Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects a specific and highly suspicious process lineage: pcalua.exe (Program Compatibility Assistant) spawning powershell.exe, which subsequently triggers WmiPrvSE.exe, followed by cmd.exe and finally rundll32.exe. This chain often indicates a sophisticated attempt to bypass security controls by nesting execution through legitimate Windows utilities.
Detects ClickFix-style social engineering attacks where users are lured into executing obfuscated commands via terminal copy-paste. The detection monitors for the sequential execution of remote file downloads (e.g., curl, PowerShell) followed immediately by shell history-clearing commands designed to obfuscate the malicious activity. This behavior is associated with macOS crypto-drainers and loaders.
Detects the abuse of Visual Studio Code (and compatible IDEs like Cursor) workspace trust to trigger malicious tasks upon opening a folder. This pattern is associated with the 'Void Dokkaebi' (Famous Chollima) threat group's propagation of the 'DEV#POPPER' RAT. The rule identifies instances where the code editor spawns common scripting or network utilities (like PowerShell, curl, or Node.js) with command-line arguments indicative of file downloads or execution, as defined in a local '.vscode/tasks.json' file.
Detects the use of osascript to generate fake macOS system-style dialog boxes that solicit user credentials or administrator privileges. This technique is often employed by macOS infostealers to conduct GUI-based credential harvesting or to bypass user interaction requirements for privilege escalation.
Detects the creation of a new domain user followed by its addition to sensitive, high-privileged groups (e.g., Domain Admins, Enterprise Admins) using the native Windows net.exe or net1.exe utilities. This pattern aligns with known post-compromise activity observed in campaigns like Bumblebee, AdaptixC2, and Akira ransomware, where attackers create stealthy, elevated accounts (e.g., masquerading as backup service accounts) to maintain persistence and full domain control.
Detects the modification of a Windows Registry Run key using reg.exe to schedule a forced system shutdown. This pattern is often associated with wipers or disruptive malware attempting to ensure system unavailability upon reboot or login.
This rule detects potential exploitation or unauthorized interaction with an HAProxy service. It correlates process execution on Linux systems involving the HAProxy PID file with subsequent network traffic containing the suspicious string 'writeservice_info' within a one-hour window.
Detects the specific execution pattern associated with CurlRAT, where common Linux daemons (crond, atd, agetty, polkitd) perform an outbound network connection and subsequently spawn an interactive shell (sh, bash, dash) as the root user within a 5-minute window.
Detects instances where common web server applications (e.g., Apache, Tomcat, IIS, Nginx) or Java runtime environments spawn suspicious child processes like command shells (cmd.exe, powershell.exe, sh, bash) or network utilities (wget, curl). This behavior often indicates exploitation of a web vulnerability, such as Remote Code Execution (RCE), allowing an adversary to execute commands or download further malicious payloads.
Detects the CurlRAT malware interactive shell behavior where legitimate Linux system daemons (atd, crond, agetty, polkitd) are trojanized or abused to execute shell commands with attacker-supplied network endpoints (IP:Port).
Detects potential exploitation of PostgreSQL via logical decoding plugins, specifically targeting CVE-2026-6471. The rule monitors for the PostgreSQL server process spawning suspicious shell utilities or loading modules from locations outside of the expected PostgreSQL library or plugin directories, which is a common indicator of unauthorized code execution.
Detects the execution of the 'chmod +x' command to mark a file named '/tmp/helper' as executable, followed by the execution of that same binary within a 5-minute window. This behavior is indicative of an attacker dropping and executing a payload from a temporary directory.
CVE-2026-65400 affects the macOS Screen Sharing service and can allow an attacker on the network to authenticate without valid credentials. Huntress' research goes further, describing the pre-authentication path and opportunities to obtain root-level file access and ultimately code execution. First thing first: patch. Update affected devices to macOS Tahoe 26.6.1, Sequoia 15.7.9, or Sonoma 14.8.9. Apple released these versions on August 6 to address CVE-2026-65400. If patching is not immediately possible, disable Screen Sharing. After patching, we still need to answer the hunter's question: was any of this activity already happening before the update? The KQL below hunts across Microsoft Defender XDR telemetry for activity around the observed attack path: Screen Sharing file activity, SSH sessions, privileged file writes, LaunchDaemon persistence, process masquerading, Packet Filter changes, XMRig artefacts and related network activity. One process particularly worth reviewing is SSFileCopyReceiver / SSFileCopySender. Huntress notes that these are privileged Screen Sharing helpers, and their research highlights root-context activity and filesystem operations as useful hunting opportunities.
Detects the execution of the Windows Installer utility (msiexec.exe) where the command line references an Azure Blob Storage URL. This pattern is commonly used by adversaries to download and install malicious MSI packages directly from a remote storage location, bypassing local file creation.
Detects the execution of PowerShell with encoded commands, a common technique used by attackers to obfuscate malicious scripts and evade detection.
Detects suspicious child process creation (e.g., cmd.exe, powershell.exe) originating from Java applications where the command line contains indicators of deserialization vulnerabilities (e.g., FilteredObjectInputStream, Log4jLogEvent). This pattern is often associated with exploitation of Java applications to gain remote code execution.
The following analytic detects the creation of a new local user account on a MacOS system. It leverages osquery logs to identify this activity.
Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network.
If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.
Monitoring the creation of local accounts is crucial for a SOC as it can indicate unauthorized access or lateral movement within the network.
If confirmed malicious, this activity could allow an attacker to establish persistence, escalate privileges, or gain unauthorized access to sensitive systems and data.
Detects the execution of JavaScript files using Windows Script Host (wscript.exe or cscript.exe) containing specific obfuscated patterns or indicators typically associated with malicious multi-stage dropper payloads. These patterns are indicative of obfuscated code attempting to evade static analysis and security controls during the initial execution phase.
Detects execution of 'BrowserCore.exe' when the initiating (parent) process is not a recognized web browser (msedge.exe, chrome.exe, or firefox.exe). This rule flags potential process masquerading or misuse of the BrowserCore utility, particularly when spawned by command interpreters or the Task Scheduler.
Detects the addition of suspicious file names or known potentially unwanted program artifacts to Windows Run registry keys, often used for persistence. The rule correlates registry modifications with potential installer process activity.
Detects reconnaissance patterns associated with SynkLoader, specifically focusing on in-memory PowerShell execution used to harvest system information, user privileges, running services, process listings, and Active Directory computer counts.
Page 283 of 977