Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects execution, chmod, or invocation of the fuckaliyun.sh script used to disable Alibaba Cloud's Cloud Shield/Yundun host security monitoring agent, plus the associated iptables install added by JadeProx's modified variant of the script. Requires an actual execution context (direct invocation, chmod +x, or a bash/sh interpreter with the script as an argument or parent process) rather than any incidental string reference to 'fuckaliyun'.
Detects execution of the fscan internal network reconnaissance scanner renamed as sys.log or mail.log, or process command lines invoking the actual fscan CLI binary with its characteristic flags, as used by JadeProx operators for post-compromise internal network scanning.
Detects execution of the fscan internal network reconnaissance scanner renamed as sys.log or mail.log, or process command lines invoking the actual fscan CLI binary with its characteristic flags, as used by JadeProx operators for post-compromise internal network scanning.
Detects download or reference to the chrome-injector Chrome App-Bound Encryption decryption tool (github.com/xaitax/Chrome-App-Bound-Encryption-Decryption), attempted by JadeProx operators for post-exploitation browser credential theft.
This rule detects a suspicious pattern on Linux systems where a process creates a file in the /tmp directory with a name consisting of a long hexadecimal string (indicative of a hash, often used by Rust-based loaders for Sliver or similar implants), followed immediately by the execution of that same file by the initiating process.
Detects suspicious execution patterns associated with the SleeperGem supply chain attack, where a compromised Gem install script (git_credential_manager-2.8.3/bin/install) spawns shell or PowerShell commands to trigger secondary malicious scripts like deploy.sh or redirects output to /dev/null.
Detects command-line execution or application configuration referencing the disabling of TLS certificate verification, specifically using 'OpenSSL::SSL::VERIFY_NONE' or 'http.verify_mode'. This pattern is often indicative of malicious activity attempting to bypass secure communication validation, such as in supply chain attacks involving compromised dependencies or backdoors.
Detects execution of the LegacyHive proof-of-concept (PoC) binary or its unique command-line indicators. LegacyHive exploits a Windows User Profile Service vulnerability to perform arbitrary registry hive loading, which can be utilized for privilege escalation.
Detects the TOKYOCORE RAT executing arbitrary commands via cmd.exe, identified by specific command-line indicators including the 'addtime' command and the 'Executing command:' string.
Detects remote scheduled task creation, execution, or deletion via schtasks.exe with a suspicious task action.
Detects the BlueNoroff VBScript implant's C2-tasked execution engine — dual wscript.exe invocations with campaign-specific numeric arguments, or a curl-fetched secondary payload chained into cmd/WScript.Shell execution — excluding legitimate installer deployment tooling.
Detects an obfuscated, hidden-window PowerShell loader chaining campaign-specific SET environment-variable assignments to stage a payload path and download a next-stage payload from cdn.zoom-videos infrastructure, consistent with BlueNoroff's ClickFix PowerShell staging technique.
Detects the invocation of cmd.exe using the specific non-standard flag combination '/e:ON /v:OFF /d /c'. This command pattern is associated with the msaRAT implant, which leverages these flags to execute commands received via browser-mediated C2 channels (WebRTC/CDP).
This rule detects execution of msiexec.exe involving specific internal method calls ('CElevate', 'CleanupTempPackages', 'FDeleteFolder'). These calls are associated with abusing the Windows Installer elevation mechanism to perform folder deletion with SYSTEM-level privileges.
Detects the use of the Windows 'reg.exe load' command to mount registry hive files from file paths other than the standard user-specific hive locations (ntuser.dat or usrclass.dat). This behavior is often associated with privilege escalation or post-exploitation techniques where attackers attempt to load sensitive system hives, such as SAM or SECURITY, into the registry for offline analysis or credential dumping.
Detects execution of Lua/LuaJIT binaries, specifically luau.exe or lua(jit).exe, with command-line arguments referencing ico64.txt, or execution via application.cmd. This behavior is often associated with malware loaders attempting to execute secondary scripts or payloads.
Detects PHP process execution invoking fsockopen() to establish an outbound reverse shell connection, consistent with SpyPress backdoor persistence mechanisms deployed by TA458 on compromised Roundcube webmail servers.
Detects HPC GPU and SLURM reconnaissance (nvidia-smi/squeue) run together or spawned from a Python parent process, consistent with the mrmustard stealer's environment-profiling behavior.
Detects the creation and immediate execution of an unsigned binary on a system within two minutes of that system establishing an outbound network connection to port 32768, which is the command and control (C2) port associated with the Dolphin X stealer. This rule aims to identify the behavior of a secondary payload being fetched and launched by the initial loader.
Detects attempts to modify Windows Defender settings, specifically disabling real-time monitoring or adding exclusions, using PowerShell commands. The rule filters for suspicious execution patterns, such as hidden windows or invocation from scripting hosts (wscript, cscript, mshta, cmd), while excluding common management tool paths to minimize noise.
Page 312 of 977