Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects process discovery activities (using tasklist.exe, wmic, or Get-Process) performed on a Windows endpoint shortly after an 'MSP Support' account logon, commonly associated with reconnaissance during exploitation of N-able N-central vulnerabilities.
This rule monitors for Microsoft IIS worker processes (w3wp.exe) initiating common command-line shells or scripting engines. This behavior is indicative of successful remote code execution exploitation against internet-facing web applications, such as SharePoint or Telerik UI, often via deserialization vulnerabilities.
Detects instances where a Java process (typically a web application server like Tomcat) initiates suspicious command-line tools such as cmd.exe, powershell.exe, or various Linux shell binaries, using command-line arguments indicative of a reverse shell or code execution (e.g., -e /bin/sh, -i, /dev/tcp, IEX, DownloadString). This pattern is commonly associated with exploit attempts targeting vulnerabilities like Java deserialization.
This rule detects potentially malicious command-line execution patterns often observed in 'ClickFix' or similar clipboard-based attack campaigns. It monitors for instances where standard Windows interpreters (PowerShell, cmd.exe, mshta.exe) are launched by legitimate shell processes (explorer.exe, rundll32.exe) and execute specific commands (like certutil for decoding) to process content found in suspicious or user-writable locations such as AppData or containing file extensions like .png (often used for steganography or file hiding).
Detects the execution of DragonForce ransomware binary or its associated event log clearing batch script, as observed in attacks leveraging SimpleHelp vulnerabilities.
Detects the creation and subsequent execution of AppleScript files (.scpt) using the 'osascript' command-line utility on macOS. This pattern is commonly used to automate tasks, but can be leveraged by attackers for malicious payload execution or system interaction.
This rule detects the execution of potentially malicious command-line patterns (involving base64 decoding, pipes to sh/zsh, and network-fetching utilities like curl) within Terminal.app processes on macOS. It correlates these command executions with prior web browser activity within a 5-minute window, effectively identifying potential 'ClickFix' social engineering lures where users are coerced into copying and pasting malicious instructions into their shell.
This rule detects the multi-stage execution pattern characteristic of the AMOS stealer on macOS, where a terminal session is used to execute a base64-encoded payload piped into a shell interpreter. The rule specifically monitors for processes like curl, openssl, base64, and zsh being launched from a Terminal or shell parent, often involving specific command-line indicators or malicious URLs associated with the stealer's toolkit.
khunt actor did this after confirming SYSTEM access via KhuntCmd. This one's noisier - backup software and some AV tools do reg save legitimately, so tighten it to non-backup accounts / unmanaged paths if you get FPs.
Detects screenshot capture events on domain controllers occurring while both FTK Imager and Microsoft Edge processes are running within the same 15-minute window, consistent with UNC6692's Edgecution malware suite deployment where attackers use FTK Imager for forensic/data collection and Edge (loaded with a malicious extension) as the Edgecution backdoor, alongside screen capture activity for surveillance/monitoring of compromised domain controllers.
This rule detects the use of the Certutil.exe utility with flags commonly associated with adversary techniques such as downloading files, decoding malicious payloads, or manipulating the Windows Certificate Store.
Detects the execution of FTK Imager.exe followed by the creation of the Active Directory database (NTDS.dit) and at least one critical Windows registry hive file (SAM, SYSTEM, or SECURITY) in the user's Downloads folder within a 30-minute timeframe. This pattern is indicative of potential credential theft or offline password cracking attempts using forensic imaging utilities.
Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.
Detects the execution of the rclone utility followed by successful outbound network connections occurring outside of standard business hours (8:00 PM to 6:00 AM). Rclone is a legitimate cloud storage synchronization tool frequently abused by adversaries for data exfiltration. This pattern identifies potential unauthorized data staging and egress to remote cloud storage services during times when activity is less likely to be monitored.
Detects VS Code / Node.js extension host processes invoking command lines that reference CI/CD and repository environment variables (e.g., GITHUB_REPOSITORY, CI_PROJECT_PATH, Azure DevOps collection URI, Buildkite, CircleCI, Codespace, Gitpod), consistent with malicious Open VSX "evil twin" extensions harvesting developer and CI/CD metadata.
Detects python.exe executing from unusual locations (AppData, Temp, or ProgramData directories) that subsequently establish outbound network connections, consistent with DeviceManager RAT behavior delivered via the DOUBLECUP loader.
Detects msiexec.exe executed with silent installation flags (/i /quiet /qn) targeting an MSI file that was written to disk within the preceding 15 minutes, consistent with the CountLoader delivery chain associated with DOUBLECUP.
Detects the UAC self-elevation behavior associated with DeadLock ransomware, specifically the repeated creation and execution of randomly named 8-character .cmd files in user-writable directories (Temp, ProgramData, AppData). The detection triggers when multiple execution attempts are identified within a short window, suggesting a retry loop when UAC prompts are not immediately accepted.
Detects execution of the "mofcomp" utility as a child of a suspicious shell or script running utility or by having a suspicious path in the commandline.
The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.
Attackers abuse this utility to install malicious MOF scripts
The "mofcomp" utility parses a file containing MOF statements and adds the classes and class instances defined in the file to the WMI repository.
Attackers abuse this utility to install malicious MOF scripts
Detects the creation of suspicious file types (.txt, .esd) within Windows Update (WSUS) content or download directories, specifically when initiated by standard Windows update-related processes (wuauclt.exe, TrustedInstaller.exe, or svchost.exe). This pattern may indicate an attempt to blend malicious activity with legitimate update mechanisms or an abuse of update file paths for payload delivery.
Detects the execution of processes related to 'SKILL.md', 'npx', 'mcp-server', or 'invoke_skill' followed closely by read or copy actions on sensitive file locations (SSH keys, AWS credentials, environment files, or AppData). The rule further correlates this activity with subsequent outbound network connections from the same device.
Page 301 of 977