Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,504 detections
Filters
Last updated
All Time
Detection languages
8,116
7,177
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,504
11,884
5,888
5,179
4,868
Platforms
18,099
3,056
1,506
124
104
Products / Services
5,727
4,306
3,717
1,175
958
MITRE Techniques
9,496
7,578
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the execution of the SentinelOne memory scanner process (SentinelMemoryScanner.exe) or the loading of the associated SentinelOne core library (SentinelAgentCore.dll) from a directory path outside of the standard SentinelOne installation locations (Program Files\SentinelOne or Program Files (x86)\SentinelOne). This behavior is indicative of potential masquerading or tampering where an adversary attempts to execute a renamed or moved security tool to bypass policy or evade detection.
This rule detects the execution of the SentinelOne memory scanner process (SentinelMemoryScanner.exe) or the loading of the associated SentinelOne core library (SentinelAgentCore.dll) from a directory path outside of the standard SentinelOne installation locations (Program Files\SentinelOne or Program Files (x86)\SentinelOne). This behavior is indicative of potential masquerading or tampering where an adversary attempts to execute a renamed or moved security tool to bypass policy or evade detection.
Detects instances where the Windows Management Instrumentation service (wmiprvse.exe) launches suspicious command-line interfaces or interpreters (PowerShell, CMD, cscript, etc.), or executes scripts from sensitive/temporary directories. The rule includes exclusions for common management tools to reduce noise.
Detects the use of net.exe to stop critical system services commonly associated with ransomware operations, such as volume shadow copies, security services, and Windows update services, to facilitate data encryption or prevent system recovery.
Detects the presence of OpnKey ransomware-specific configuration strings related to size-tiered file encryption settings in process command lines. These indicators suggest the execution of a binary with hardcoded logic to categorize files for encryption based on their size.
Detects suspicious modifications to browser 'Secure Preferences' files associated with known bypass techniques for extension integrity checks, coupled with browser process termination and subsequent relaunch using the --restore-last-session flag. This pattern is consistent with adversary activity attempting to inject malicious browser extensions by manipulating browser configuration files.
Detects potential local privilege escalation via Windows ALPC (Advanced Local Procedure Call) heap-based buffer overflow by identifying a non-SYSTEM Chrome process tree spawning child processes with SYSTEM privileges. The rule specifically monitors for suspicious child binaries or paths characteristic of exploit payloads while excluding legitimate Chrome update and crash handler processes.
Detects anomalous child processes spawned by a Chrome renderer process. This behavior is often indicative of exploitation attempts, such as the BlueMoon exploit kit leveraging CVE-2026-85046, where a compromised renderer attempts to escape the sandbox or execute arbitrary code in the host process.
Detects the execution of REAgentC.exe with the /disable command-line argument. This utility is used to manage the Windows Recovery Environment (WinRE). Adversaries often disable WinRE to prevent system recovery and impede incident response, often as a prelude to data destruction or ransomware attacks.
Detects the execution of the Windows Event Utility (wevtutil.exe) with the 'cl' (clear-log) command, specifically targeting multiple critical event logs simultaneously. This behavior is indicative of anti-forensic activity aimed at obfuscating post-compromise actions, as seen in the Settra ransomware campaign.
Detects Git checkout operations executed by AI coding agent processes that specify a full 40-character commit hash or use 'FETCH_HEAD'. This behavior is indicative of potential supply chain attacks, specifically the 'Plugin4Shell' vulnerability, where malicious actors attempt to force the agent to checkout arbitrary, potentially malicious, repository references.
Detects Git commands initiated by AI coding agent processes that perform a checkout of a specific 40-character SHA hash or a FETCH_HEAD reference. This behavior is potentially indicative of a supply chain attack where an AI plugin agent is being instructed to swap code components or load specific, potentially malicious, commit versions from a remote repository.
Detects PowerShell processes executing [Reflection.Assembly]::Load to load .NET assemblies directly into memory. This behavior is commonly used by fileless loaders such as StealC to execute malicious payloads while avoiding disk-based artifacts.
Detects malicious PowerShell activity using the -ExecutionPolicy Bypass flag combined with caret obfuscation or indicators related to known malicious infrastructure used in ClickFix-style social engineering campaigns. The rule specifically monitors for attempts to download or execute configuration.ps1 from identified attacker domains and IP addresses.
Detects the execution or deployment of MeshAgent, a legitimate Remote Monitoring and Management (RMM) tool, which is often abused by adversaries to maintain persistence and command-and-control access. The rule monitors for common process names such as meshagent.exe and mvtcs.exe, as well as command-line arguments containing 'meshagent'.
Detects the execution of reagentc.exe with the /disable flag, which is used to disable the Windows Recovery Environment (WinRE). This activity is often performed by ransomware actors prior to data encryption to prevent system recovery and hinder incident response.
Detects a successful VPN authentication event followed within 30 minutes by the execution of the MeshAgent RMM tool or its renamed variant mvtcs.exe. This behavioral pattern is associated with initial access via compromised VPN credentials followed by the deployment of remote monitoring and management (RMM) tools for persistence and command and control.
Detects a suspicious sequence of system utility executions (reagentc.exe, diskpart.exe, ipconfig.exe, and cipher.exe) originating from a single parent process within a 10-minute window. This behavior is indicative of ransomware attempting to inhibit system recovery and perform anti-forensic actions.
Detects instances where AI coding agents (such as Claude Code, Copilot, etc.) execute git commands (checkout, fetch, clone) using a branch name or reference formatted as a 40-character hex string. This behavior is indicative of a 'Plugin4Shell' style bypass, where an attacker crafts a branch name that mimics a commit SHA to cause ambiguous refname errors or hijack repository operations.
Detects the execution of MeshAgent, a remote monitoring and management (RMM) tool, by monitoring for its associated process names (meshagent.exe, mvtcs.exe) or command lines containing the string 'MeshAgent'. Adversaries often abuse such legitimate remote access tools to establish persistent command and control channels or to perform unauthorized administrative activities.
Detects the use of the wevtutil.exe utility to clear specific Windows Event Logs. Adversaries may clear event logs to hide evidence of malicious activity on a system.
Page 226 of 977