Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects potentially malicious command-line execution patterns often observed in 'ClickFix' or similar clipboard-based attack campaigns. It monitors for instances where standard Windows interpreters (PowerShell, cmd.exe, mshta.exe) are launched by legitimate shell processes (explorer.exe, rundll32.exe) and execute specific commands (like certutil for decoding) to process content found in suspicious or user-writable locations such as AppData or containing file extensions like .png (often used for steganography or file hiding).
Detects the creation and configuration of suspicious LaunchAgent and LaunchDaemon plist files on macOS. It identifies files masquerading as legitimate system components (e.g., com.finder.helper, .mainhelper, .agent) or exhibiting common patterns of persistent agent names (random 10+ character names). It also monitors for the use of 'launchctl load' to activate these suspicious configuration files.
Detects suspicious spawning of a process under a different user context than the parent process.
Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
Processes such as notepad.exe, calculator etc. are generally spawned under the same user context and
also they are often targeted as sacrificial process or decoy process to check successful privilege escalation.
Detects Quick Assist (msra.exe/quickassist.exe) being launched on a device within a short window after the same user signed into Microsoft Teams, consistent with UNC6692's vishing tradecraft where actors impersonate internal IT support over Teams and coerce victims into granting remote access via Quick Assist to deploy the Edgecution malware suite.
This rule detects network connections from common administrative processes (such as PowerShell, CMD, WScript, or Rundll32) to known dynamic DNS providers. This pattern is frequently indicative of malware beacons, command and control (C2) communication, or other unauthorized remote access tools utilizing dynamic DNS services to maintain connectivity to adversary infrastructure.
This rule detects the use of the Frida dynamic instrumentation toolkit and the objection framework, specifically searching for command-line arguments and process names associated with their installation or use, as well as network activity on the default Frida server port (27042). It monitors for activities like SSL pinning bypass, mobile application patching, and remote agent deployment.
Detects the execution of JavaScript files via Windows Script Host (wscript.exe or cscript.exe) where the command line contains an unusually long base64-encoded string. This pattern is often indicative of a dropper or loader script deobfuscating and executing a subsequent malicious payload in memory.
Detects pgrep enumerating ngrok, cloudflared, or ssh processes from within a Claude Code or Cursor coding-agent session, indicating discovery of existing tunnel/remote-access tooling as part of an agent-driven attack chain.
This rule detects file creation and process execution events involving strings associated with the Solidity-Pro tool, which is known to be used as a C2 mechanism or malicious component. It specifically triggers on files with these patterns and processes spawned by or related to 'Code.exe' (VS Code) utilizing these malicious strings in their command lines.
Detects the creation of an LSASS memory dump file (lsass*.dmp) initiated by Task Manager (taskmgr.exe) within Temp or user directories. This behavior often indicates an adversary or unauthorized user leveraging the Task Manager 'Create dump file' feature to dump process memory for credential harvesting.
Detects a process reporting the name netd_service whose backing executable path does not match genuine Android system netd binary locations, indicating Kimwolf v7 process masquerading to blend into legitimate network daemon activity.
Detects execution of a Bun binary from a temporary, download-staging or node_modules path
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
rather than a standard installation location. The keyv/cacheable stage-1 loader downloads a
platform-matched standalone Bun runtime from the oven-sh GitHub release URL and uses it to
execute the second stage, specifically to bypass the host Node version and any Node-level
monitoring. Staging directories follow a 'bun-dl-*' naming pattern.
Detects the execution of an executable file initiated by npm during the postinstall process. This behavior is often indicative of a software supply chain attack where a malicious package executes code immediately after installation.
This rule detects potentially malicious activity associated with known supply chain compromise indicators in npm packages (such as Keyv and associated malicious scripts). It flags the execution of specific suspicious files (e.g., 'setup.mjs', 'Math_Symbol.js') or the use of specific versions of common packages known to be associated with recent supply chain attacks, when executed via npm or node.js runtime.
Detects a silent MSI installation (msiexec.exe with /i, /quiet, and /qn) where the target MSI file was created or written by the same causality chain on the same host within the preceding 60 minutes, consistent with CountLoader/DOUBLECUP payload staging and silent deployment behavior.
Device Name Search
Cortex XDR
This rule performs a telemetry data retrieval query for a specific agent hostname. It outputs detailed fields related to network connections and process executions (including command lines, user context, and process image names) from the XDR dataset for auditing or investigative purposes.
Temporal correlation of the two highest-confidence stages of the keyv/cacheable compromise:
a setup.mjs preinstall hook executing, followed within 15 minutes on the same host by a Bun
runtime executing from a staging or node_modules path. Either alone is tunable noise on a
developer estate; the pair is the campaign. Use this as the alerting rule and keep the base
rules at correlation-input severity.
a setup.mjs preinstall hook executing, followed within 15 minutes on the same host by a Bun
runtime executing from a staging or node_modules path. Either alone is tunable noise on a
developer estate; the pair is the campaign. Use this as the alerting rule and keep the base
rules at correlation-input severity.
This rule detects potential malware sandbox/virtualization evasion behavior on macOS. It identifies processes that execute 'system_profiler' with hardware-identifying keywords (e.g., QEMU, VMware, KVM) and correlates this with either immediate process self-termination within 5 seconds or the presence of a 'cis_blocked' signal, which is indicative of a kill-switch mechanism often used by malicious actors to avoid analysis.
Detects the execution of AppleScript files (.scpt) using the osascript command-line utility on macOS. Adversaries often use AppleScript to execute commands, interact with applications, or perform malicious actions on a system.
Detects instances where Java or Oracle-related processes (java.exe, oracle.exe, tnslsnr.exe) initiate suspicious command-line tools like cmd.exe or powershell.exe to execute commands typically associated with reconnaissance, such as whoami or tasklist. This is a strong indicator of post-exploitation activity where a compromised web server or database process is being used to conduct system discovery.
Detects wmic.exe process enumeration ("process list"/"where") spawned within 60 seconds by a python.exe or pythonw.exe process running from a non-standard path (AppData, Temp, or ProgramData), consistent with DeviceManager RAT reconnaissance behavior delivered via the DOUBLECUP ClickFix loader.
Page 299 of 977