Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects persistence mechanisms via Windows Registry Run or RunOnce keys, specifically targeting the execution of Python scripts or common interpreted/executable files located in suspicious user profile directories (AppData, Temp, or Public folders). This behavior is characteristic of adversaries using Python-based remote access trojans (RATs) to maintain a foothold on a compromised host.
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
This rule monitors for a sequence of suspicious discovery commands (e.g., whoami, net, ipconfig) executed by web server processes (IIS w3wp.exe, Apache httpd, Nginx, or Tomcat). By requiring a threshold of at least three distinct discovery tools being executed by the same process within a 24-hour period, the rule identifies potential post-exploitation reconnaissance activity following a web server compromise.
This rule detects potentially malicious file deletion activity initiated by a Java-based application. It looks for common deletion commands ('del', 'rm', 'Remove-Item', 'unlink') in process command lines originating from 'java.exe' or 'javaw.exe', specifically targeting common staging paths ('Users\Public', 'AppData\Local\Temp') or filenames matching a specific pattern ('cleo.' followed by digits). This pattern is consistent with the behavior of staging and cleaning up artifacts during an intrusion.
Detects the execution of Microsoft Edge (msedge.exe) with suspicious command-line arguments designed to sideload malicious browser extensions, often associated with the UNC6692 campaign. The rule specifically looks for a combination of flags including --load-extension, headless/no-startup-window modes, known malicious or suspicious paths (e.g., 'User Data\test1'), and the disabling of browser synchronization or the first-run experience, occasionally triggered by scheduled tasks.
Detects Node.js processes executing code from compromised Joyfill beta packages (@joyfill/layouts or @joyfill/components). The rule triggers when a Node.js process attempts to load specific files or interact with file paths associated with these packages, which are indicative of an attempt to bypass standard installation security measures (like --ignore-scripts) and execute malicious code during package import.
This rule detects when common web browser processes spawn command-line shells or scripting interpreters. This behavior is often indicative of malicious browser extensions, browser exploitation, or remote code execution attempts, as browsers generally should not be launching native system shells.
Detects the creation of a scheduled task named 'WindowsUpdate' or 'BootUpdate' that triggers the execution of 'fsociety.exe' with SYSTEM privileges. This pattern is indicative of the TOKYOCORE malware establishing persistence on a Windows host.
Detects the use of netsh.exe to export Wi-Fi profiles with clear-text keys using output redirection or piping. This behavior is indicative of automated credential harvesting, such as that observed in the CaptiveCrunch campaign, while filtering out legitimate interactive usage and known remote support tools.
Detects execution of msconfig.exe or modification of the fDenyTSConnections registry value via reg.exe/powershell.exe, techniques STAC4749 operators used to enable Remote Desktop Protocol on compromised hosts to support lateral movement.
Detects automated or scripted access to Chrome's internal chrome://device-log/FIDO diagnostics page, or command-line evidence of 'security domain secret'/keys/wrap content, which can unintentionally expose the Security Domain Secret (SDS) master key. Scoped to headless/automation-flagged or script-launched Chrome processes to reduce noise from manual developer/support troubleshooting.
Detects execution or file drop of the GHOSTBLADE keychain-dumping module (keychain_copier.js) or its parent implant (ghostblade.js) on a device following DarkSword iOS exploit-chain compromise.
Detects macOS persistence via launchctl loading a LaunchAgent plist within 300 seconds of that plist file being created in /Library/LaunchAgents/, a technique associated with the DOUBLECUP loader delivering CountLoader and DeviceManager RATs.
Detects a process chain where mshta.exe is spawned by and descends from mshta.exe, executing a command line referencing a remote HTTP/HTTPS URL, consistent with CountLoader delivery observed in DOUBLECUP LaaS ClickFix campaigns.
Detects PowerShell processes whose command line chains a main() function call directly into Invoke-Expression, consistent with CountLoader's module-fetch-and-execute pattern used by DOUBLECUP LaaS.
Detects execution of pOneDrive.exe, cOneDrive.exe, or mOneDrive.exe running from a user profile or AppData path (outside standard Program Files/System32/SysWOW64 locations) whose PE OriginalFileName does not match the on-disk image name, indicative of CountLoader binary impersonation delivered via the DOUBLECUP loader.
Detects the DOUBLECUP ClickFix loader execution chain where cmd.exe uses a 'for /f' loop with 'where pow?r?hell.exe' wildcard lookup, 'findstr' searching for the ZZ1984 marker, and a minimized 'start /min cmd /c' relaunch, consistent with steganographic PNG cache extraction and CountLoader/DeviceManager RAT delivery.
This rule detects a potential credential exfiltration attempt following the launch of a terminal (cmd.exe, powershell.exe, bash, zsh, sh) by common IDE processes (Code.exe, Cursor.exe, Antigravity.exe). It monitors for sensitive configuration or credential files (such as .env, .aws/credentials, or .config/gh) being accessed within two minutes of a terminal process being spawned by the development environment.
Detects instances where Veeam ONE Agent components (VeeamOneAgent, VeeamOneWebService, or VeeamOneReportingSvc) initiate common command and scripting interpreters like cmd.exe, powershell.exe, cscript.exe, or wscript.exe. This activity is often indicative of potential exploitation of the backup management software or administrative abuse.
This rule detects when common administrative or networking tools such as bash, sh, cmd.exe, powershell.exe, curl, or wget are initiated by Langflow application processes (python, uvicorn, gunicorn). This behavior is indicative of potential command injection or exploitation of the Langflow platform to execute unauthorized commands or download malicious payloads.
This rule detects the creation of a Windows service named 'Cloud Sync Service' using command-line tools like 'sc.exe' or 'New-Service', or via direct service event monitoring. This behavior is often associated with malware persistence mechanisms that use misleading names to blend in with legitimate software services.
Page 305 of 977