Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of mshta.exe with a remote URL containing an .hta file in the command line. This pattern is commonly used by adversaries to proxy execution of malicious scripts via a trusted Windows binary, often initiated by common applications like explorer.exe or cmd.exe.
Detects a non-root local process gaining a root shell or executing a SUID-root binary shortly after AF_RXRPC (rxrpc) network socket activity on the same device, consistent with exploitation of the DirtyDecrypt RxGK decrypt-before-authentication flaw to corrupt page-cache pages of SUID-root binaries and gain root.
Detects an unprivileged local user invoking keyctl to add a key of type rxrpc_s to a keyring they control, enabling userspace reproduction of the kernel's RxGK token encryption key derivation as part of CVE-2026-31635 (DirtyDecrypt) exploitation.
Detects PowerShell-driven download and execution of STAC4749 loader/backdoor payloads (ms_876*.exe, sekv*.exe, helper*.exe, 74fs*/7414fs*.exe, 45234ssdf403851640.exe, updater.exe, msupdate.exe) staged in AppData\Roaming or AppData\Local\Temp, or execution from known STAC4749 download domains/URLs.
Detects a command line containing the Cyrillic string 'вшк', a mistyped attempt at the 'dir' command on a Russian keyboard layout, observed as a hands-on-keyboard artifact in STAC4749 intrusions.
Detects msiexec.exe installing Claude.msi or GolddTV.msi (which use VBScript custom actions to drop the TriBack Loader triad into the Startup folder) or the associated desktop shortcut created under ProgramFiles\SquirrelTemp pointing to the staging VBScript.
Detects the creation of explorer.exe processes on non-default Windows desktops, which is a known indicator of Hidden VNC (HVNC) activity often utilized by the Dolphin X stealer. The rule mitigates false positives by excluding legitimate non-default desktop uses (like RDP/Citrix/VDI brokers) and requires correlation with a recent network connection from the newly spawned explorer.exe process.
Detects execution of a bash reverse shell using /dev/tcp TCP redirection, a persistence/backdoor technique used by TA458 SpyPress operators on compromised webmail servers to connect back to C2 infrastructure.
This rule monitors process command line arguments for strings containing 'maliciousdomain.com'. This pattern is indicative of a process interacting with a known malicious domain, commonly associated with phishing campaigns or initial access attempts where malicious links or payloads are invoked via command-line tools.
Detects a suspicious sequence of events where a browser process (Firefox or Tor) is followed by a process escalation to root within 15 minutes on the same device. This pattern is indicative of a browser sandbox escape combined with kernel privilege escalation (e.g., exploitation of CVE-2026-10702 and CVE-2026-43499).
Detects a suspicious pattern where a process creates a file in /dev/shm/, unlinks it, and re-executes itself from /proc/self/fd/ while manipulating the process name to masquerade as the systemd-journald daemon. This behavior is indicative of fileless execution techniques used by malware to maintain a presence while blending in with legitimate system processes.
Detects the execution of Chrome or Edge browsers with --headless and --remote-debugging-port command-line flags when launched by suspicious or non-standard parent processes. This behavior is commonly associated with msaRAT, which leverages the Chrome DevTools Protocol (CDP) to establish a covert Command and Control (C2) channel through a headless browser instance.
Detects installation or require-time execution of known-malicious SleeperGem RubyGems package versions (git_credential_manager 2.8.0-2.8.3, Dendreo 1.1.3-1.1.4, fastlane-plugin-run_tests_firebase_testlab 0.3.2) via gem install/bin/install command lines, and matches the same version strings when found in Gemfile.lock dependency manifests.
Detects a parent process spawning at least two distinct macOS system reconnaissance utilities (sw_vers -productVersion, system_profiler SPHardwareDataType, ioreg -rd1 IOPlatformExpertDevice) within a 5-minute window, consistent with CountLoader recon behavior delivered via the DOUBLECUP ClickFix loader.
Detects PowerShell or pwsh execution containing a custom regex-based JSON key/value parsing pattern (mimicking CountLoader's manual JSON parsing) in either the raw command line or a base64-decoded encoded command, while excluding legitimate ConvertFrom-Json usage.
Detects correlated activity where a browser shortcut (.lnk) file is modified/renamed and, within a 15-minute window on the same host, conhost.exe is spawned with --headless and a cmd.exe/cmd "/c start" command line, indicative of shortcut hijacking used to covertly relaunch a payload such as CountLoader.
Detects a process performing cryptocurrency wallet/messenger folder discovery (Ledger Live, Atomic, Exodus, Guarda, KeepKey, BitBox02, Signal) combined with antivirus product enumeration (via rootSecurityCenter2, AntiVirusProduct, or WMI SELECT displayName queries) within the same host/process/time window, consistent with CountLoader host-profiling behavior.
Detects the use of the netsh.exe utility with the 'wlan show profile' command and the 'key=clear' argument, which displays saved Wi-Fi network passwords in plaintext. This technique is often used by adversaries to perform credential harvesting on compromised systems.
Detects the creation of a Windows service using 'sc.exe' with names or command-line indicators associated with legitimate Windows update services, a technique commonly used by the TOKYOCORE malware for persistence.
Detects the creation or modification of WMI event subscriptions using the wmic.exe command-line utility. Adversaries utilize WMI event subscriptions for persistence by configuring event filters, consumers, and bindings that execute malicious code upon specific system events.
Detects the use of built-in Windows Living-off-the-Land binaries (LOLBins) to initiate outbound network connections to public infrastructure for file downloads. The rule correlates process execution, network connections, and subsequent file creation to identify potentially malicious ingress tool transfer. It includes risk-based scoring to prioritize events where files are dropped in user-writable paths or subsequently executed.
Page 309 of 977