Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of pythonw.exe from locations within the AppData\Roaming directory, which is a known behavior of the SynkLoader malware. The rule monitors for specific paths used by the loader for both the interpreter and script files.
Detects the execution of PowerShell with hidden window arguments that utilize a combination of hex-encoded character arrays, the -join operator, and Invoke-Expression (iex). This technique is commonly employed by attackers to execute obfuscated, memory-resident payloads while evading detection by security solutions.
Detects outbound network connections initiated by the 'build-script-build' executable, which is the compiled output of a Rust 'build.rs' script. While legitimate build scripts may fetch dependencies, unexpected network activity from this process could indicate malicious code injection during the build process, such as a software supply chain attack attempting to download secondary payloads.
Detects a suspicious execution chain where wscript.exe is used to run a file named 'rust-setup-launch.vbs' from a temporary directory, which subsequently triggers powershell.exe to execute a script named 'rust-setup.ps1'. This behavior is indicative of a staged supply chain attack.
This rule detects activities associated with the C2Looper v2 backdoor, which achieves persistence and code execution by sideloading a malicious wtsapi32.dll into the OneDrive process. It also identifies subsequent beaconing behavior where the compromised OneDrive process communicates with GitHub-hosted infrastructure to exchange command and control state files (cmd.json, result.json, beacon.json) instead of using traditional dedicated C2 servers.
Detects DLL search-order hijacking by monitoring for the execution of 'consent.exe' from non-standard directories (e.g., user-writable paths like %TEMP% or %APPDATA%) alongside the loading of specific DLLs (msimg32.dll, version.dll) from that same non-standard directory, which is indicative of malicious side-loading activity observed in Bumblebee and Akira intrusion campaigns.
Detects execution of a renamed Windows Contacts utility (wab.exe) spawned by the WMI Provider Host (WmiPrvSE.exe). This pattern is indicative of masquarading and process injection, commonly used by threat actors to execute arbitrary code or establish C2 communication while appearing as a legitimate Windows binary.
Detects process activity referencing the typosquatted proc-macro1 crate or build-script-build.exe spawning a child process — the build-time execution chain used to trigger the malicious proc-macro1 payload on Windows build hosts.
Detects the execution of JavaScript files using WScript or CScript that contain obfuscated 'eval()' calls, such as string concatenation (e.g., (0,this)["ev"+"al"]) or Unicode escaping. Adversaries often use these techniques to bypass signature-based detection for malicious script execution.
Detects unexpected child processes spawned by Rust build tools (cargo/rustc) that initiate network connections during build processes. This rule specifically monitors for instances where the build process performs network-related activities associated with build scripts (build.rs) or cargo build commands, which may indicate malicious dependency injection or build-time exfiltration.
This rule detects the use of the 'xattr' utility to remove the 'com.apple.quarantine' extended attribute from files located in '/tmp/'. Removing this attribute is a common technique used by attackers to bypass macOS Gatekeeper security controls, allowing unauthorized or malicious applications to execute without user prompts.
Detects suspicious execution patterns in Unix-based shells (sh, bash, zsh) where commands are obfuscated using base64, openssl, or gunzip and then executed via 'eval'. The command further includes indicators of manual execution or persistence, such as 'printf', 'xattr', or immediate permission changes ('chmod +x'). This pattern is frequently observed in the delivery of multi-stage payloads, fileless malware, or initial entry stagers.
This rule detects the creation of a Windows scheduled task named 'TaskHandler' using the schtasks.exe utility. The task is configured to execute a specific file, 'F7u00ex.exe', on system startup under the 'NT AUTHORITY\SYSTEM' account. This behavior is indicative of a persistence mechanism, often associated with the Spark RAT malware, which attempts to maintain a foothold on the system with high-level privileges.
Detects the execution of Chrome or Microsoft Edge with remote debugging enabled (--remote-debugging-port) in a headless configuration (--headless=new). This combination is commonly used by automated scripts, scrapers, or potential malicious activity to interact with the browser remotely, which can be leveraged for data exfiltration, session hijacking, or automated attacks.
This rule monitors for the execution of msiexec.exe with command-line arguments involving 'update_ms.msi' specifically referencing 'Updates Verify' or 'LexSoft Ltd.', which may indicate the installation of potentially unauthorized or malicious software masquerading as legitimate updates.
Detects instances where the Windows Defender antimalware service (MsMpEng.exe) spawns common shell processes (cmd.exe, powershell.exe, pwsh.exe, or conhost.exe) while running under the SYSTEM account. This behavior is highly anomalous and indicative of potential exploitation involving privilege escalation via the Microsoft Defender process.
Detects PowerShell command line arguments containing ADSI (Active Directory Service Interfaces) patterns
trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
trying to create a new user account via the WinNT or LDAP provider. This is an uncommon method to create
user accounts and may indicate an attempt to evade detection by avoiding more commonly monitored commands
such as "net user", "New-LocalUser" or "New-ADUser".
Detects PowerShell or pwsh processes spawned from Teams.exe with command-line arguments indicative of remote download and execution (e.g. Invoke-WebRequest, curl, encoded commands, IEX, Invoke-Expression, Expand-Archive of a zip archive). This pattern matches the TWINLOOT campaign's initial access chain, in which victims are lured via fake Microsoft Teams messages (T1566.004) into launching malicious content that triggers PowerShell execution (T1059.001) from within the Teams process, consistent with user execution of a malicious link or file (T1204.002).
Detects pythonw.exe executing from non-standard paths (ProgramData, AppData, or Temp) while loading netapi32.dll or ntdsapi.dll, consistent with the TWINLOOT implant's recon module performing NetAPI-based enumeration of domain controllers, admins, and domain trusts via DsEnumerateDomainTrusts and related calls, as observed being tasked by operators through the SharePoint dead-drop C2 channel.
Detects a non-browser process directly querying the Chrome/Brave/Edge SQLite Login Data store with the exact origin_url/username_value SELECT statements used by the botking RAT to harvest saved credentials.
Detects the execution of the QUICAgent backdoor (Windowsupdate.exe) from an AppData folder path. The rule monitors for this specific process name, which has been associated with C2 activity including hostname and username enumeration.
Page 287 of 977