Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects instances where the Internet Information Services (IIS) worker process (w3wp.exe) initiates execution of suspicious binaries such as cmd.exe, powershell.exe, or other script interpreters, which may indicate web-based exploitation or lateral movement.
Detects shell/command execution spawned by a Marimo notebook server process where the shell command line contains suspicious indicators (download-and-execute patterns, base64-encoded commands, reverse-shell syntax, or outbound network utility invocation), consistent with exploitation of CVE-2026-39987 leading to command execution on Marimo notebook processes.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects the execution of a Windows system binary that is usually located in the system folder from an uncommon location.
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
Detects NightLedger backdoor command dispatcher invoking known command IDs for process execution (3), DLL loading (43), process termination (56), and thread termination (69) as parsed from its C2 channel. When the dispatching process is AppVShNotify.exe, these actions are common to legitimate App-V activity, so the rule only fires for that image when there is additional evidence it is the compromised implant host - either recorded process lineage (ParentImage) or image-load context showing a module already loaded into the process (ImageLoaded). Events for AppVShNotify.exe lacking both signals are suppressed as likely benign generic process control.
Suspicious Script and Utility Execution
Cortex XDR
This rule detects the execution of common command-line interpreters and utility tools frequently abused by attackers for reconnaissance, execution, and post-exploitation activities. Monitored binaries include script interpreters (python.exe, powershell.exe, pwsh.exe, bash.exe, sh.exe) and command-line utilities (cat, grep, find).
Detects unauthorized modifications to the /etc/init.d/workplace initialization script on SonicWall SMA appliances, specifically looking for additions of commands that launch the KNUCKLEBALL Python-based loader (deploy_new.py). This behavior indicates an adversary attempting to establish boot-time persistence.
Detects the process st.exe (identified as StealC / TrojanPSW:Win32/StealC) executing and subsequently accessing well-known browser credential store artifacts (Login Data, Cookies, key4.db, logins.json, Local State, Web Data) used to harvest stored passwords and session data from browsers.
Detects execution of files named svchost32.exe or chrome_update.exe running from non-system paths (AppData, Temp, Downloads) that are unsigned or whose code-signing certificate does not match the expected legitimate signer (Microsoft/Google), indicative of the CornFlake RAT dropper used by Midnight Blizzard/Storm-2945 in the CaptiveCrunch campaign.
Detects automated or scripted access to Chrome's internal chrome://device-log/FIDO diagnostics page, or command-line evidence of 'security domain secret'/keys/wrap content, which can unintentionally expose the Security Domain Secret (SDS) master key. Scoped to headless/automation-flagged or script-launched Chrome processes to reduce noise from manual developer/support troubleshooting.
This rule detects suspicious process execution where PowerShell (powershell.exe) spawns a Python interpreter (python.exe or pythonw.exe) located in an AppData\Roaming directory. It specifically flags instances where the command line of the invoked process includes both a reference to the AppData\Roaming directory and a Python script (.py) file, which is a common behavior for loaders like CastleLoader attempting to execute scripts from user-writable directories.
Detects exploitation of the CVE-2026-12569 Java deserialization vulnerability in PTC Windchill and FlexPLM. The detection triggers when the specific payload class 'com.ptc.wpcfg.logic.ExpressionClassMethod' is identified within command-line arguments of Java-based processes, indicating an attempt to achieve remote code execution through the application's deserialization flaw.
Detects potential post-exploitation activity originating from the SharePoint worker process (w3wp.exe). The rule monitors for three primary indicators: w3wp.exe spawning command interpreters (cmd.exe or powershell.exe), unauthorized file modifications or creations within SharePoint web directories, and outbound network connections to public IP addresses initiated by w3wp.exe, which may indicate payload delivery or C2 communication. (CVE-2026-50522)
Detects instances where an nginx worker process spawns a shell interpreter, such as sh or bash. This behavior is highly irregular for a web server and is often indicative of exploitation of a remote code execution vulnerability, such as the referenced CVE-2026-42533.
This rule detects the execution of the Cloudflare Tunnel utility (cloudflared.exe) or similarly named binaries from non-standard, suspicious locations like temporary directories or public user folders. This pattern is commonly used by attackers to establish unauthorized persistent network tunnels (reverse proxies) into the victim's environment, bypassing firewall restrictions.
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
Detects execution of remote access/RMM tools (Microsoft Quick Assist, RemSupp, DWAgent, AnyDesk) observed used by STAC4749 for initial access and backup remote-access channels following Teams vishing contact.
Detects launch of STAC4749 Golang-based C2 implants via a command line containing the '--token-raw=' authentication argument, known implant filenames, or downloads from the fa5.flsdwnld.online C2 domain.
Detects a Python process invoking native_host.py (the Edgecution native messaging host component) spawning cmd.exe or powershell.exe with command-line flags consistent with UNC6692's Edgecution malware suite execution capability, including PowerShell launched with -NoProfile -NonInteractive -ExecutionPolicy Bypass -Command or cmd.exe launched with /c chcp 65001.
Page 306 of 977