Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the execution of specific DLP-related shell scripts (dlp.sh, dlp-docker.sh) being invoked by Terraform processes. This pattern may indicate suspicious automated infrastructure configuration or an attempt to bypass security controls by leveraging IaC tools to execute scripts.
The following analytic detects exploitation of Ghostscript causing command execution.
This can be used by attackers to abuse file conversion services or embedded LibreOffice documents.
This can be used by attackers to abuse file conversion services or embedded LibreOffice documents.
The following analytic identifies processes running from %temp% directory file paths. It leverages data from Endpoint Detection and Response (EDR) agents, focusing on specific process paths within the Endpoint data model. This activity is significant because adversaries often use unconventional file paths to execute malicious code without requiring administrative privileges. If confirmed malicious, this behavior could indicate an attempt to bypass security controls, leading to unauthorized software execution, potential system compromise, and further malicious activities within the environment.
Detects execution of pythonw.exe (windowless Python) from user-writable directories (e.g., AppData, Temp, Downloads) when launched by common parent processes typically associated with initial access or execution, indicative of the SynkLoader C2 malware.
Detects execution of Electron or Node.js processes attempting to export Telegram sessions, specifically targeting execution paths often used for staging or temporary storage (Temp, Roaming, ProgramData, Public folders).
Detects anomalous child process execution (e.g., cmd.exe, powershell.exe, whoami) by PaperCut application processes (java.exe, pc-app.exe, PCClient.exe), which is indicative of post-exploitation activity following an authentication bypass and remote code execution chain against PaperCut NG/MF.
Detects anomalous child process creation (e.g., cmd.exe, powershell.exe, rundll32.exe) spawned by the VMware host process 'vmware-vmx.exe'. This behavioral pattern is a high-confidence indicator of potential guest-to-host virtual machine escape, specifically monitoring for activity associated with vulnerabilities like CVE-2026-59346.
This rule detects the execution of processes or network connections that impersonate 'WhatsApp' or 'Instagram' companion applications. It identifies specific file names and process command lines that mimic these applications, often associated with browser-launched or malicious payloads, and monitors for associated network traffic directed toward suspicious endpoints like herokuapp domains.
Detects execution of PowerShell.exe initiated by cplsupport.exe with hidden window styles and non-interactive, no-profile flags, which is often indicative of obfuscated command execution or malicious script activity.
Detects the use of the Windows 'copy /b' command to join multiple files into a single executable, specifically targeting patterns where document files are merged with a binary named 'Windowsupdate.exe'. This technique is often used to reassemble malicious payloads by combining split components or masquerading malicious content within seemingly benign file operations in temporary user directories.
This rule monitors for email events where the email is flagged for suspicious properties (SPF/DKIM/DMARC failure, threat categorization) and includes potentially malicious attachments or URLs. It then correlates these suspicious emails with subsequent process execution events on the recipient's endpoint within a 30-minute window, identifying a potential successful execution of a phishing payload.
Detects the use of the 'xattr' command to remove the 'com.apple.quarantine' extended attribute from a file. This attribute is used by macOS Gatekeeper to identify files downloaded from the internet and trigger security warnings. Removing it is a common technique to bypass Gatekeeper and execute untrusted software without user notification.
Detects the execution of 'conhost.exe' with command-line arguments '--headless' and 'cmd' initiated by 'svchost.exe' as part of a scheduled task. The command executes from user-writable directories such as AppData, ProgramData, or Temp, which is a common pattern for fileless or staged payload execution initiated by malicious scheduled tasks.
Detects the execution of psql.exe to query the Veeam Backup & Replication PostgreSQL database for stored credentials. This pattern is associated with credential theft techniques utilized during ransomware operations (e.g., Bumblebee, Akira) where sensitive configuration or credential data is retrieved and potentially later decrypted via DPAPI.
Detects frequent execution of the 'pbpaste' command on macOS, which is used to read clipboard contents. An unusually high volume of executions within a short window can indicate automated data collection or clipboard monitoring, a common technique for credential harvesting or exfiltration of sensitive information copied by the user.
Detects the execution of bash or shell commands associated with a hidden directory '.task' and a specific script 'tokenlinux.sh'. This pattern is indicative of potential persistence mechanisms, unauthorized script execution, or command-and-control (C2) activity in a Linux environment.
This rule detects potentially suspicious activity involving the execution of node.js, npm, or curl where a specific node version (node-v20.11.1-darwin-x64) and a file named 'parser.js' appear in the command line within a short period. This pattern is indicative of a developer or attacker staging tools and scripts on a macOS system.
Detects frequent execution of the 'pbpaste' command on macOS, which is used to read clipboard contents. An unusually high volume of executions within a short window can indicate automated data collection or clipboard monitoring, a common technique for credential harvesting or exfiltration of sensitive information copied by the user.
Detects the execution of bash or shell commands associated with a hidden directory '.task' and a specific script 'tokenlinux.sh'. This pattern is indicative of potential persistence mechanisms, unauthorized script execution, or command-and-control (C2) activity in a Linux environment.
This rule detects potential malicious activity on macOS where a user or script is prompted to open a legitimate-looking application bundle (decoy) while, in close temporal proximity (within 2 minutes), background processes related to hidden .macos payloads or quarantine flag manipulation via 'xattr' are executed. This is a common pattern for malware to appear legitimate to the user while performing malicious setup or persistence in the background.
Detects the addition of suspicious file names or known potentially unwanted program artifacts to Windows Run registry keys, often used for persistence. The rule correlates registry modifications with potential installer process activity.
Page 280 of 977