Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,480 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,166
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,480
11,864
5,884
5,164
4,867
Platforms
18,083
3,046
1,506
124
104
Products / Services
5,723
4,293
3,713
1,173
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
The following analytic identifies a LOLBAS process being executed where it's process name does not match it's original file name attribute.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
The LOLBAS project documents Windows native binaries that can be abused by threat actors to perform tasks like executing malicious code.
This rule detects the use of 'docker cp' or 'sbx cp' commands which are susceptible to the CVE-2026-17106 (CopyEscape) vulnerability. This vulnerability allows a compromised container to perform arbitrary file writes or overwrites on the host system during archive extraction, potentially leading to container escape and privilege escalation by replacing critical system binaries like runc.
Detects a node/npm/npx process writing to a Unix shell startup file (.zshrc, .zprofile, .bashrc, .bash_profile) immediately after package install activity. STARDUST CHOLLIMA (DPRK-nexus) used stolen maintainer credentials to compromise the Axios npm package and deliver platform-specific "ZshBucket" malware, and separately injected a malicious dependency into 131 Mastra AI framework packages. Malicious postinstall scripts modifying shell profiles is a persistence mechanism consistent with this campaign's naming and delivery pattern.
Detects execution of esxcli syslog configuration commands where the command
itself is reconstructed at runtime from hex escape sequences, octal escape sequences, an
awk BEGIN block, or a Python chr()-based decoder before being reset against loghost.
CrowdStrike cataloged this pattern across 21 ESX BusyBox obfuscation techniques used to
hide 'esxcli system syslog config set --reset=loghost' from cleartext shell log review.
Threat actors including SCATTERED SPIDER, BlackBasta, Royal/BlackSuit, and Akira use this
to sever centralized log forwarding from a compromised ESXi host immediately before
encrypting the datastore.
itself is reconstructed at runtime from hex escape sequences, octal escape sequences, an
awk BEGIN block, or a Python chr()-based decoder before being reset against loghost.
CrowdStrike cataloged this pattern across 21 ESX BusyBox obfuscation techniques used to
hide 'esxcli system syslog config set --reset=loghost' from cleartext shell log review.
Threat actors including SCATTERED SPIDER, BlackBasta, Royal/BlackSuit, and Akira use this
to sever centralized log forwarding from a compromised ESXi host immediately before
encrypting the datastore.
Detects a behavioral chain where PowerShell stages a hidden base64-encoded command and schedules a VBScript task, or PowerShell fetches an upgrade.txt file via web client methods for execution.
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
This rule monitors endpoint telemetry (DNS queries, network connections, file creation, and process execution) to identify matches against a predefined list of known malicious indicators, including IP addresses, domains, and file hashes (SHA256). The rule differentiates between confirmed malicious activity and low-confidence indicators, providing a prioritized view of potential threats.
Detects a behavioral chain where PowerShell stages a hidden base64-encoded command and schedules a VBScript task, or PowerShell fetches an upgrade.txt file via web client methods for execution.
Detects PowerShell execution performing port checks across multiple internal hosts using Test-NetConnection in a looping construct with output redirected to a log file, indicative of post-compromise reconnaissance (such as LONEPAGE scanning).
Detects the execution of MATCHBOIL malware variants (PlannerAssistantManager.exe or RegularExpressionExplorer.exe) using specific command-line arguments (-auto, -plans, -renew) which trigger C&C logic.
Detects PowerShell processes invoked with obfuscated command lines that enumerate Microsoft.PowerShell.Utility
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
exported commands and invoke cmdlets indirectly by array index. This technique is used to evade
detections that look for explicit strings such as Invoke-RestMethod or Invoke-Expression.
The following analytic identifies a popular 3rd party software process being executed where it's process name does not match it's original file name attribute.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
Processes that have been renamed and executed may be an indicator that an adversary is attempting to evade defenses or execute malicious code.
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
Detects potential remote shell behavior where a process named libgcrypt establishes an outbound connection on TCP port 9999 and spawns a shell (such as sh, bash, dash, zsh, or ash) within a short time window.
Detects a suspected ClickFix social engineering attack where a user is tricked into pasting malicious commands into Windows Terminal, leading to a PowerShell download, followed by the appearance of specific known malicious artifacts (LockScreenContentServer.exe, dui70.dll, or 1.bat) within 15 minutes on the same device.
This detection identifies potential abuse of SSH "ProxyCommand" or "LocalCommand" by monitoring for suspicious process execution patterns.
Specifically, it looks for instances where ssh.exe (as a parent process) containing "ProxyCommand" or "LocalCommand" in its arguments spawns potentially malicious child processes like mshta, powershell, wscript, or cscript, or processes containing "http" in their command line.
This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands.
Specifically, it looks for instances where ssh.exe (as a parent process) containing "ProxyCommand" or "LocalCommand" in its arguments spawns potentially malicious child processes like mshta, powershell, wscript, or cscript, or processes containing "http" in their command line.
This technique can be used by attackers to execute arbitrary commands through SSH proxy configurations, potentially enabling command & control activities or remote code execution. The detection focuses on commonly abused Windows scripting engines and web requests that may indicate malicious activity when spawned through SSH proxy commands.
The following analytic detects the execution of programs initiated by forfiles.exe. This command is typically used to run commands on multiple files, often within batch scripts. The detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process creation events where forfiles.exe is the parent process. This activity is significant because forfiles.exe can be exploited to bypass command line execution protections, making it a potential vector for malicious activity. If confirmed malicious, this could allow attackers to execute arbitrary commands, potentially leading to unauthorized access or further system compromise.
The following analytic detects programs initiated by pcalua.exe, the Microsoft Windows Program Compatibility Assistant. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process and parent process information. While pcalua.exe can start legitimate programs, it is significant because attackers may use it to bypass command line execution protections. If confirmed malicious, this activity could allow attackers to execute arbitrary commands, potentially leading to unauthorized actions, privilege escalation, or persistence within the environment.
The following analytic detects modifications to the Windows error recovery boot configurations using bcdedit.exe with flags such as "recoveryenabled" and "no". It leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names, parent processes, and command-line executions. This activity is significant because ransomware often disables recovery options to prevent system restoration, making it crucial for SOC analysts to investigate. If confirmed malicious, this could hinder recovery efforts, allowing ransomware to cause extensive damage and complicate remediation.
The following analytic identifies instances of control.exe loading a .cpl or .inf file from a writable directory, which is related to CVE-2021-40444. This detection leverages data from Endpoint Detection and Response (EDR) agents, focusing on process names and command-line executions mapped to the `Processes` node of the `Endpoint` data model. This activity is significant as it may indicate an attempt to exploit a known vulnerability, potentially leading to unauthorized code execution. If confirmed malicious, this could allow an attacker to gain control over the affected system, leading to further compromise.
The following analytic detects the creation or deletion of Windows shares using the net.exe command. It leverages Endpoint Detection and Response (EDR) data to identify processes involving net.exe with actions related to share management. This activity is significant because it may indicate an attacker attempting to manipulate network shares for malicious purposes, such as data exfiltration, malware distribution, or establishing persistence. If confirmed malicious, this activity could lead to unauthorized access to sensitive information, service disruption, or malware introduction. Immediate investigation is required to determine the intent and mitigate potential threats.
Page 21 of 976