Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
11,847 detections
Filters
Last updated
All Time
Detection languages
5,637
1,822
1,261
860
754
Contributors
3,246
2,040
1,233
910
828
Categories
20,460
11,847
5,879
5,158
4,866
Platforms
9,745
2,545
1,173
276
100
Products / Services
3,075
2,985
2,353
1,065
955
MITRE Techniques
6,780
3,901
2,671
2,015
1,829
CVEs
21
19
18
14
14
IDS Classtypes
75
31
26
19
19
IDS Protocols
102
68
10
5
3
This rule correlates email attachment delivery events with subsequent process creation events on the recipient's endpoint. It identifies scenarios where a known document reader or mail client (Outlook, Word, Excel, PowerPoint, Adobe Acrobat/Reader) spawns a suspicious child process (PowerShell, CMD, WScript, CScript, MSHTA, Rundll32, or Regsvr32) shortly after a file is delivered via email to the same user. This detects the immediate execution phase of a phishing attack.
Detects the use of command-line tools such as rclone, aws CLI, gsutil, and curl to upload files associated with machine learning models (e.g., weights, checkpoints, training datasets) to public cloud storage or AI model hosting platforms. This pattern may indicate the exfiltration of sensitive proprietary AI research or training data.
Detects instances where a Python-based machine learning framework (identifiable by command-line arguments related to model loading like pickle or PyTorch loading functions) spawns a suspicious child process, such as a shell or network utility. This behavior indicates a potential malicious machine learning model, such as a booby-trapped pickle file, executing arbitrary code upon deserialization.
This rule detects interactive or user-triggered execution of PowerShell carrying indicators of payload downloading, inline evaluation, or Base64 encoding. Because explorer.exe is the parent process, it typically signifies a payload delivered via email/web that a user opened directly such as an .lnk shortcut.
This rule detects suspicious activity where a node.exe process, often associated with a node-pty terminal emulation, launches common Windows command-line shells (cmd.exe, powershell.exe) from specific file paths or directories. This behavior is indicative of a Node.js-based Remote Access Trojan (RAT) or shell spawning mechanism being used to establish command and control or persistence on a Windows host.
Detects a multi-stage attack chain involving the download, extraction, permission modification, and execution of the XMRig cryptocurrency miner on Linux systems. The rule specifically monitors for common staging patterns in /tmp and the use of known mining-related CLI arguments.
Detects a suspicious execution chain where a command shell (cmd.exe) launched by explorer.exe uses curl.exe to download an MSI file from Azure Blob Storage, followed immediately by the installation of that MSI using msiexec.exe. This pattern is indicative of common malware delivery techniques, such as those observed with the RVTools.lnk delivery chain.
Detects a sequence of activity indicative of beacon-like behavior: initial domain reconnaissance using commands such as 'net', 'systeminfo', or 'nltest', followed by the execution of 'rundll32.exe' without command-line arguments, and subsequent LDAP (port 389) communication to a domain controller, all occurring within a short timeframe.
Detects the creation of a scheduled task using the 'schtasks.exe' utility where the task name is 'MultiUpdater' and the task definition is imported from a file with a specific naming convention and extension (mgk, tmp, or xml) in the root directory.
Detects the execution of rundll32.exe with a command line referencing a DLL file stored in the C:\ProgramData directory. This pattern is commonly used by adversaries to execute malicious code while masquerading as legitimate system activity, particularly when initiated by command shell or browser processes.
Detects a sequence of suspicious process executions related to the 'RemoteAgent' application, specifically monitoring for MSI-based installations, NSSM service management, and API checks across a device. The rule aggregates distinct process events per device and flags if two or more distinct indicators are identified within a 14-day window.
Detects the specific network-observable behavior of the JWR client engine. The rule identifies a device loading the engine script (main.js) followed within a short time window by either a fallback redirection to a_index.html or the initiation of a WebSocket connection using a specific obfuscated path pattern associated with JWR command and control.
Detects the execution of ServiceModelReg.exe from the standard .NET Framework directories. While this utility is a legitimate tool used for registering and configuring WCF components, its abuse has been observed in the wild by threat actors, including the OnyxC2 malware, to leverage built-in Windows utilities for suspicious activities.
Detects the execution of a specific VBScript file 'Telegram_Private_Call_Session.vbs' via WScript, or its execution when spawned as a child process of MSHTA. This behavior is indicative of an HTA-dropped malicious script attempting to execute.
Detects the suspicious initiation of Control Panel applet functionality via the COM object 'COpenControlPanel'. Adversaries may leverage this COM interface or the associated 'CPL_INIT' message to proxy malicious code execution through standard Windows processes like dllhost.exe or rundll32.exe, effectively bypassing security controls that might otherwise flag the direct execution of malicious .cpl files.
Detects the execution of PowerShell with flags designed to bypass execution policies (-NoProfile, -NonInteractive, -ExecutionPolicy Bypass) directly spawned by a GitLab Runner process. This behavior is associated with the abuse of GitLab CI/CD runners as a Command and Control (C2) mechanism to execute unauthorized commands on build infrastructure.
Detects the creation or execution of a scheduled task masquerading as a Microsoft Update process. The task is configured to execute potentially malicious components, specifically identified by filenames such as userscreen.exe, UserInerfacePicture, or config.cat. This behavior is indicative of persistence and execution of malicious payloads, as seen in campaigns involving the NarwhalRAT loader.
Detects anomalous GitLab CI pipeline execution that matches patterns associated with GitRunner C2 abuse. The detection identifies pipelines triggered via API (CI_PIPELINE_SOURCE=api) with cloning disabled (GIT_STRATEGY=none) and a specific static job name (run_command), which can indicate the CI runner is being abused as a command-and-control channel for arbitrary script execution.
Detects cmd.exe processes utilizing variable assignment and dynamic substring expansion to reconstruct and execute obfuscated PowerShell commands, a technique frequently observed in malicious LNK file decoy campaigns to evade static signature detection.
FileFix lures append a real-looking file path after a '#' comment character so the Explorer address bar visually shows a benign path while the PowerShell prefix executes silently.
Detects the execution of MSBuild.exe when spawned by a PowerShell process. This is a common pattern for proxying execution of malicious code, such as the LxBaseRAT, by leveraging MSBuild's inline task capability to execute C# or VB.NET code within a signed Microsoft binary.
Page 66 of 565