Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,503 detections
Filters
Last updated
All Time
Detection languages
8,116
7,176
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,503
11,883
5,887
5,179
4,868
Platforms
18,098
3,056
1,506
124
104
Products / Services
5,727
4,305
3,717
1,175
958
MITRE Techniques
9,495
7,578
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of the Windows 'net' or 'net1' utility to connect to the hidden 'IPC$' inter-process communication share. This behavior is often associated with lateral movement, reconnaissance, or establishing authenticated sessions to remote systems for further malicious activity, such as remote command execution.
This rule logs the execution of 'UBPUpdater.exe'. While the purpose of this binary is not inherently malicious, tracking its execution can be useful for auditing software updates or identifying unauthorized applications running on the system.
Detects instances where a process named UBP.Exe spawns a child process named HTSPnew.Exe, specifically when both binaries reside within the same directory path containing 'UBP'. This behavior may indicate an application-specific pattern or potentially malicious execution where one component of a suite invokes another.
Detects instances where cmd.exe or wscript.exe are executed from explorer.exe or via a .lnk file, which is a common pattern for initial access and execution of malicious payloads, often seen in spearphishing scenarios involving obfuscated or disguised files.
This rule detects potential ransomware activity by monitoring for specific file naming patterns associated with known ransom notes (.krsid, README_KRSID.Txt) and the execution of suspicious processes (HTSPnew.Exe, UBPUpdater.exe).
Detects execution of processes associated with QuasarRAT or references to its configuration files, originating from or involving files and processes named 'UBPUpdater.exe' or 'UBPPatch.Psh'. Also identifies network connections via FTP or involving configuration files ('config.Ini') initiated by these specific processes, which may indicate malicious activity, command and control, or data exfiltration.
This rule detects potentially malicious file manipulation activities, such as renaming, moving, copying, or deleting files, specifically when involving targeted filenames (e.g., 'GymTraniningShedule.exe') or locations (e.g., 'SystemFolder32'). The detection monitors for suspicious command-line arguments executed by 'cmd.exe' or 'conhost.exe' and cross-references them with file deletion events involving '.lnk' files or specific application artifacts.
Detects the use of mklink.exe or cmd.exe with mklink arguments to create symbolic links associated with specific file paths (ProgramData\doxc) or specific suspicious filenames (hzwzucr_widsisa.exe). This behavior is often associated with malware persistence or evasion, where adversaries link malicious binaries to disguise their location or execution source.
Detects macOS shell processes (bash/sh/zsh) executing curl to fetch portable Python bootstrap files from known indicators associated with CRPx0/ClickFix campaigns. This typically involves downloading python-build-standalone environments or staging scripts from external endpoints.
This rule detects the installation or modification of ScreenConnect services on Windows endpoints. It monitors for the creation of services using 'sc.exe', process commands related to ScreenConnect setup executables, or registry modifications and service installations associated with specific ScreenConnect identifiers, often indicative of unauthorized remote management software installation.
This rule detects a correlation between host-level reconnaissance activity using WMI (via PowerShell or WMIC) to query system information, followed by network exfiltration to a known C2 IP address over a specific URI within a 10-minute window.
This rule detects a correlation between host-level reconnaissance activity using WMI (via PowerShell or WMIC) to query system information, followed by network exfiltration to a known C2 IP address over a specific URI within a 10-minute window.
Detects processes running from user-writable locations (Temp/AppData/Public/Downloads) creating a self-referential Windows Firewall allow rule via netsh, consistent with NJRAT establishing outbound C2 connectivity while evading network-based blocking.
Detects the use of command-line tools like find and grep to recursively search the filesystem for files containing sensitive information, such as configuration files, environment variables, database credentials, and digital wallet keys. This behavior is indicative of an attacker performing automated discovery of credentials and secrets.
This rule detects a high volume of unique command executions within a short time window where the command lines contain patterns resembling developer or script comments (e.g., # or // followed by keywords like 'attempt', 'retry', 'diagnos'). The threshold-based logic (over 600 unique commands in less than 1 hour) combined with high-frequency retry attempts suggests automated or scripted activity, potentially indicative of automated exploitation frameworks, reconnaissance, or brute-force tools that include verbose logging or internal notes within the command execution.
Detects instances where browser processes or related credential files are accessed or targeted by process termination (e.g., taskkill.exe) followed by attempts to access sensitive files like Login Data, logins.json, or key4.db. This pattern is indicative of credential theft from web browsers.
Detects the execution of common Windows command-line tools (such as cmd, powershell, or wmic) being used to query system information related to security configurations, antivirus status, firewall status, or installed security products. This behavior is indicative of an adversary performing reconnaissance to understand the defensive landscape of a compromised host.
This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.
This rule detects network connections or process command lines associated with known malicious domains, IP addresses, or payload URLs. Additionally, it correlates connections to common public file-sharing platforms or APIs (e.g., Gofile, Telegram) if these events occur on the same device within a 60-minute window of a confirmed malicious infrastructure event, reducing false positives from legitimate uses of shared infrastructure.
Detects the execution of AutoIt3 scripts using mshta.exe as the parent process from suspicious or non-standard directories such as Temp, Downloads, or AppData. This behavior is indicative of an attempt to bypass application execution policies or obfuscate malicious script execution.
This rule detects the execution of arbitrary commands via the Windows Subsystem for Linux (WSL) by monitoring process creation events where 'wsl.exe' is the executable. It specifically looks for command lines that include flags like '--exec' or '-e', or common shell commands and downloaders such as 'curl', 'wget', 'bash -c', 'sh -c', 'nc ', or 'ncat '. This activity can indicate an adversary leveraging WSL to execute malicious code or bypass security controls.
Page 214 of 977