Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects two potentially malicious behaviors: 1) The creation or installation of a Windows service using the 'Cloudflared' executable, which can be leveraged for unauthorized tunneling or persistence. 2) The execution of an executable named 'svchost.exe' located within a user's Documents folder, which is a common indicator of file masquerading to evade detection.
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
Detects instances where Veeam ONE Agent components (VeeamOneAgent, VeeamOneWebService, or VeeamOneReportingSvc) initiate common command and scripting interpreters like cmd.exe, powershell.exe, cscript.exe, or wscript.exe. This activity is often indicative of potential exploitation of the backup management software or administrative abuse.
Detects the execution of 'cloudflared', a tool used to establish secure tunnels from a local network to Cloudflare's edge, by monitoring for common command-line arguments such as 'service install', 'tunnel run', or '--url'. This behavior could indicate an attempt by an attacker to create a persistent or ad-hoc reverse proxy for remote access.
Detects instances where the Node.js package manager (npm) or node process initiates suspicious child processes such as curl, powershell, or shell interpreters (bash/sh/cmd) containing command-line arguments indicative of downloading or executing remote content (e.g., GitHub raw URLs or pipes to interpreters). This behavior is characteristic of supply chain attacks or malicious installation scripts.
Detects instances where Java or Oracle-related processes (java.exe, oracle.exe, tnslsnr.exe) initiate suspicious command-line tools like cmd.exe or powershell.exe to execute commands typically associated with reconnaissance, such as whoami or tasklist. This is a strong indicator of post-exploitation activity where a compromised web server or database process is being used to conduct system discovery.
Detects a VBS script invoking PowerShell to decode a Base64 payload, write it to disk with a random name, and decompress it using IO.Compression.GzipStream into tmp*.bat.gz/tmp*.bat files, consistent with the AutoIT-based VIPKeylogger/MedusaHVNC infection chain.
This rule detects PowerShell processes attempting to bypass the Antimalware Scan Interface (AMSI) via .NET reflection, specifically targeting 'AmsiUtils' or 'amsiInitFailed' fields. To reduce noise, it correlates this activity with the presence of WinHTTP COM objects (for network evasion) or timing-based functions (e.g., Stopwatch, GetTickCount) often used for anti-sandbox or anti-analysis evasion, characterizing behavior consistent with the ChocoShell malware family.
Detects redundant persistence mechanisms associated with the CornFlake RAT by identifying the creation of Windows services, registry run keys, and scheduled tasks that reference a binary named svchost32.exe located outside of the standard C:\Windows\System32 directory, often masquerading as a 'Cloud Sync Service'.
Detects NightLedger backdoor command dispatcher invoking known command IDs for process execution (3), DLL loading (43), process termination (56), and thread termination (69) as parsed from its C2 channel. When the dispatching process is AppVShNotify.exe, these actions are common to legitimate App-V activity, so the rule only fires for that image when there is additional evidence it is the compromised implant host - either recorded process lineage (ParentImage) or image-load context showing a module already loaded into the process (ImageLoaded). Events for AppVShNotify.exe lacking both signals are suppressed as likely benign generic process control.
Detects the creation of a Windows service named 'svchost32' with a display name of 'Cloud Sync Service' via administrative command-line utilities like sc.exe, PowerShell, or cmd.exe. This activity is a known persistence mechanism for the CornFlake RAT, which masquerades as a legitimate system process to evade detection.
Detects the execution of the 'clientCode' RAT process when initiated by a Node.js process (node.exe/node). This behavior is indicative of a second-stage payload execution related to supply chain compromises where malicious dependencies are leveraged to gain remote shell access.
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
Detects a multi-stage execution chain involving a malicious LNK file that triggers PowerShell. The rule specifically looks for PowerShell commands spawned by explorer.exe or mshta.exe that contain indicators of string deobfuscation (using .Replace), specific job-related keywords (CoreJob), or remote content retrieval (Net.WebClient.DownloadString). The detection correlates these process events with the presence of suspicious LNK files and decoy document files dropped within the temporary directory on the same endpoint.
This rule detects the use of 'osascript' on macOS to execute commands that interact with the 'AccountsHelper' process, specifically using 'stat' to probe /dev/console and 'sudo -u' for privilege elevation or user context switching. This pattern is indicative of unauthorized attempts to interact with system account management utilities or sensitive user processes.
No description available.
Detects the execution of 'su' or 'sh' binaries from within suspicious application-specific directories on Android devices. These directories typically house application libraries or data, and execution of system binaries from these locations, particularly when combined with arguments like 'persisted' or 'exit', is indicative of privilege escalation attempts or malicious persistence mechanisms by Android malware.
Detects network, process, and file activity referencing the specific hard-coded VAPID public key used by SNOWBELT in the UNC6692/Edgecution campaign for push-notification-based registration, correlating browser extension file drops (background.js, extension.log) with the key's appearance in network traffic or process command lines.
Detects the execution of PsExec.exe in correlation with the installation of the PSEXESVC service on the same host within a 15-minute timeframe. The rule includes an allowlist filter for authorized administrative accounts to minimize alerts for legitimate infrastructure management.
Detects a pattern where a process enumerates running processes via tasklist looking for msedge.exe with SHELL32.dll or CoreUIComponents.dll modules loaded, followed within 5 minutes by a taskkill /F /PID command against that process, initiated by svchost.exe, taskeng.exe, python.exe, pythonw.exe, powershell.exe, or a process invoked via native_host.py. This behavior matches Edgecution's technique of detecting a running headless Edge instance and terminating it before relaunching, as observed in the UNC6692 campaign.
This rule detects the execution of the Cloudflare Tunnel utility (cloudflared.exe) or similarly named binaries from non-standard, suspicious locations like temporary directories or public user folders. This pattern is commonly used by attackers to establish unauthorized persistent network tunnels (reverse proxies) into the victim's environment, bypassing firewall restrictions.
Page 304 of 977