Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,864
5,884
5,164
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Sweeps Defender XDR telemetry for known NEBULA / KNTRAT indicators (SHA256 hashes, C2 IP, decoy domain and URLs, burner publisher emails). Hash matching is scoped per table (execution hash only in process events), noisy tooling is excluded from command-line matches, network hits are limited to connection events, and results are aggregated per device and IOC.
The following analytic detects the execution of a process by `WmiPrvSE.exe`, indicating potential use of WMI (Windows Management Instrumentation) for process creation. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process relationships. This activity is significant as WMI can be used for lateral movement, remote code execution, or persistence by attackers. If confirmed malicious, this could allow an attacker to execute arbitrary commands or scripts, potentially leading to further compromise of the affected system or network.
Detects an agentic AI application (e.g., Claude Code, ChatGPT Codex) directly
spawning a package manager install command (npm install / pip install). As enterprise
adoption of agentic coding and automation tools spreads beyond developer workstations into
marketing, HR, finance, and operations, these tools autonomously pull open-source packages
from npm and PyPI on behalf of non-developer users. CrowdStrike reports poisoned packages
(e.g., 131 AI framework packages by STARDUST CHOLLIMA, 300+ dependencies in a single day by
ALTERED SPIDER) are increasingly pulled into environments this way, giving adversaries a path
to endpoints that never had traditional developer tooling scrutiny.
spawning a package manager install command (npm install / pip install). As enterprise
adoption of agentic coding and automation tools spreads beyond developer workstations into
marketing, HR, finance, and operations, these tools autonomously pull open-source packages
from npm and PyPI on behalf of non-developer users. CrowdStrike reports poisoned packages
(e.g., 131 AI framework packages by STARDUST CHOLLIMA, 300+ dependencies in a single day by
ALTERED SPIDER) are increasingly pulled into environments this way, giving adversaries a path
to endpoints that never had traditional developer tooling scrutiny.
Detects suspicious command-line execution patterns involving Unix shells (bash, zsh, sh) spawned from terminal applications where tools like curl or wget are piped directly into a shell, base64 decoding is performed, osascript executes dialogs, or quarantine attributes are removed.
Detects the use of msxsl.exe or wmic.exe to process .xsl or .xslt files, potentially indicating the execution of embedded scripts. The rule calculates a risk score based on the combination of the utility name, the presence of an XSL/XSLT file reference in the command line, usage of suspicious file paths (e.g., Temp, AppData), and being launched by potentially suspicious parent processes like cmd.exe or powershell.exe.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
IOC sweep (SHA256, domains, URLs, IPs, sender emails) for the RedFlick-style VHDX/LNK/WebDAV campaign against Moldovan and Ukrainian civil society, with false-positive controls.
Detects a system shell interpreter being spawned directly by a Celery worker process.
This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context,
which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.
This behavior indicates a Python background task execution framework is evaluating raw string input through a shell execution context,
which is highly indicative of successful command or prompt injection exploitation against an LLM agent task.
The following analytic detects the modification of SSH Authorized Keys on Linux systems. It leverages process execution data from Endpoint Detection and Response (EDR) agents, specifically monitoring commands like "bash" and "cat" interacting with "authorized_keys" files. This activity is significant as adversaries often modify SSH Authorized Keys to establish persistent access to compromised endpoints. If confirmed malicious, this behavior could allow attackers to maintain unauthorized access, bypassing traditional authentication mechanisms and potentially leading to further exploitation or data exfiltration.
The following analytic detects MSIExec making network connections over ports 443 or 80. This behavior is identified by correlating process creation events from Endpoint Detection and Response (EDR) agents with network traffic logs. Typically, MSIExec does not perform network communication to the internet, making this activity unusual and potentially indicative of malicious behavior. If confirmed malicious, an attacker could be using MSIExec to download or communicate with external servers, potentially leading to data exfiltration, command and control (C2) communication, or further malware deployment.
Hunts for sqlservr.exe spawning command shells or system utilities, a pattern consistent with xp_cmdshell abuse. It also flags later steps from a public intrusion write-up: certutil decoding, SAM, SYSTEM or SECURITY hive saves and local account or group changes.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
Results are grouped per device and day and ranked by stage count. Rows can also appear without a SQL parent when two later stages occur on the same device and day.
Triage: Some jobs use xp_cmdshell legitimately. Review the command line and the account. Hunting query, not an alert.
Limitations: Activity inside the SQL process with no child process is not visible. Renamed tools, obfuscation and privilege escalation tools are not covered. Needs Defender for Endpoint on the SQL servers.
This rule monitors endpoint telemetry for indicators of compromise (IOCs) associated with known malicious activity. It checks for file creation, process execution, and network connections that match a defined list of malicious file hashes (SHA256, SHA1, MD5), C2 IP addresses, and malicious domains or URL patterns.
Detects the use of vim and its siblings commands to execute a shell or proxy commands.\nSuch behavior may be associated with privilege escalation, unauthorized command execution, or breaking out from restricted environments.
Detects creation of a scheduled task named "Windows Defender Advanced
Threat Protection Service" configured to run at system startup with SYSTEM privileges
and launch an executable named defender.exe. HoneyMyte (Mustang Panda) used this exact
schtasks command to establish boot persistence for the CoolClient backdoor sideloader,
masquerading the task and binary as a legitimate Windows Defender component.
Threat Protection Service" configured to run at system startup with SYSTEM privileges
and launch an executable named defender.exe. HoneyMyte (Mustang Panda) used this exact
schtasks command to establish boot persistence for the CoolClient backdoor sideloader,
masquerading the task and binary as a legitimate Windows Defender component.
Detects execution of the XMRig Monero cryptominer or a miner
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
launched with XMRig-specific pool and tuning arguments. In the AhsayCBS
exploitation campaign attackers dropped XMRig onto compromised backup
servers to hijack CPU resources for Monero mining, severely degrading
server performance. Detection keys on XMRig binary names and the mining
command-line grammar (stratum pool URLs, donate-level and thread-hint flags).
The following analytic detects the execution of ngrok.exe on a Windows operating system. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because while ngrok is a legitimate tool for creating secure tunnels, it is increasingly used by adversaries to bypass network defenses and establish reverse proxies. If confirmed malicious, this could allow attackers to exfiltrate data, maintain persistence, or facilitate further attacks by tunneling traffic through the compromised system.
This rule monitors for potentially malicious use of Windows Subsystem for Linux (WSL) binaries. It detects the execution of common command-line tools for reconnaissance, download, or lateral movement within the WSL environment, identifies the use of WSL to execute Windows 'living-off-the-land' binaries (Lolbins), and flags the installation of WSL components.
Detects the use of system utilities (wevtutil, PowerShell, wmic, etc.) or log-reading tools (grep, tail) for log enumeration or export when executed by processes that are not standard management or monitoring agents. This pattern is commonly associated with adversary efforts to gain situational awareness or identify security logs.
Detects the execution of the SCCM/Configuration Manager notification utility (SCNotification.exe) when it is unsigned or has an invalid/expired signature, excluding standard loaded modules from .NET and assembly directories.
The following analytic detects the use of Ntdsutil to export the Active Directory database (NTDS.dit). It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line arguments. This activity is significant because exporting NTDS.dit can be a precursor to offline password cracking, posing a severe security risk. If confirmed malicious, an attacker could gain access to sensitive credentials, potentially leading to unauthorized access and privilege escalation within the network.
Page 17 of 976