Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects anomalous child process creation by Zoom client executables (Zoom.exe, CptHost.exe, ZoomOpener.exe, zoom.us), specifically monitoring for command interpreters, script hosts, and browser processes, which may indicate exploitation of the Zoom client for code execution.
Detects the use of the 'copy /b' command to reconstruct an executable payload (Windowsupdate.exe) by concatenating split decoy files (header.doc and body.doc) typically located within a _rels directory, a technique associated with malware delivery chains like Operation QUICSILVER.
This rule detects a suspicious sequence of activities that potentially indicates an attempt to exploit Common Log File System (CLFS) vulnerabilities or manipulate cloud filter drivers for privilege escalation. The rule monitors for a correlation between Registry modifications involving Cloud Filter settings (HKLM\SYSTEM\CurrentControlSet\Services\CldFlt) and the creation or modification of specific CLFS-related files (.blf, .blf2, .regtrans-ms) occurring within a 10-minute window, with an optional check for symbolic link manipulation (NtCreateSymbolicLinkObject).
Detects the execution of an unsigned binary under a non-SYSTEM user context that directly spawns 'whoami.exe' which then runs as the SYSTEM account. This behavioral pattern is indicative of a successful local privilege escalation exploitation, where a malicious binary confirms its escalation by querying the current user identity in a SYSTEM shell. The rule includes exclusions for common administrative agents, such as the Microsoft Intune Management Extension, that may exhibit similar behavior due to periodic detection scripting.
Potential exploitation of JetBrains TeamCity (Unauthenticated RCE, CVE-2026-63077) looking for suspicious child processes spawned by TeamCity services.
Detects C2Looper disabling Windows Error Reporting via registry modification to suppress crash dialogs, excluding common enterprise provisioning tools that legitimately configure the same keys.
Detects the use of the BITSAdmin utility to create, add, resume, or complete download jobs, which may indicate an adversary attempting to download malicious files or tools onto a system.
The following analytic detects kernel-level events where a setuid binary launches a shell or interpreter with a NULL argument vector, which occurs when a privilege escalation exploit gains root and executes a process via execve() without constructing a legitimate argument array.
Detects coordinated activity where a PowerShell process executes multiple distinct administrative utilities (such as wevtutil, vssadmin, wbadmin, or bcdedit) to perform destructive actions like clearing event logs, deleting shadow copies, or disabling system recovery settings. This rule uses correlation to identify sequences of at least three distinct commands and utilities, reducing false positives associated with single administrative tasks.
Detects the execution of Windows processes where the file's web-origin metadata (Mark-of-the-Web) contains a referrer URL pointing to the public GitHub Desktop repository. This rule serves as a provenance and threat hunting signal to track the origin of binaries executed in the environment, identifying software potentially derived from this specific source repository.
This rule detects instances where the Windows Defender Antivirus service (MsMpEng.exe) spawns common command-line shells (cmd.exe, powershell.exe, conhost.exe) while running under the SYSTEM context. This behavior is highly irregular for a security product and is indicative of process injection, exploit payload execution, or anti-tampering bypass attempts.
Detects the creation and configuration of a Windows service named 'media_updaten' via command-line utilities (sc.exe) or direct registry modification. This service is associated with CoolClient for persistence to relaunch 'Sang.exe' with a 'work' parameter.
Detects the use of the built-in Windows tool 'wbadmin.exe' to perform a system backup that specifically includes the Active Directory database (ntds.dit) along with SYSTEM and SECURITY registry hives. This technique is often used by adversaries to perform offline credential theft by creating an accessible copy of sensitive domain files.
This rule detects potential data exfiltration or verification behavior by correlating a file write event in a temporary directory (/tmp/) with a subsequent 'cat' command execution reading that same file within a 10-minute window. This behavioral pattern is often associated with C2 agents staging data for retrieval.
This rule detects unauthorized or suspicious registration of native Internet Information Services (IIS) modules. It monitors command-line activity involving common administrative tools used to modify IIS configurations (appcmd.exe) and manage .NET assemblies (gacutil.exe), as well as the execution of specific PowerShell cmdlets like New-WebGlobalModule. Such activities are often indicative of an attacker attempting to establish persistence on a web server by loading malicious modules.
Detects the creation of new domain user accounts using the 'net user /add /domain' command. This activity can be indicative of an adversary establishing persistence or escalating privileges within a Windows domain environment.
Detects execution of msiexec.exe involving specific command-line arguments (CA_Run_EA2AEBC3, Bin_lib_EA2AEBC3) often associated with malicious installers or library side-loading, correlated with the loading of 'lib.dll' by the msiexec process.
This rule detects potential multi-stage desktop takeover attacks by monitoring sequences of process execution within a 5-minute window. It looks for initial shell (explorer.exe or cmd.exe) spawning script-based tools (mshta.exe, wscript.exe, cscript.exe, powershell.exe, cmd.exe) with suspicious command-line arguments (extensions like .lnk, .url, .hta, or PowerShell-specific artifacts like 'IEX', 'DownloadString', or '-enc'). This is immediately followed by a secondary stage where PowerShell, cmd, or rundll32 are used to load external DLLs, register modules via regsvr32, or interact with AppData/Local/Temp directories, indicative of payload staging and execution.
This rule detects instances where the Windows Defender Antivirus service (MsMpEng.exe) spawns common command-line shells (cmd.exe, powershell.exe, conhost.exe) while running under the SYSTEM context. This behavior is highly irregular for a security product and is indicative of process injection, exploit payload execution, or anti-tampering bypass attempts.
Detects the creation and enablement of a systemd unit file that uses a deceptive description ('Apache HTTPD Cache Manager') and the 'Restart=always' directive. This pattern is characteristic of persistence mechanisms used by the Evooo1Bot malware, which attempts to maintain continuous execution by running as a system service.
This rule detects potentially malicious command execution initiated within Claude Code's zsh shell-snapshot environment on macOS. It triggers when a zsh process executes a command via the internal shell-snapshot wrapper and subsequently performs high-risk activities such as credentialized HTTP requests, unauthorized data exfiltration/upload, download-and-execute shell chains, tunneling (e.g., ngrok, cloudflared, SSH port forwarding), persistence mechanism manipulation (e.g., LaunchAgents/LaunchDaemons, PlistBuddy), credential access (e.g., keychain queries), or defense evasion techniques (e.g., clearing quarantine attributes or ad-hoc codesigning).
Page 292 of 977