Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects a python3 script executed from /tmp under a zsh parent with command-line indicators of network activity (URLs, sockets, requests/urllib, curl/wget, or tunnel tool names), indicating a coding-agent-staged script establishing outbound network or tunnel connections.
Detects a sequence where a host performs process enumeration for EDR/AV security tools (CrowdStrike, Sophos) followed within 5 minutes by the execution of Microsoft Edge with specific flags (--headless=new or --no-startup-window, --load-extension, --disable-sync). This pattern is consistent with the UNC6692 'Edgecution' malware tradecraft used to check for security presence before sideloading a malicious browser extension.
Detects the deletion of the 'Zone.Identifier' alternate data stream from a downloaded .msi file, followed closely by the execution of that file using 'msiexec.exe'. This pattern is a known technique for bypassing Windows Mark-of-the-Web (MOTW) protections, which normally trigger SmartScreen warnings or Restricted View protections for internet-downloaded files.
Detects the deployment and execution of GSocket-based persistence mechanisms on Linux systems. This includes monitoring for the use of deployment scripts (gs_deploy.py, gs_persist.py), the establishment of cron jobs for periodic GSocket check-ins, the use of GSOCKET_HOST environment variables to control network behavior, and the execution of GSocket binaries staged in suspicious locations such as /tmp/.gs or web server directories.
Detects dual remote-access activity initiated by PowerShell. The rule tracks two behaviors: the installation of an UltraVNC server listener on ports 5800/5900, and PowerShell-spawned executables dropped into common user-writable directories (Temp, AppData, etc.) establishing network connections to known Larva-24009 C2 infrastructure.
Detects the execution of known remote monitoring and management (RMM) or remote access tools shortly after Microsoft Teams process activity on a host. This behavior is consistent with helpdesk-impersonation vishing attacks where an adversary convinces a user to initiate a remote session.
Detects potential steganographic data extraction by monitoring for command-line usage of certutil.exe or findstr.exe associated with specific file size markers (304204 bytes) or URL patterns (stego-image.png?sid=) often used in browser-cached file extraction, specifically linked to DOUBLECUP Stage 1 activity.
No description available.
Detects a multi-stage exploitation chain for CVE-2026-15410 targeting SonicWall SMA 1000 appliances. It correlates web request logs containing path traversal sequences in a hotfix parameter, associated application log entries indicating removal of a hotfix referencing a temporary file, and subsequent system shutdown commands executed with root privileges, indicating successful privilege escalation and system compromise.
Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.
Detects the execution of cmd.exe, powershell.exe, or pwsh.exe launched directly from Windows Explorer (explorer.exe) where the command line contains obfuscated arguments, long encoded strings, or specific indicators associated with common click-based execution attacks.
This rule detects malicious activity associated with the DOUBLECUP/CountLoader malware by correlating specific PowerShell execution patterns within a single process lineage. It flags process sequences where an encoded PowerShell command (using -enc or -encodedcommand) occurs in conjunction with suspicious .NET reflection (System.Reflection.Assembly) or ScriptBlock invocation within a 5-minute window. The rule explicitly excludes processes with valid digital signatures to reduce false positives from legitimate administrative software.
Detects PowerShell creating shortcuts within the Windows Startup folder using Environment.GetFolderPath and CreateShortcut.
Detects the execution of 'certighost.py', a Python-based tool used to exploit CVE-2026-54121. The detection monitors process command lines for the specific script name in combination with command-line arguments (such as --dc-ip, --template, --computer-name, etc.) used to abuse the AD CS chase enrollment flow for malicious certificate requests.
This rule detects potentially malicious file deletion activity initiated by a Java-based application. It looks for common deletion commands ('del', 'rm', 'Remove-Item', 'unlink') in process command lines originating from 'java.exe' or 'javaw.exe', specifically targeting common staging paths ('Users\Public', 'AppData\Local\Temp') or filenames matching a specific pattern ('cleo.' followed by digits). This pattern is consistent with the behavior of staging and cleaning up artifacts during an intrusion.
This rule monitors for a sequence of suspicious discovery commands (e.g., whoami, net, ipconfig) executed by web server processes (IIS w3wp.exe, Apache httpd, Nginx, or Tomcat). By requiring a threshold of at least three distinct discovery tools being executed by the same process within a 24-hour period, the rule identifies potential post-exploitation reconnaissance activity following a web server compromise.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Detects PlistBuddy setting a StartInterval key on a com.*watchdog.plist LaunchAgent from a zsh parent process, indicating a coding-agent-driven persistence mechanism used to relaunch a reverse-tunnel watchdog after reboot or process termination.
This rule detects when common administrative or networking tools such as bash, sh, cmd.exe, powershell.exe, curl, or wget are initiated by Langflow application processes (python, uvicorn, gunicorn). This behavior is indicative of potential command injection or exploitation of the Langflow platform to execute unauthorized commands or download malicious payloads.
This rule detects the extraction of a specific Python 3.13.3 embedded runtime archive ('python-3.13.3-embed-amd64-with-pip.zip') using tar.exe with a passphrase, targeted specifically at the Microsoft Edge User Data directory. The execution is flagged when initiated by processes like AutoHotkey or processes originating from within the Edge User Data directory, which is indicative of the 'Edgecution' malware suite's method for establishing a persistent native messaging host to facilitate malicious browser-based activity.
Detects potential exploitation of CVE-2026-59726 (RufRoot) against the Ruflo MCP bridge service. The rule identifies when the 'node' or 'ruflo' processes spawn shell interpreters (sh, bash) with command-line arguments typical of initial reconnaissance (id, hostname, whoami, uname) or arbitrary command execution, indicative of an unauthenticated remote code execution attempt.
Page 303 of 977