Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the download, file creation, or execution of known NirSoft credential and browser harvesting utilities (ChromePass, WebBrowserBookmarksView, Network Password Recovery, LastActivityView) from non-standard directories or identified malicious actor infrastructure.
Detects command-line execution associated with WhatsApp API contact synchronization, specifically looking for 'WPP.contact.getAllContacts' or 'WPP.contact.list' commands. This pattern may indicate automated or unauthorized scraping of contact lists via a messaging interface.
Detects creation of a new com.<random-string>.plist file under ~/Library/LaunchAgents or /Library/LaunchAgents, followed by launchctl load/bootstrap referencing LaunchAgents, or an osascript-to-bash heredoc chain writing a plist into LaunchAgents, consistent with EtherHiding's macOS Launch Agent persistence mechanism.
Detects PowerShell invoking Get-CimInstance against Win32_Process to enumerate running processes (ProcessId, ParentProcessId, Name, ExecutablePath, CommandLine), converting output to compressed JSON, when spawned by or related to python.exe or cmd.exe -- consistent with the Edgecution native host's process-enumeration command (command 6).
Detects instances where Microsoft Edge (msedge.exe) initiates a python.exe process that executes 'native_host.py' (associated with the Edgecution malware suite) and subsequently writes files to sensitive or non-standard directories such as ProgramData or Edge recovery folders. This activity is indicative of the malware's native messaging host persistence, staging, or data exfiltration mechanisms.
Detects the execution of PowerShell or Command Prompt initiated by specific integration or MFT (Managed File Transfer) software processes (e.g., Cleo, Harmony, VLTrader). The rule monitors for command-line arguments indicative of encoded commands, script execution, or base64 decoding, which may suggest malicious activity or lateral movement originating from an exposed or compromised integration server.
This rule detects the use of the Windows utility 'certutil.exe' to download external files, executed from the context of common web server or application processes (e.g., w3wp.exe, nginx.exe). This pattern is a common technique used by attackers to stage malicious payloads or tools in publicly accessible or temporary directories after initial web-based compromise.
Detects instances where a Python interpreter (python.exe/pythonw.exe) or an executable file launched from temporary, roaming, or public directories initiates an outbound network connection to common C2/high-risk ports. This behavior is indicative of potential malware staging or C2 communication from obfuscated or temporary locations.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
This rule detects the Python interpreter (python.exe or pythonw.exe) spawning system administration or shell utility processes (e.g., cmd.exe, powershell.exe, netsh.exe). It explicitly excludes Python processes running from typical installation directories, flagging potential execution of malicious Python-based payloads or command-and-control (C2) agents that interact with the host operating system.
Detects the execution of tar.exe with passphrase-protected extraction flags (-xf and --passphrase) originating from or operating within a Microsoft Edge User Data directory. This behavior aligns with the 'Edgecution' malware deployment technique, where attackers leverage Edge application paths for staging and executing malicious payloads, as observed in UNC6692 campaigns.
Detects the CornFlake RAT masquerading as 'svchost32.exe' executing from within user AppData directories. The rule correlates the initiation of audio/video capture APIs (WASAPI or MediaFoundation) by this process with the subsequent creation of .wav, .jpg, or .jpeg files, suggesting unauthorized audio or camera capture by the malicious process.
Detects reconnaissance of system security posture by unsigned or unknown processes. The rule monitors for a combination of AV/EDR product enumeration (SecurityCenter2, Windows Defender exclusion queries), RDP history collection, Office MRU collection, and general system information gathering. It correlates two or more of these activities originating from the same process within a 15-minute window, while excluding known legitimate security and management software.
Detects multiple stages of the ChocoShell credential and token theft framework, including SYSTEM token impersonation for DPAPI key access, VSS shadow copy abuse to extract browser databases, malicious use of browser remote debugging ports (CDP) for cookie exfiltration, and unauthorized access to browser profile files or Token Broker cache (.tbres) files.
Detects the ClickFix technique where a fake 'Webcam Compatibility' / 'Zoom SDK Update' lure instructs a victim to press Win+R, paste clipboard content into the Run dialog, and press Enter, resulting in explorer.exe spawning powershell.exe with a short base64-encoded one-liner (<600 bytes)
Detects anomalous shell processes spawned as children of Git operations ('git apply' with index flags or specific plumbing commands) typical of the Gitea repository RCE vulnerability (CVE-2026-60004). This rule identifies malicious Git hooks triggered by the Gitea service account to execute arbitrary commands.
Detects PowerShell staging commands that download an executable with Invoke-WebRequest to $env:APPDATA\sekv<random>.exe, unblock it, and launch it via Start-Process, consistent with GoGRPC backdoor delivery following a Quick Assist vishing session.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Detects the use of PowerShell to invoke 'Confirm-SecureBootUEFI' or 'Clear-SecureBootKeys' cmdlets. These commands are utilized by the TOKYOCORE wiper malware to erase the UEFI Secure Boot key database, effectively preventing the system from booting a signed operating system as part of a destructive attack chain.
Detects a single process invocation querying WMI hardware/OS classes together with AntiVirusProduct/SecurityCenter2 enumeration, consistent with a reconnaissance module performing hardware/OS fingerprinting and AV product enumeration.
Detects the creation of scheduled tasks using schtasks.exe where the initiating process is unsigned or the target binary path is located in common user-writable or temporary directories, a technique frequently used by malware for persistence.
Page 308 of 977