Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects unauthorized command-line shell execution (cmd.exe or powershell.exe) spawned by the process 'Windowsupdate.exe', or the execution of a file associated with the malicious hash attributed to the QUICAgent backdoor.
Detects the use of curl.exe to download a file named 'update_ms.msi' and save it to the 'C:\ProgramData\' directory. This activity is indicative of the msaRAT loader, a component often associated with Chaos ransomware, using the curl utility to drop malicious installer packages for execution.
Detects the execution of Google Chrome or Microsoft Edge in headless mode with the Chrome DevTools Protocol (CDP) remote debugging port enabled. This configuration allows external control of the browser instance and is often abused by attackers to perform browser-based attacks, intercept traffic, or exfiltrate session data.
Detects execution of a specific msaRAT MSI custom action that loads an embedded lib.dll payload from the MSI Binary table into memory via msiexec.exe during the InstallFinalize phase.
Detects Python processes (python.exe, pythonw.exe, py.exe) executing with high or system integrity levels and interacting with named pipes, a technique often used for inter-process communication, persistence, or process injection.
Detects behavior where the ERAAgent process writes a file to disk and executes that same file shortly after (within 5 minutes). This pattern is consistent with staged payload delivery, decompression, or assembly often observed in malicious activity, specifically referencing SLEEPWALKER malware patterns.
This rule performs a two-layer hunt for the ShieldBreak/RoguePlanet (CVE-2026-50656) exploit. Layer 1 detects potential privilege escalation by identifying Windows Error Reporting processes (WerFault, WerFaultSecure, or WerMgr) running as SYSTEM that initiate suspicious child processes like cmd.exe, powershell.exe, or rundll32.exe. Layer 2 identifies the presence of known exploit artifacts including 'ShieldBreak.exe', 'Warden.dll', and the 'eicar_com.zip' test file via process execution or file creation events.
Detects AppLocker policy enumeration attempts via PowerShell using the Get-AppLockerPolicy cmdlet and an policy scope of either Effective, LDAP, or Local.
This rule detects attempts to bypass macOS Gatekeeper security controls by disabling security policies via the 'spctl' command, or by removing file quarantine attributes using the 'xattr' utility. These techniques are commonly used to execute unauthorized or malicious software that would otherwise be blocked by macOS security features.
Detects instances where the SQL Server process (sqlservr.exe) initiates a child process that is a known command-line tool, script interpreter, or utility often used in living-off-the-land attacks, or when a child process is spawned from suspicious directory paths such as AppData, Temp, or Windows\Temp.
This rule detects the launch of the Terminal application (Terminal.app) on macOS when initiated by a web browser process such as Safari, Chrome, Firefox, or Microsoft Edge. This behavior is indicative of a potential drive-by download attack or a malicious file execution sequence (e.g., ClickLock stealer) where browser-based interactions lead to the execution of system-level command line interfaces.
This rule detects when an individual user on a single host launches three or more distinct AI or LLM-related tools (such as ChatGPT, Claude, Cursor, Copilot, Ollama, or LMStudio) within the observed timeframe. This may indicate developers or power users utilizing various AI-assisted coding and productivity tools, but could also indicate unauthorized use of generative AI tools for data processing or exfiltration.
Detects the execution of child processes from common Microsoft Office applications (Word, Excel, Outlook) where the command line contains keywords associated with 'job offer' themes. This pattern is consistent with known spearphishing lures used by the Lazarus Group to initiate infection chains.
This rule detects a multi-stage attack pattern associated with Akira ransomware, including AD enumeration using PowerShell, data staging with WinRAR, S3 exfiltration via s5cmd, AnyDesk service installation, registry manipulation for persistence via Safe Mode, and boot configuration changes to facilitate EDR bypass. It also incorporates detection for specific IOCs like attacker jump host RDP connections and malicious file hashes.
This rule performs a two-layer hunt for the ShieldBreak/RoguePlanet (CVE-2026-50656) exploit. Layer 1 detects potential privilege escalation by identifying Windows Error Reporting processes (WerFault, WerFaultSecure, or WerMgr) running as SYSTEM that initiate suspicious child processes like cmd.exe, powershell.exe, or rundll32.exe. Layer 2 identifies the presence of known exploit artifacts including 'ShieldBreak.exe', 'Warden.dll', and the 'eicar_com.zip' test file via process execution or file creation events.
This rule monitors process command lines for identifiers related to virtual machine communication interfaces such as 'VMCI', 'AF_VSOCK', 'svm_cid', or 'vm:2'. It specifically targets both the ESET Remote Administrator (ERA) Agent and any other processes utilizing these communication mechanisms, which can be indicators of inter-process communication across virtual machine boundaries or potential hypervisor-related activity.
This rule monitors process command lines for identifiers related to virtual machine communication interfaces such as 'VMCI', 'AF_VSOCK', 'svm_cid', or 'vm:2'. It specifically targets both the ESET Remote Administrator (ERA) Agent and any other processes utilizing these communication mechanisms, which can be indicators of inter-process communication across virtual machine boundaries or potential hypervisor-related activity.
Detects TWINLOOT's fake lock screen credential harvesting technique, where the implant creates a window using highly unique class names (launcher_black_screen_31337, launcher_fake_lockscreen_view) to simulate a Windows lock screen and then calls GetUserNameExW to capture the logged-on user's credentials without validation, feeding harvested credentials into subsequent lateral movement.
Detects suspicious execution of 'browsercore.exe' using common command-line interpreters (cmd.exe, powershell.exe, pwsh.exe). This pattern monitors for specific command-line arguments involving file redirection, content retrieval, or process spawning, which are often indicative of malicious activity or attempts to bypass security controls by leveraging legitimate-looking browser-related binaries.
This rule detects the creation of a scheduled task where the initiating process is not the standard 'schtasks.exe'. It monitors for activity associated with COM objects (CLSID_TaskScheduler, ITaskService) typically used by applications to interact with the Task Scheduler API programmatically, which is a common technique for persistence or execution in non-standard ways.
Detects the use of the Windows 'copy /b' command to reconstruct a potential binary payload from smaller components, specifically targeting the creation of an executable named 'Windowsupdate.exe'. This technique is often used to bypass security controls by splitting malicious files into smaller pieces that do not trigger static analysis signatures.
Page 286 of 977