Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the addition of a Microsoft Defender exclusion path targeting suspicious directories or executables that mimic legitimate Windows Defender installation paths (e.g., 'Microsoft\Windows Defender' or 'defender.exe'). This behavior is indicative of defense evasion, allowing attackers to hide malicious files from real-time scanning by bypassing security controls via PowerShell Set-MpPreference or WMIC.
This rule detects the execution of 'cmd.exe' with specific arguments 'start /max' used to open a file named 'TrainingAnnouncement.pdf'. This pattern is associated with Operation QUICSILVER, where attackers use this specific command line invocation to masquerade a malicious process or backdoor installation as a benign document opening event.
This rule detects a suspicious sequence of activities that potentially indicates an attempt to exploit Common Log File System (CLFS) vulnerabilities or manipulate cloud filter drivers for privilege escalation. The rule monitors for a correlation between Registry modifications involving Cloud Filter settings (HKLM\SYSTEM\CurrentControlSet\Services\CldFlt) and the creation or modification of specific CLFS-related files (.blf, .blf2, .regtrans-ms) occurring within a 10-minute window, with an optional check for symbolic link manipulation (NtCreateSymbolicLinkObject).
The following analytic detects the creation of a Python path configuration (`.pth`) file in conjunction with a package installation process.
Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
Path configuration files placed under `site-packages` or `dist-packages` are executed with every subsequent invocation of Python, allowing adversaries to achieve persistence on the victim endpoint regardless of build method or distribution type.
This technique was used by the threat actor group TeamPCP during the supply chain compromise of the `litellm` package.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
The following analytic detects the creation of a Python site hook file (`sitecustomize.py` or `usercustomize.py`) within a `site-packages`/`dist-packages` directory in conjunction with a package installation process.
Python's `site` module loads these hooks from directories on `sys.path` before Python is executed.
If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
Python's `site` module loads these hooks from directories on `sys.path` before Python is executed.
If an adversary manipulates or plants one of these files, they can hijack the Python environment and execute their payload with every Python invocation, achieving persistence on the victim endpoint.
The VIPERTUNNEL backdoor was reported to abuse site hooks in order to import and trigger DLL execution.
If confirmed malicious, this could result in arbitrary code execution every time Python is invoked on the compromised host.
Detects command-line activity indicative of attempts to disable, bypass, uninstall, or interfere with the Netskope security agent functionality on an endpoint.
Detects the TWINLOOT Python implant's self-update mechanism, in which a schtasks.exe process is spawned with '/Run' by a pythonw.exe parent process while referencing a reobf.json manifest on the command line, indicating the implant is relaunching itself via a scheduled task after fetching an updated/reobfuscated payload configuration.
Detects the use of 'net.exe' or 'net1.exe' to add a user to the 'Enterprise Admins' group, which is a highly privileged Active Directory group. This activity is indicative of privilege escalation and persistence attempts by an adversary to gain full control over the domain.
Detects the use of rundll32.exe to invoke the MiniDump function from comsvcs.dll, which is a well-known technique to dump the memory of the Local Security Authority Subsystem Service (LSASS) process to a file for credential harvesting.
Detects the execution of the Cortex XDR agent administration tool (Cytool) with the 'protect disable' command line argument. This indicates an attempt to manually disable the security agent's protective features on an endpoint, which is a common technique used by adversaries to impair security controls.
Detects potential command injection on GitHub Actions self-hosted runners where a child shell process (bash/sh) is spawned by the Runner.Worker or Runner.Listener processes. The rule looks for a specific pattern of shell command lines containing single quotes, semicolons, and the 'echo' command, which is indicative of a breakout attack exploiting unsanitized GitHub event data (e.g., issue titles) being passed into shell commands.
This rule detects the use of the Windows 'copy /b' command to reconstruct an executable file (named Windowsupdate.exe) by concatenating two separate files ('header.doc' and 'body.doc'). This behavior is consistent with file-based reconstruction techniques used to bypass security controls by splitting payloads into seemingly benign components.
This rule detects the suspicious execution of the native Windows FTP utility ('ftp.exe') initiated by a shortcut file (.lnk). It specifically looks for the '-s' command-line switch, which is used to execute a script file for non-interactive FTP operations. This pattern is commonly observed in malware campaigns where an adversary uses a shortcut file to trigger a secondary stage of the attack by downloading payloads via FTP scripts.
Detects the execution of rundll32.exe with command-line arguments involving shell32.dll and SHCreateLocalShellFolderServer, which is associated with phishing lures. The rule correlates this execution with either a direct child relationship to web browsers (Chrome, Edge) or proximity in time to the execution of Microsoft Outlook, indicating potential spearphishing or web-based delivery of malicious payloads.
Detects the execution of Windows Script Host (wscript.exe) where the Interactive mode is explicitly disabled in the script content or command line arguments. Disabling interactive mode is a common technique used by attackers to ensure malicious scripts run silently without triggering UI prompts or requiring user interaction.
Detects the execution of a process named 'Windowsupdate.exe' from within the user's Local AppData directory. This pattern is indicative of masquerading, where malware attempts to evade detection by mimicking the legitimate Windows Update executable, a technique observed in the Operation QUICSILVER campaign.
This rule detects instances of VS Code, code-server, or associated Node.js processes executing 'git config --get user.email'. This behavior is characteristic of malicious VS Code extensions (specifically 'evil-twin' extensions) attempting to perform developer reconnaissance by harvesting local Git identity information, which can then be exfiltrated.
Detects the presence of Afd4Eop12_x64.dll or the execution of command lines referencing specific exploit indicators such as 'initialize_afd_npfs_exploit' or 'enable_god_mode', often associated with local privilege escalation exploits leveraging kernel vulnerabilities.
Detects creation of new scheduled tasks (cron), systemd services, or startup entries that reference the reverse_ssh tool, consistent with attacker persistence established after vCenter compromise.
Detects the execution of msiexec.exe to install specific MSI packages (ManageEngine-OpManager.msi or Advanced-IP-Scanner.msi) when initiated by explorer.exe. This pattern is indicative of user-driven execution, which may be part of an initial access or software deployment workflow.
Detects the use of rundll32.exe to execute the MiniDump command against comsvcs.dll, a known technique used to dump process memory (such as LSASS) to a file for credential harvesting.
Page 289 of 977