Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,503 detections
Filters
Last updated
All Time
Detection languages
8,116
7,176
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,503
11,883
5,887
5,179
4,868
Platforms
18,098
3,056
1,506
124
104
Products / Services
5,727
4,305
3,717
1,175
958
MITRE Techniques
9,495
7,578
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the use of shell commands ('bash', 'sh') to interact with potential configuration backup files or files containing sensitive system information (e.g., 'show_running-config.txt', 'show_version.txt'). This behavior is indicative of an adversary staging or accessing configuration data on a compromised system or network device.
Detects the loading of the somkernl.dll module by 360speedld.exe or SoftupNotify.exe, or the execution of these binaries. These files are associated with 360 Safe/360 Security software components, and this rule monitors for their specific activity patterns, which may be used to identify software presence or potential process hollowing/masquerading attempts involving these legitimate components.
Detects potential remote code execution (RCE) attempts targeting vulnerable Sub-Store instances (versions < 2.38.2). The detection identifies web browsers making network connections to local ports (38324) associated with Sub-Store, followed by the spawning of shell processes (cmd, powershell, bash, sh) by the Node.js process hosting the application.
Detects potential remote code execution (RCE) attempts targeting vulnerable Sub-Store instances (versions < 2.38.2). The detection identifies web browsers making network connections to local ports (38324) associated with Sub-Store, followed by the spawning of shell processes (cmd, powershell, bash, sh) by the Node.js process hosting the application.
This rule detects potentially malicious command-line activity involving powershell.exe or mshta.exe that is initiated by a web browser process (chrome.exe, msedge.exe, firefox.exe, or iexplore.exe). It monitors for indicators such as encoded commands, usage of Invoke-Expression, download cradles, hidden window flags, and specific known IOCs, correlating these events with recent browser activity to identify potential drive-by download or browser-based exploitation attempts.
This rule detects potentially malicious command-line activity involving powershell.exe or mshta.exe that is initiated by a web browser process (chrome.exe, msedge.exe, firefox.exe, or iexplore.exe). It monitors for indicators such as encoded commands, usage of Invoke-Expression, download cradles, hidden window flags, and specific known IOCs, correlating these events with recent browser activity to identify potential drive-by download or browser-based exploitation attempts.
Detects cortex-xdr-payload.exe connecting to a server outside Palo Alto Networks LRC infrastructure. Attackers can abuse the Live Terminal feature as a pre-installed, EDR-trusted C2 channel by redirecting the payload to their own server using a URL validation bypass in the server hostname check
The following analytic detects the execution of a Unix shell command designed to wipe root directories on a Linux host.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option.
This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred.
If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host.
Immediate investigation and response are crucial to mitigate potential damage.
It leverages data from Endpoint Detection and Response (EDR) agents, focusing on the 'rm' command with the '--no-preserve-root' option.
This activity is significant as it indicates potential data destruction attempts, often associated with malware like Awfulshred.
If confirmed malicious, this behavior could lead to severe data loss, system instability, and compromised integrity of the affected Linux host.
Immediate investigation and response are crucial to mitigate potential damage.
The following analytic detects suspicious data chunking activities that involve the use of split or dd, potentially indicating an attempt to evade detection by breaking large files into smaller parts.
Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data.
By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
Attackers may use this technique to bypass size-based security controls, facilitating the covert exfiltration of sensitive data.
By monitoring for unusual or unauthorized use of these commands, this analytic helps identify potential data exfiltration attempts, allowing security teams to intervene and prevent the unauthorized transfer of critical information from the network.
Detects a sequence of commands characteristic of the Stealer/1.0 malware, involving the systematic disabling of security features including Windows Defender, Firewall, UAC, System Restore, Windows Recovery Environment, SafeBoot, and the deletion of Volume Shadow Copies as a precursor to destructive data operations.
Detect malicious GPO modifications can be used to implement many other malicious behaviors.
Detects instances where Adobe Acrobat or Adobe Reader processes initiate suspicious child processes, such as common interpreters (PowerShell, CMD, WScript, CScript) or binaries (rundll32, browser executables) often used in malicious document-based attacks to achieve initial code execution.
Detects a sequence of events where a PDF file opened from a Microsoft Outlook content directory triggers an immediate subsequent execution of a Microsoft Edge process pointing to a Google Sites URL, or containing suspicious command line arguments often associated with malicious redirection or web-based credential harvesting.
This rule detects the Microsoft Edge browser (msedge.exe) being spawned by common productivity applications like Adobe Acrobat or Microsoft Outlook using the '--single-argument' command-line flag. This pattern is frequently used to force a specific browser window to open a malicious URL, which can be an indicator of a malicious document or phishing email attempting to direct the user to a credential harvesting or malware delivery site.
Detects a sequence of events where a PDF file opened from a Microsoft Outlook content directory triggers an immediate subsequent execution of a Microsoft Edge process pointing to a Google Sites URL, or containing suspicious command line arguments often associated with malicious redirection or web-based credential harvesting.
Detects instances where base64-encoded PHP code, obfuscated behind a 'data:image/gif;base64' MIME type prefix, is written to the disk as a .php file or initiated by web server processes. This pattern is commonly used in file upload bypass attacks to execute arbitrary code.
This rule detects suspicious process execution originating from web server applications (e.g., php-fpm, apache2, nginx). It looks for common shell interpreters or command-line utilities (e.g., bash, curl, python) triggered by these web server processes when they contain command execution function strings in their command lines (e.g., system, shell_exec, passthru), which is a common indicator of web shell activity or post-exploitation command execution.
Detects the use of the Windows 'diskpart' utility combined with a script or command execution containing 'clean all', which performs a destructive multi-pass overwrite of disk data structures to render it irrecoverable. This behavior is typically associated with malicious data destruction or wiping activities.
Detects the execution of vssadmin.exe to delete volume shadow copies or attempts to clear recovery-related directories such as SoftwareDistribution or Windows.old. This behavior is indicative of ransomware or destructive activity aimed at inhibiting system recovery.
Detects the use of 'bootsect.exe' with parameters specifically designed to overwrite the Master Boot Record (MBR) and the targeting or modification of 'winload.efi', which is indicative of destructive boot-level attacks or bootkit deployment attempts.
Detects suspicious activity related to the Windows Subsystem for Linux (WSL), such as installing new distributions (especially penetration testing ones like Kali), importing custom images, or executing commands non-interactively. Attackers may use WSL to run malicious Linux binaries, hide artifacts, and evade defenses.
Page 269 of 977