Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of the LOLBIN PrintBrm.exe, which can be used to create or extract ZIP files. PrintBrm.exe should not be run on a normal workstation.
Detects instances where Microsoft Outlook (OUTLOOK.EXE) initiates common living-off-the-land (LotL) binaries that are often abused by malicious attachments or macros to execute secondary commands, such as PowerShell, command prompt, or script host engines.
Detects the execution of SOAPHound, a .NET tool for collecting Active Directory data, using specific command-line arguments that may indicate an attempt to extract sensitive AD information.
Detects scheduled task creations or modification on a suspicious schedule type
Detects the execution of PowerShell with suspicious command-line arguments (hidden window, encoded commands using char arrays, and iex) that subsequently initiates multiple or long-running network connections. This behavior is indicative of a remote access trojan, beaconing, or fileless malware downloading additional payloads.
Detects execution of PowerShell commands that use obfuscated [char[]] hex arrays in conjunction with 'iex' (Invoke-Expression) to run code in memory. This pattern is commonly used by loaders like SynkLoader (cleaner.ps1) to execute scripts while avoiding disk artifacts.
Detects unauthenticated command injection in Zimbra Collaboration (CVE-2026-73570).
The swatchdog Perl script spawns a shell that chains arbitrary commands after snmptrap,
indicating abuse of SNMP notifications via a crafted SMTP sender.
The swatchdog Perl script spawns a shell that chains arbitrary commands after snmptrap,
indicating abuse of SNMP notifications via a crafted SMTP sender.
Detects the execution of a Faronics Deploy installer that has been renamed to mimic Adobe-related software. This technique is often used in phishing campaigns to trick users into executing binaries that lead to the silent installation of remote monitoring tools like ScreenConnect.
Detects the execution of python.exe or pythonw.exe from locations other than standard installation directories (C:\Python, C:\Program Files\Python), accompanied by the presence of associated DLLs (msvcp150/160.dll or python3xx.dll). This behavior is often indicative of portable Python environments being used for malicious script execution.
Detects the execution of BrowserCore.exe, a native messaging component for web browsers, when combined with command-line redirection (< or >) or specific output file creation (e.g., prt_cookie.txt, formatted_nonce.txt). This behavior is characteristic of an attack designed to extract Primary Refresh Tokens (PRTs) or browser cookies, which can be used to bypass authentication mechanisms.
Detects the use of PowerShell (Invoke-WebRequest or Invoke-RestMethod) to download files to the AppData directory, followed by the execution of a file using a 'token-raw' argument. This pattern is often associated with malicious payload delivery and execution.
Detects the execution of known Remote Monitoring and Management (RMM) and remote access tools. The rule specifically flags these tools when they are executed from high-risk directories such as AppData, Temp, Downloads, or ProgramData, which is a common indicator of unauthorized installation or persistence efforts by an adversary.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
This rule detects either the execution of a specific SSH daemon binary known to be trojanized or the creation/modification of files within the /var/lib/sshd/ directory, which is a common indicator of backdoor persistence or credential theft targeting SSH sessions.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
Detects the modification or replacement of critical Linux system daemons (crond, sshd, polkitd, etc.) followed by a service restart or reload. This behavior is indicative of potential trojanization or unauthorized tampering of system processes to establish persistence or inject malicious code.
This rule detects potential exploitation or unauthorized interaction with an HAProxy service. It correlates process execution on Linux systems involving the HAProxy PID file with subsequent network traffic containing the suspicious string 'writeservice_info' within a one-hour window.
This rule detects either the execution of a specific SSH daemon binary known to be trojanized or the creation/modification of files within the /var/lib/sshd/ directory, which is a common indicator of backdoor persistence or credential theft targeting SSH sessions.
Detects the specific execution pattern associated with CurlRAT, where common Linux daemons (crond, atd, agetty, polkitd) perform an outbound network connection and subsequently spawn an interactive shell (sh, bash, dash) as the root user within a 5-minute window.
Detects the execution of the SSH client (ssh.exe) with remote port forwarding arguments (-R). This technique is commonly used by adversaries to establish a reverse SSH tunnel, allowing them to proxy Remote Desktop Protocol (RDP) traffic from an internal victim machine to an external attacker-controlled server, effectively bypassing perimeter firewall restrictions. This behavior has been observed in various ransomware and C2 campaigns, including Bumblebee and Akira.
Page 277 of 977