Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects anomalous scheduled task execution by identifying processes named 'csvchost.exe' or 'psvchost.exe' that reference GoogleUpdateService or MSEdgeUpdateService task names containing GUID patterns. It further correlates this with suspicious command-line indicators such as 'App.py' references, 'WakeToRun' flags, '-headless' flags, or PowerShell bypass techniques, which are associated with the delivery of CountLoader and DeviceManager RATs in DOUBLECUP campaigns.
Detects a curl request to a tunnel-exposed /api/summary endpoint piped through jq extracting a 'spend' field, indicating automated exfiltration of financial data via a coding-agent-established tunnel.
Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.
Detects execution of potentially malicious JavaScript files (e.g., setup.mjs, math_init.js) via Node.js or Bun command-line tools. This often indicates the execution of obfuscated or unauthorized scripts during software installation or supply chain compromise attempts.
Detects anomalous network behavior where a python.exe process initiates connections to multiple internal hosts across sensitive ports (135/445/3389) in a short time frame. This pattern is indicative of reconnaissance or lateral movement staging, commonly observed with portable Python interpreters used by malware suites like Edgecution.
Detects the execution of msiexec.exe to install ScreenConnect.ClientSetup.msi when initiated from user-controlled directories like Downloads or Temp folders. This behavior is indicative of potential social engineering or phishing attacks leveraging legitimate remote access software installers.
Detects post-exploitation persistence artifacts on Windows endpoints managed by N-able N-central consistent with abuse of CVE-2026-18577, including a new Windows service named Cloudflared, registry Services key creation for Cloudflared, a file named svchost.exe written under a user's Documents folder, or process execution of cloudflared.exe or a Documents-located svchost.exe.
This rule detects account and credential enumeration activities using the macOS 'dscl' (Directory Service Command Line) utility. It specifically monitors for 'dscl' commands ('-list /Users', '-read', or '-authonly') being invoked by unsigned shell scripts (sh, bash, zsh) or scripts running from suspicious locations like '/tmp/', '/private/tmp/', '/private/var/folders/', or '/Downloads/'. The rule effectively identifies potential reconnaissance or credential harvesting attempts often associated with malicious macOS 'clickfix' campaigns.
Detects the use of 'curl' to perform a network request (likely for a remote script) and immediately piping that output to 'osascript' for execution in memory. This pattern is often used to execute malicious AppleScript payloads directly without writing to the disk, a technique seen in recent macOS infostealer campaigns.
This rule detects activities indicative of Android APK repackaging and the manual injection of the Frida-gadget library to bypass security controls like SSL pinning. It monitors for the use of APK patching tools followed by ADB installation commands, the installation of specific patched APK names, the presence of the Frida-gadget shared library file, and system-level signature mismatch errors from the PackageManager.
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
This rule detects two potentially malicious behaviors: 1) The creation or installation of a Windows service using the 'Cloudflared' executable, which can be leveraged for unauthorized tunneling or persistence. 2) The execution of an executable named 'svchost.exe' located within a user's Documents folder, which is a common indicator of file masquerading to evade detection.
khunt actor did this after confirming SYSTEM access via KhuntCmd. This one's noisier - backup software and some AV tools do reg save legitimately, so tighten it to non-backup accounts / unmanaged paths if you get FPs.
Detects the use of the Certutil utility to decode an encoded file (often obfuscated malicious code) followed by the execution of an MSI installer on the same device. This pattern is commonly used in multi-stage downloaders and installer-based attacks to reassemble or deobfuscate payload files.
Detects the execution of common shell utilities, interpreters, or configuration commands initiated by QEMU or KVM processes. This often indicates the use of virtualized environments to execute payloads, bypass security controls, or hide artifacts within a host system, especially when correlated with process crashes related to hypervisor components.
Detects the creation of a scheduled task named 'MicroUpdaterV1' using the 'schtasks.exe' utility with an XML configuration file ('t.xml') that specifies 'pythonw.exe' as the task target. This behavior is associated with the persistence mechanism of the DeviceManager RAT as delivered by the DOUBLECUP loader.
Detects the execution of unsigned JavaScript (.js) files using the Windows Script Host (wscript.exe). Adversaries often use JavaScript for initial execution or as a secondary payload, and obfuscation is commonly applied to these scripts to evade detection.
This rule detects the execution of 'pkexec' or 'sudo' by a low-privilege web server process (e.g., Apache, Nginx, PHP-FPM) that results in a process running with root privileges. This pattern is indicative of privilege escalation attempts targeting local vulnerabilities, such as CVE-2021-4034 (PwnKit) or CVE-2021-3156 (Baron Samedit), where a compromised web application account attempts to elevate to root.
Detects instances where VS Code (Code.exe) or Node.js (node.exe) processes reference CI/CD-related environment variables in their command line. This behavior is often associated with build pipeline manipulation, credential harvesting from environment configurations, or post-exploitation activities within developer environments.
Detects potential memory scraping or credential dumping attempts targeting the Google Chrome process (chrome.exe). The rule monitors for command-line arguments involving known dump utilities ('MiniDump', 'procdump', 'rundll32') or the use of 'comsvcs.dll', which is commonly used to dump process memory, specifically when targeted against a browser process.
This rule detects PowerShell execution patterns indicative of fileless information stealer activity. It searches for specific command-line flags often associated with obfuscated or hidden script execution (e.g., -EncodedCommand, -nop -w hidden, IEX) combined with attempts to access or target sensitive files and tokens (e.g., Cookies, Login Data, msal.cache, AAD.BrokerPlugin) common in Microsoft 365 and browser-based credential theft.
Page 300 of 977