing this information per device.
This rule detects several suspicious activities often associated with post-exploitation and defense evasion. It identifies PowerShell commands used for recursively searching for msbuild.exe, tampering with Windows Defender settings (disabling real-time monitoring or adding exclusions), and downloading files from the internet to common temporary or application data directories. Additionally, it flags msbuild.exe executing suspicious .proj files from temporary directories, and any executable launched from temporary or program data folders by PowerShell or MSBuild. The rule also includes detection for persistence via .url file creation in the Startup folder and the dropping of specific suspicious files (.proj, pins.dat, staxs.exe, tybd7.exe) by PowerShell or MSBuild in temporary or program data directories.
This rule detects network connections from devices to a predefined list of known malicious domains. It identifies attempts by internal systems to communicate with command and control servers, phishing sites, or other infrastructure associated with threat actors.
This detection aims to identify suspicious popup activity on devices by analyzing process events that launch notifications. The query focuses on detecting referrers that generate multiple unique popup URLs, which could indicate potentially malicious behavior.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
You can use this to check for potential browser popups generated by malicious sites gaining notification permission on a browser before they lead to further compromise of a host.
This rule detects the creation of files with specific malicious extension IDs on devices. These extensions are typically associated with browser-based malware or unwanted programs that modify browser behavior, steal data, or perform other malicious activities. The rule specifically looks for `FileCreated` events where the `FileName` matches any of the predefined malicious extension IDs.
This rule detects suspicious batch (.bat) file creation events by monitoring for several indicators. It flags batch files created by processes using command lines indicative of downloads (e.g., 'http:', 'https:', 'iwr', 'iex', 'invoke'), batch files created by suspicious executables ('curl.exe', 'mshta.exe'), batch files placed in high-risk directories ('\Users\Public\', '\Start Menu\Programs\Startup\'), or batch files exceeding a size threshold of 5MB. The rule explicitly excludes processes named 'java.exe' or 'javaw.exe' from triggering alerts.
This rule detects network connections or URL click events to a list of domains known to be associated with phishing or malware distribution. The rule specifically looks for connections to these domains that also contain certain path segments like '/wlc/', '/load/', or '/success/', which are often indicative of malicious activity or payload delivery. It also broadly checks for any URL click events containing these suspicious domains.
Page 459 of 509