Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,504 detections
Filters
Last updated
All Time
Detection languages
8,116
7,177
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,504
11,884
5,888
5,179
4,868
Platforms
18,099
3,056
1,506
124
104
Products / Services
5,727
4,306
3,717
1,175
958
MITRE Techniques
9,496
7,578
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where LiteLLM, or related Python application processes (uvicorn, python), spawn a shell or command-line utility (bash, sh, id) under the root user account. This behavior is indicative of potential container breakout, application exploitation, or privilege escalation attempts originating from a web-accessible service.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
This rule detects potential execution of malicious files from removable media (e.g., USB drives). It monitors for a sequence of events where a removable drive is mounted, a file is subsequently created on that drive, and then that same file is executed within a short time window.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects uncommon or suspicious child processes spawning from a WSL process. This could indicate an attempt to evade parent/child relationship detections or persistence attempts via cron using WSL.
Detects file creation on a removable drive followed by process execution from that drive shortly after mounting.
Detects nm_host.exe (PEEP native messaging host binary) spawned by Chrome/Edge, tightened to require either the known PEEP extension ID in the native-messaging invocation command line or the distinctive com.peep.lab host path.
This rule monitors process command lines for identifiers related to virtual machine communication interfaces such as 'VMCI', 'AF_VSOCK', 'svm_cid', or 'vm:2'. It specifically targets both the ESET Remote Administrator (ERA) Agent and any other processes utilizing these communication mechanisms, which can be indicators of inter-process communication across virtual machine boundaries or potential hypervisor-related activity.
This rule detects instances where LockAppHost.exe or a variation of it (likely used as a proxy) initiates processes or command-line arguments that interact with Windows services, scheduled tasks, or Windows Defender configurations. This behavior is indicative of an adversary attempting to disable security features, suppress Windows updates, or manipulate system services to evade detection.
Detects the use of PowerShell commands to add directory exclusions to Windows Defender settings. Adversaries often use this technique to exclude directories in 'AppData' from being scanned by antivirus solutions to hide malicious activity, tools, or persistence mechanisms.
This rule detects a correlation between the creation of a specific suspicious file named 'A08744D2.tmp' and the subsequent activity of the Windows Media Player Network Sharing Service ('wmpnetwk.exe') within a short time window. This pattern often indicates potentially malicious activity where a temporary file may be used to stage or interact with the service process.
Detects anomalous activity patterns consistent with automated firmware reverse engineering pipelines, specifically correlating the high-frequency execution of firmware analysis tools (e.g., binwalk, Ghidra) with the creation of vulnerability research knowledge base artifacts. This behavioral heuristic aims to identify potential AI-driven or automated zero-day discovery workflows by tracking tool usage density and output characteristics.
Detects the execution of a reverse shell on Linux systems utilizing a common technique involving mkfifo (named pipe) to redirect input/output for a shell session to a netcat network connection. This is often used by attackers to gain interactive remote access to a compromised host.
Detects the execution of a reverse shell on Linux systems utilizing a common technique involving mkfifo (named pipe) to redirect input/output for a shell session to a netcat network connection. This is often used by attackers to gain interactive remote access to a compromised host.
Detects the execution of a reverse shell on Linux systems utilizing a common technique involving mkfifo (named pipe) to redirect input/output for a shell session to a netcat network connection. This is often used by attackers to gain interactive remote access to a compromised host.
Detects suspected exploitation of CVE-2026-81963, an Elevation of Privilege vulnerability in the Windows Update stack. The rule monitors for the creation of reparse points, junctions, or symbolic links within update staging paths by Windows Update processes, followed by either the spawning of suspicious child processes or unauthorized file writes/renames outside of expected directories, which are indicative of a privileged link-following exploit.
This rule detects unauthorized attempts to modify CrowdStrike Falcon sensor exclusion registry keys or commands involving DLL loading techniques that may indicate evasion preparation, specifically referencing potential FalconFlank-related activities. It filters out legitimate management activity from known service accounts, SCCM, and the CrowdStrike Falcon agent itself.
Detects a sequence of events where a PDF file opened from a Microsoft Outlook content directory triggers an immediate subsequent execution of a Microsoft Edge process pointing to a Google Sites URL, or containing suspicious command line arguments often associated with malicious redirection or web-based credential harvesting.
This rule monitors for network connections to known command-and-control (C2) IP addresses and the execution or presence of files matching known hashes associated with the 'PhantomC2' threat group or malware family. It correlates data from DeviceNetworkEvents, DeviceFileEvents, and DeviceProcessEvents to identify potential compromise.
This rule monitors for network connections to known command-and-control (C2) IP addresses and the execution or presence of files matching known hashes associated with the 'PhantomC2' threat group or malware family. It correlates data from DeviceNetworkEvents, DeviceFileEvents, and DeviceProcessEvents to identify potential compromise.
Detects a command shell (cmd.exe, powershell.exe, powershell_ise.exe, pwsh.exe) created with a SYSTEM SID whose immediate parent process is a POSITIVELY IDENTIFIED non-SYSTEM account running at Low/Medium integrity. Excludes known-benign SYSTEM-spawning binaries and blank-parent scheduled-task/service noise confirmed via live telemetry and attached evidence logs, and drops the prior TokenElevationTypeFull branch which mostly matched routine UAC-elevated admin activity rather than an actual SYSTEM token.
Page 249 of 977