Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,839 detections
Filters
Last updated
All Time
Detection languages
5,629
1,822
1,261
860
754
Contributors
3,246
2,040
1,233
910
828
Categories
20,456
11,839
5,876
5,155
4,865
Platforms
9,739
2,542
1,172
276
100
Products / Services
3,075
2,979
2,352
1,065
955
MITRE Techniques
6,777
3,901
2,671
2,014
1,827
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
Detects files written under Magento pub/media/custom_options/quote by a web server or PHP process, and flags when a subsequent process command line references the uploaded file, indicating potential web shell activity.
Detects msiexec.exe spawning scripting or programming engines (such as PowerShell or Python) that perform LDAP directory searches and establish outbound external network connections within a specific time window.
Detects an SSH process establishing local port forwarding to a Unix socket (such as docker.sock) or a path containing a socket, followed shortly after (within 15 minutes) by non-administrative tool access to sensitive files like /etc/shadow or Docker sockets on the same device.
Detects command-line execution of script interpreters (PowerShell, CMD, MSHTA) spawned via Windows Explorer containing download primitives and URLs, followed by immediate external network connections.
The KQL rule detects a ClickFix-style technique in which script hosts reference files disguised with an f_* naming pattern in browser profile cache directories. The key behavioural indicators are:
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
- Script hosts such as wscript.exe, cscript.exe, and mshta.exe referencing browser cache paths.
- Suspicious parent processes, including Explorer, command shells, and script hosts.
- Creation, modification, or renaming of t.vbs under the user's Temp directory by Windows Script Host.
Detects a sequence where a process is launched from or references the hidden /tmp/.x directory (indicative of cryptominer deployment), followed within 30 minutes on the same device by a process-check command (such as ps, top, or htop) referencing XMRig or /tmp/.x.
Detects Microsoft Word (winword.exe) spawning the Windows command shell (cmd.exe) to execute batch scripts (.bat or .cmd files). This behavior is commonly associated with malicious document macros attempting to drop and execute secondary payloads, excluding common system paths to reduce false positives.
Detects PowerShell processes combining local loopback listener terms (such as HttpListener or TcpListener) and authentication or web request cmdlets referencing 127.0.0.1 or localhost, correlated with local network loopback connections.
Detects node or agent-initiated npm installation commands (such as npm install or npm i) executed within 24 hours of creating or modifying a developer assistant instruction file (such as AGENTS.md, CLAUDE.md, .cursorrules) in common user directories like Downloads, Desktop, or Temp.
Detects instances where web server processes or PHP interpreters (apache2, httpd, php-fpm, php) spawn a shell process (sh, bash, dash). This behavior is often indicative of post-exploitation activity such as remote code execution (RCE) via PHP session upload progress or web shell activity.
Detects the execution of the Chisel tunneling tool configured as a client building a reverse SOCKS tunnel with flags such as TLS verification disabled, keepalive, or authentication, or communicating with a known C2 endpoint.
Detects the execution of tooling routed through a reverse SOCKS5 pivot via wrappers such as via_socks.sh, proxychains4 with a SOCKS5 configuration, or LD_PRELOAD injection of libproxychains.so.
Detects when a Java or JavaW process spawns a Unix shell (bash, sh, dash) with command-line arguments indicative of a reverse shell utilizing /dev/tcp and interactive shell flags.
Detects PaperCut server processes (such as pc-app.exe, pc-server.exe, or Java running PaperCut) spawning command shells or utility binaries associated with credential dumping, internal reconnaissance, or pivoting.
Detects a sequence where PowerShell downloads an .msi file from Azure Blob storage (blob.core.windows.net), followed by msiexec.exe spawning PowerShell on the same device within 30 minutes.
Detects suspicious post-exploitation activities, reconnaissance, and command execution originating from web server and PHP lineage processes, indicating potential webshell activity or compromised web applications.
Detects a PaperCut server Java process spawning a local account creation or local administrators group addition, followed closely by Active Directory domain or computer enumeration from the same host within a 30-minute window.
Detects instances where the Apache web server spawns a shell process (sh, dash, bash) which subsequently executes common discovery or callback utilities (such as id, curl, wget, php, hostname, or uname), typically indicative of web application exploitation or remote code execution.
Detects WinRAR or 7-Zip extracting an archive with a hard-coded password supplied via command line from a cmd.exe batch parent, using switch patterns associated with the RareWolf AnyDesk dropper.
Detects instances where a browser process (Chrome, Edge, Firefox, Brave) is observed on a device shortly before an explorer.exe-initiated PowerShell, PWSH, or CMD process executes a command containing download strings or script execution patterns (such as DownloadString, Invoke-WebRequest, IEX, or encoded commands) referencing URLs.
Detects web server processes (such as apache2, httpd, nginx, php-fpm) spawning a shell or curl process that performs LDAP queries using curl against URLs. This activity is indicative of Remote Code Execution (RCE) vulnerabilities being exploited against web applications to perform internal reconnaissance or LDAP enumeration.
Page 3 of 564