Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the creation of suspicious file types (.txt, .esd) within Windows Update (WSUS) content or download directories, specifically when initiated by standard Windows update-related processes (wuauclt.exe, TrustedInstaller.exe, or svchost.exe). This pattern may indicate an attempt to blend malicious activity with legitimate update mechanisms or an abuse of update file paths for payload delivery.
Cortex XDR Process Lineage Observation
Cortex XDR
This rule monitors and retrieves process lineage information, including child process execution, parent process context, and grandparent process hierarchy for a specific host. It extracts process execution details such as image names and command lines to provide visibility into process trees for forensic investigation and behavior analysis.
Detects local Administrators group enumeration via net.exe or net1.exe within 10 minutes of a PsExec session on the same device. This behavior is indicative of post-compromise privilege or account discovery following remote service execution.
Detects the use of the Certutil utility to decode an encoded file (often obfuscated malicious code) followed by the execution of an MSI installer on the same device. This pattern is commonly used in multi-stage downloaders and installer-based attacks to reassemble or deobfuscate payload files.
Detects the execution of an 'update.exe' process initiated by 'svchost.exe' where the update executable resides in non-standard, user-writable directories (AppData, Temp, Users Public, or Downloads). This behavior is highly suspicious as svchost.exe should typically only execute binaries from system directories, and the target file is running in a location common for malware staging.
Detects ClickFix social-engineering attacks where a user is tricked into pasting malicious commands into the Windows Run dialog. The detection monitors explorer.exe spawning cmd.exe or powershell.exe with specific command-line indicators, such as wildcard patterns used to obfuscate powershell.exe names, the 'ZZ1984' marker string associated with DOUBLECUP/ClickFix loaders, or specific loop structures ('for /f') designed to locate and parse payloads staged in browser cache.
This rule detects potential malicious activity associated with the 'ClickFix' technique, commonly linked to Midnight Blizzard. It identifies a sequence of events where a device attempts to resolve or fetch a 'wpad.dat' file (a common indicator of proxy configuration manipulation or man-in-the-middle attempts) followed shortly thereafter by the execution of 'powershell.exe' or 'mshta.exe' spawned from 'explorer.exe' on the same host within a 30-minute window. This pattern is indicative of a user being coerced into executing malicious scripts under the guise of fixing connectivity or security prompts.
This rule detects potential multi-stage loader execution chains where a user mounts an ISO file via Windows Explorer, followed by the execution of LOLBAS binaries (rundll32.exe, regsvr32.exe, or mshta.exe) that exhibit suspicious behavior such as reflective loading or memory allocation commands within a 30-minute window of the ISO mount event.
Detects the ChainDrop/Shai-Hulud 2.0 "Run Copilot" secrets-laundering technique: a CI workflow step dumping toJSON(secrets) to a format-results.txt artifact, followed by GitHub Actions artifact-API downloads using scraped ghs_ runner tokens and git ref deletion used to cover tracks.
Detects a sequence of potentially malicious activities on a Windows host: a batch script command referencing AMSI bypass, followed within 30 minutes by a registry modification affecting Windows SmartScreen settings, and culminating in a silent MSI installation (msiexec.exe /qn). This pattern is consistent with an adversary attempting to disable security controls to facilitate an stealthy software installation.
Detects the execution of nslookup.exe invoked by common shell programs (cmd.exe, powershell.exe, etc.) with command-line arguments indicative of network scanning or discovery activities, such as targeting specific IP addresses or requesting specific DNS record types.
Detects host-profiling reconnaissance behavior characteristic of the CountLoader malware, where a process concurrently checks for common cryptocurrency wallet and Signal messaging application data folders alongside performing WMI-based antivirus product enumeration within a 5-minute window.
Detects a suspicious process spawning from one of the Microsoft Office suite products (Word, Excel, PowerPoint, Publisher, Visio, etc.)
Detects the use of PowerShell cmdlets 'Set-MpPreference' to disable real-time monitoring or 'Add-MpPreference' to add exclusion paths. The rule specifically alerts on these actions when accompanied by obfuscation or hidden execution flags, identifying behavior common to defense evasion tactics used by malware like the Larva-24009 backdoor. Legitimate management tools (e.g., SCCM, Intune) are excluded.
Detects the execution of Chromium-based browsers (Chrome, Edge, Brave, Chromium) using command-line arguments '--load-extension' or '--disable-extensions-except'. These flags are typically used for development purposes but are abused by attackers to sideload malicious, unpacked extensions, bypassing the browser's extension store review process and enabling techniques such as credential theft or C2 persistence.
Detects the execution of npm, pnpm, or yarn commands used to install or add specific beta releases of the @joyfill/layouts and @joyfill/components packages, which are known to contain malicious code designed to deliver a multi-stage RAT.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects potential malicious activity related to the XCSSET macOS malware, which leverages Xcode projects to execute malicious payloads. The rule monitors for suspicious process execution (e.g., curl, osascript, zsh) initiated by Xcode-related processes, and unusual modifications to .zshrc files by processes other than standard shells or editors.
Detects the execution of the LimeWire P2P file-sharing application within 30 minutes of the creation of sensitive files, such as LSASS memory dumps, NTDS.dit, or SAM/SYSTEM/SECURITY registry hives, on the same host. This temporal correlation suggests the potential exfiltration of sensitive credential material via P2P file-sharing.
Detects Python worker processes (e.g., dataset converters) spawning suspicious child processes (shells, network tools) or accessing sensitive filesystem paths/endpoints, such as Kubernetes service account tokens or cloud instance metadata, which are often indicative of post-exploitation activity following an SSTI or code injection vulnerability.
This rule detects persistence mechanisms via Windows Registry Run or RunOnce keys, specifically targeting the execution of Python scripts or common interpreted/executable files located in suspicious user profile directories (AppData, Temp, or Public folders). This behavior is characteristic of adversaries using Python-based remote access trojans (RATs) to maintain a foothold on a compromised host.
Page 302 of 977