Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,839 detections
Filters
Last updated
All Time
Detection languages
5,629
1,822
1,261
860
754
Contributors
3,246
2,040
1,233
910
828
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
9,739
2,542
1,172
276
100
Products / Services
3,075
2,979
2,352
1,065
955
MITRE Techniques
6,777
3,901
2,671
2,014
1,827
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects data staging and exfiltration preceding Play double extortion: WinRAR/RAR adding files to an archive (recursive or password-protected) followed within 4 hours by a WinSCP transfer from the same host and user.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Detects historical network connections, URL clicks, browser launches, email URLs, and process command lines associated with Wazza phishkit infrastructure IOCs including boegl-krysl.eu, coppietersrecherche.eu, and beacon-surge-sync.workers.dev.
Detects process execution where a shell (such as bash, zsh, cmd, or powershell) is spawned by a skill or openclaw process, and subsequently performs download activities (e.g., using curl, wget, invoke-webrequest) or establishes persistence (e.g., via cron, systemd, registry run keys, schtasks).
Detects a potential TeamPCP infostealer execution chain where a bash shell running setup.sh or entrypoint.sh spawns curl with POST or upload arguments.
The following analytic identifies the execution of tools built by NirSoft by detecting specific command-line arguments such as "/stext" and "/scomma". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because NirSoft tools, while legitimate, can be exploited by attackers for malicious purposes such as credential theft or system reconnaissance. If confirmed malicious, this activity could lead to unauthorized access, data exfiltration, or further compromise of the affected system.
The following analytic detects a process located in a potentially suspicious location making DNS queries to known URL shortening services, specifically tinyurl.
URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints.
While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.
URL shorteners are frequently used by threat actors to obfuscate malicious destinations, including phishing pages, malware distribution sites, or command-and-control (C2) endpoints.
While tinyurl.com is a legitimate service, its use in enterprise environments—particularly by non-browser processes or scripts—should be considered suspicious, especially if correlated with subsequent outbound connections, file downloads, process file path or credential prompts. Analysts should investigate the source process, execution context, and destination domain to determine intent and risk.
Detects network connections, process executions, file creations, and image loads associated with the UNC7017 AOMEI supply chain campaign IOC sweep, including specific malicious URLs, domains, IPs, file paths, and hashes.
Detects process execution reported by a Smokescreen decoy. A decoy runs no business
workload, so any process beyond the platform's own agent indicates an intruder has
reached the asset and is executing code on it.
Capture the command line in full: on a decoy it is uncontaminated by legitimate
activity and gives a clean view of attacker tooling and intent.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and process != ''
| groupby process, commandline, user, srcip
workload, so any process beyond the platform's own agent indicates an intruder has
reached the asset and is executing code on it.
Capture the command line in full: on a decoy it is uncontaminated by legitimate
activity and gives a clean view of attacker tooling and intent.
Onboarding: SMOKESCREEN is ingested via Syslog (CEF) (Bloo extractor 206).
Integration guide: https://bloo.io/docs/hypercloud/syslog-connector
BQL (Bloo Query Language):
stream=threat where sourcename='SMOKESCREEN' and action='THREAT_DETECTED'
and process != ''
| groupby process, commandline, user, srcip
Detects commands or file-write activity that configures a Tor ExitPolicy matching distinctive policy templates (Policy A or Policy B), indicating potential Tor relay or bridge deployment.
Detects the Shai-Hulud supply chain attack dead-man's switch: a gh-token-monitor persistence component followed by a recursive forced deletion of the user home directory, or the presence of the specific kill-switch string in a command line.
The following analytic detects the behavior of dumping credentials from memory by exploiting the Local Security Authority Subsystem Service (LSASS) using the comsvcs.dll and MiniDump via rundll32. This detection leverages process information from Endpoint Detection and Response (EDR) logs, focusing on specific command-line executions. This activity is significant because it indicates potential credential theft, which can lead to broader system compromise, persistence, lateral movement, and privilege escalation. If confirmed malicious, attackers could gain unauthorized access to sensitive information, leading to data theft, ransomware attacks, or other damaging outcomes.
Sweeps network, process command-line and URL-click telemetry for the Kimsuky payload C2 domain and its subdomains using an anchored match, which avoids lookalike or suffix-matching domains.
Detects the execution of Linux encryptors or binaries via the Windows Subsystem for Linux (WSL), utilizing tools like wsl.exe, wslhost.exe, or bash.exe with execution arguments or referencing ELF files, mount paths, and permission modifications.
Detects suspicious command-line execution patterns involving Unix shells (bash, zsh, sh) spawned from terminal applications where tools like curl or wget are piped directly into a shell, base64 decoding is performed, osascript executes dialogs, or quarantine attributes are removed.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects network connections, process command-line executions, and email URL info matching known APT28 (Swallowtail, HOOKEDGE, LegionRelay) indicators of compromise, including specific IP addresses and GUIDs.
Detects the use of msxsl.exe or wmic.exe to process .xsl or .xslt files, potentially indicating the execution of embedded scripts. The rule calculates a risk score based on the combination of the utility name, the presence of an XSL/XSLT file reference in the command line, usage of suspicious file paths (e.g., Temp, AppData), and being launched by potentially suspicious parent processes like cmd.exe or powershell.exe.
Detects an agentic AI application (e.g., Claude Code, ChatGPT Codex) directly
spawning a package manager install command (npm install / pip install). As enterprise
adoption of agentic coding and automation tools spreads beyond developer workstations into
marketing, HR, finance, and operations, these tools autonomously pull open-source packages
from npm and PyPI on behalf of non-developer users. CrowdStrike reports poisoned packages
(e.g., 131 AI framework packages by STARDUST CHOLLIMA, 300+ dependencies in a single day by
ALTERED SPIDER) are increasingly pulled into environments this way, giving adversaries a path
to endpoints that never had traditional developer tooling scrutiny.
spawning a package manager install command (npm install / pip install). As enterprise
adoption of agentic coding and automation tools spreads beyond developer workstations into
marketing, HR, finance, and operations, these tools autonomously pull open-source packages
from npm and PyPI on behalf of non-developer users. CrowdStrike reports poisoned packages
(e.g., 131 AI framework packages by STARDUST CHOLLIMA, 300+ dependencies in a single day by
ALTERED SPIDER) are increasingly pulled into environments this way, giving adversaries a path
to endpoints that never had traditional developer tooling scrutiny.
The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like "bash" and "cat" interacting with "authorized_keys" files. This activity is significant as adversaries often modify SSH Authorized Keys to establish persistent access to compromised endpoints. If confirmed malicious, this behavior could allow attackers to maintain unauthorized access, bypassing traditional authentication mechanisms and potentially leading to further exploitation or data exfiltration.
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
Page 13 of 564