Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects specific malicious processes (smdqservice.exe, winappx.exe) or suspicious paths associated with the CHOSEN BRICK malware suite writing image files (png, jpg, jpeg, bmp) to sensitive system directories. This activity typically precedes the exfiltration of sensitive desktop capture data to C2 infrastructure.
Detects known persistence binaries or suspicious file paths associated with the CHOSEN BRICK threat actor executing common discovery commands such as tasklist, systeminfo, and process enumeration scripts. This pattern aligns with the post-compromise reconnaissance phase performed prior to further malicious activity.
Detects a suspicious sequence of events where a suspected persistence binary (identified by name or path) performs system discovery using native tools (tasklist, systeminfo, wmic) followed by the creation of potential data exfiltration artifacts (screenshots or audio recordings) on the same device within a two-hour window.
Detects the execution of AutoIt3 scripts using mshta.exe as the parent process from suspicious or non-standard directories such as Temp, Downloads, or AppData. This behavior is indicative of an attempt to bypass application execution policies or obfuscate malicious script execution.
Detects the execution of AutoIt3 scripts using mshta.exe as the parent process from suspicious or non-standard directories such as Temp, Downloads, or AppData. This behavior is indicative of an attempt to bypass application execution policies or obfuscate malicious script execution.
Detects the execution of a potentially malicious, renamed AutoIT interpreter from a temporary directory, where the process command line or associated file activity involves a specific, obfuscated loader script (kojuyn.ini). The rule identifies behavioral patterns consistent with malware staging and execution, including the use of random filenames for both the interpreter and the script, characteristic of loaders using custom string deobfuscation and decryption routines.
Detects the initialization of the SEE_MASK_NOZONECHECKS environment variable within a PowerShell process command line. Setting this variable to '1' is a known technique used to suppress Windows zone-based security prompts (Mark-of-the-Web) for downloaded files, facilitating the execution of potentially malicious payloads.
Detects a suspicious sequence of Microsoft-signed .NET binaries (regsvcs.exe, installutil.exe, msbuild.exe, aspnet_compiler.exe) spawned by a single parent process in a short timeframe. This behavior is indicative of an attacker cycling through multiple trusted binaries in a fallback strategy to bypass application allowlisting or endpoint protection controls.
Detects the termination of 'wscript.exe' using 'taskkill.exe' or PowerShell 'Stop-Process'. This behavior is commonly used by malicious loaders to stop script-based execution after a payload has been staged or executed to minimize forensic artifacts and potential detection by defenders monitoring long-running processes.
Detects the Windows Script Host (wscript.exe or cscript.exe) executing files with suspicious double extensions, specifically those mimicking PDF documents (e.g., .pdf.js) or utilizing the .jse extension. This pattern is commonly associated with fileless initial execution lures, often seen in ClickFix-style or VEIL#DROP campaigns designed to trick users into executing malicious scripts.
This rule monitors for network connections to known command-and-control (C2) domains or DGA-patterned domains (ending in .icu or .cfd), as well as the execution or file creation of files matching known malicious SHA256 hashes.
This rule monitors for network connections to known command-and-control (C2) domains or DGA-patterned domains (ending in .icu or .cfd), as well as the execution or file creation of files matching known malicious SHA256 hashes.
This rule detects the use of 'npm' or 'node' to install packages from a registry other than trusted, standard registries (e.g., npmjs.org, GitHub). It specifically monitors command lines involving 'claude-code' that utilize custom, non-standard registry URLs. This behavior is indicative of potential supply chain attacks or the installation of unauthorized/malicious dependencies.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
This rule detects the execution of processes associated with CLI proxy routers (such as CLIProxyAPI or router-for-me) that establish network connections to multiple AI provider APIs (e.g., Anthropic, OpenAI, Google Gemini) within a short window. This pattern is indicative of efforts to bypass rate-limiting or allowlisting mechanisms commonly used by corporate environments to control and audit AI service interactions.
Detects instances where common Windows web server processes (w3wp.exe or UMWorkerProcess.exe) initiate suspicious child processes (cmd.exe, powershell.exe, etc.) within a short duration of a file modification event involving known potentially malicious DLL files (winfsp-x64.dll or DukeQt.dll), characteristic of web shell exploitation or post-compromise activity on Exchange/IIS servers.
Detects a cluster of host enumeration and system discovery commands (such as whoami, hostname, systeminfo, and network config queries) executed by the same process account within a short window, which is often indicative of post-exploitation reconnaissance.
Detects the creation of Windows services using sc.exe, powershell.exe, or cmd.exe that reference specific DLL files (winfsp-x64.dll or DukeQt.dll). This behavior is often associated with persistence mechanisms or DLL hijacking/side-loading techniques where a malicious service is configured to load a specific library.
Detects web server processes (e.g., w3wp.exe, nginx.exe, tomcat.exe) spawning command-line interpreters or utilities that could indicate remote code execution, web shell activity, or post-exploitation discovery/download attempts.
This rule monitors for the presence or execution of files matching a known set of SHA256 hashes associated with the 'DXSCAN' malware, utilizing both device file and process events.
This rule monitors for the presence or execution of files matching a known set of SHA256 hashes associated with the 'DXSCAN' malware, utilizing both device file and process events.
Page 200 of 977