Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the creation of a shortcut (.lnk) file within the Windows startup folder using PowerShell. The rule monitors for PowerShell processes executing commands to create .lnk files (e.g., via WScript.Shell) or directly monitors file creation events targeting the startup directory. This behavior is indicative of malicious persistence mechanisms.
Detects the addition of exclusion paths to Microsoft Defender via PowerShell (Add-MpPreference or Set-MpPreference) initiated by non-Microsoft signed processes or specific messaging applications. This behavior is often indicative of malware attempting to exclude malicious payloads from security scanning.
This rule detects the execution of cmd.exe with a command line containing both '/k' and 'Set' commands, alongside a regex pattern that searches for specific variable expansion techniques ('%var:~offset,length%'). This pattern is frequently used to obfuscate command lines or bypass static security signatures by reconstructing strings at runtime, often in conjunction with PowerShell commands.
Detects instances where a GitLab runner process (gitlab-runner.exe) spawns a PowerShell process with arguments typically used to execute scripts while bypassing security restrictions, such as -NoProfile, -NonInteractive, -ExecutionPolicy, and Bypass. This pattern is indicative of automated task execution or potential abuse if the runner environment is compromised.
This rule detects the execution of specific suspicious batch scripts (e.g., 'bd_test_k7old.bat') via cmd.exe, or the creation of a Windows service involving kernel drivers using sc.exe, which may indicate testing of defensive mechanisms or the deployment of potentially malicious kernel-level components.
Detects instances where the Cursor IDE (or associated helper processes) spawns a child process or executes a command involving a specific 'DevOps-Automation/cloudshield' path. This monitors for potential abuse of IDE environments to trigger sensitive automation scripts, possibly indicating malicious use of IDE tooling or unauthorized development activities.
Detects signs of malicious activity involving specific files (StreamServiceSharedBridge.ps1, ComponentTask33Agent) and behaviors, including PowerShell execution, scheduled task creation, script execution via wscript, and registry run key modification. These behaviors are indicative of persistence mechanisms and potentially suspicious command execution.
Detects the use of PowerShell to delete .js files located within the 'Downloads' directory. This behavior is commonly associated with cleanup of dropped malicious payloads or script-based malware artifacts.
Detects suspicious PowerShell command lines indicative of process termination or abnormal enumeration of .NET Framework process directories via WMI. This includes using Stop-Process against specific proxy execution binaries or using Get-CimInstance to inspect sensitive .NET framework directory structures, which may be associated with process hollowing or security product interference.
Detects PowerShell instances executing 'Stop-Process' against known living-off-the-land binaries (LotLBin) or PowerShell processes explicitly terminating these specific binaries. This behavior is often associated with process hollowing, anti-forensics, or attempts to clear space for malicious code injection by terminating security or system-related tools.
Detects the use of PowerShell to perform a web request to google.com to download a file named Document.pdf, followed by the immediate execution of that downloaded file using Start-Process.
Detects the execution of specific web browsers (Chrome, Edge, Opera) to facilitate identification of vulnerable browser versions as indicated by CVE-2026-0628 and CVE-2026-55945. This rule does not perform version checking directly but serves as a telemetry trigger for external asset inventory correlation.
The following analytic identifies a process command line referencing the IronLanguages GitHub repository, which hosts .NET implementation of popular scripting engines.
Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads.
This activity is uncommon in typical enterprise environments outside of software development contexts.
Adversaries have downloaded these .NET implementations to avoid getting detected by security controls while executing their payloads.
This activity is uncommon in typical enterprise environments outside of software development contexts.
Detects the creation, modification, or execution of known malicious files associated with the Kimsuky threat actor, based on a static list of MD5 hashes observed in their campaigns.
Detects process command lines containing LLM tool-calling syntax (e.g., 'tool_call', 'function_call') in conjunction with keywords associated with offensive security capabilities (e.g., 'exploit', 'mimikatz', 'exfiltrate'). This pattern is consistent with the behavior of malicious LLM-based agents attempting to autonomously invoke and execute offensive tasks.
This rule detects when the Node.js runtime process (node.exe) initiates the Windows command interpreter (cmd.exe) with the '/c' flag, which is commonly used to execute commands or scripts. This behavior is frequently associated with malicious Node.js activity, such as Remote Access Trojans (RATs) or web shells, which may use the shell to execute system-level operations or bypass typical application constraints.
Detects the execution of a renamed Microsoft CoreCLR Debugger (vsdbg.exe) from a directory outside of standard Visual Studio installation paths. This behavior is indicative of DLL side-loading, where a malicious vsdbg.dll is planted alongside the renamed vsdbg.exe, a technique observed in malware loader chains like Rapuncel/BoryptGrab.
This rule detects the execution, file presence, or driver loading associated with 'EDRKiller' and 'WarsawKiller', which are malicious tools used to terminate or disable endpoint security products.
Detects the execution or presence of AnyDesk.exe within directories containing 'UBP-Asset' that are outside of known, legitimate installation paths. This behavior often indicates an adversary attempting to use remote access software for persistent access or command and control, commonly disguised within unconventional directories.
Detects the execution or presence of AnyDesk.exe within directories containing 'UBP-Asset' that are outside of known, legitimate installation paths. This behavior often indicates an adversary attempting to use remote access software for persistent access or command and control, commonly disguised within unconventional directories.
Detects sensitive cPanel/WHM administrative commands or system file modifications occurring within one hour of a suspected authentication bypass event, indicative of potential post-exploitation activity related to CVE-2026-41940.
Page 141 of 977