Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects a single process invocation querying WMI hardware/OS classes together with AntiVirusProduct/SecurityCenter2 enumeration, consistent with a reconnaissance module performing hardware/OS fingerprinting and AV product enumeration.
Detects the execution of mshta.exe launched by powershell.exe where the command line includes a remote URL. This pattern mimics the 'ClickFix' execution chain where explorer.exe initiates PowerShell, which in turn invokes mshta.exe to fetch and execute a remote payload, a common technique for initial access and execution.
Detects regsvr32 loading chromelevator.ocx/mscom.ocx followed by the ChromEggscalator credential-extraction command sequence.
Detects an interactive cmd.exe shell launched in quiet mode with redirected I/O by a regsvr32-loaded TAG-195 implant, matching shell_start C2 tasking.
Detects a registry hijack of the 'ms-settings\Shell\Open\command' key, followed by the execution of auto-elevated binaries 'fodhelper.exe' or 'computerdefaults.exe'. The rule identifies potential UAC bypass attempts by correlating these registry modifications with the subsequent spawning of an unsigned or unrecognized child process by the auto-elevated binary.
Detects instances of explorer.exe spawning command shells (cmd.exe or powershell.exe) with arguments. This behavior is indicative of a user launching commands directly via the Windows Run dialog or executing scripts from the shell, which can be a vector for malicious activity.
Detects instances where 7-Zip utility processes (7z.exe, 7zFM.exe, 7zG.exe) or DLLs act as the parent for suspicious child processes such as command interpreters (cmd.exe, powershell.exe) or other binaries running from temporary or download directories. This pattern is commonly associated with the execution of malicious payloads extracted or staged via 7-Zip archives.
Detects lateral movement patterns involving PsExec or PSEXESVC where either a suspicious command-line flag (e.g., '-psex') is present or the PsExec service spawns child processes like cmd.exe or powershell.exe executing suspicious, obfuscated, or remotely retrieved payloads.
Detects host reconnaissance commands (e.g., pip freeze, id, hostname -I) spawned by processes whose command line references the malicious 'mrmustard' Python package. This links discovery activity directly to the context of the supply chain compromise.
Detects installation or import of the trojanized mrmustard 0.7.4 PyPI package via pip or a direct python import, the initial-access vector for this supply-chain compromise.
Detects the use of curl.exe to download a specific file named 'update_ms.msi' from a known malicious IP address. This behavior is indicative of a stager for msaRAT being downloaded onto a Windows host, potentially disguised to mimic a legitimate Windows update file.
The implant handing off attacker command frames to cmd.exe with its distinctive flag set (/e:ON /v:OFF /d /c), launched as a child of a headless Chrome or Edge instance acting as the covert C2 driver.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
The implant handing off attacker command frames to cmd.exe with its distinctive flag set (/e:ON /v:OFF /d /c), launched as a child of a headless Chrome or Edge instance acting as the covert C2 driver.
Detects curl.exe retrieving an .msi file from a URL that specifies a raw IP address (rather than a domain) and writing/staging it under ProgramData. This behavioral pattern was observed in Chaos ransomware group initial-access activity staging a fake Windows-update MSI from IP 172.86.126.18; that IP is a high-confidence indicator but the detection logic is structured around the broader raw-IP + .msi + ProgramData pattern since staging infrastructure rotates across campaigns.
A non-browser parent process (installer, service, msiexec.exe/rundll32.exe/services.exe, or lib.dll-style loader) spawning Chrome or Edge headlessly with CDP remote-debugging flags enabled. Requires an anomalous parent to reduce false positives from legitimate browser automation frameworks that also use --headless and --remote-debugging-port.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects the full TTF Trap JScript dropper chain executed by wscript.exe or cscript.exe. The obfuscated JScript dropper uses ActiveXObject instances (Scripting.FileSystemObject, ADODB.Stream, Microsoft.XMLDOM) combined with heavy string split/join obfuscation to decode and write both a Lua script disguised with a .ttf extension and a LuaJIT or AutoIt interpreter executable into C:\Users\Public\Libraries\. The dropper then invokes WScript.Shell to launch the dropped interpreter executable, passing the .ttf-disguised Lua script as a command-line argument to execute the next stage.
Detects instances of dllhost.exe running with elevated integrity (High or System) that were not spawned by the standard DCOM Server Process Launcher (svchost.exe). This behavior is characteristic of COM object hijacking or auto-elevation techniques used to bypass UAC.
Detects the use of command-line tools employing recursive search patterns (e.g., -Recurse) targeting document file extensions (PDF, DOCX, XLSX). This activity is often associated with the staging phase of an exfiltration attempt, where an adversary identifies sensitive files across a directory structure before collection.
Detects the execution of rundll32.exe attempting to load a DLL from a remote WebDAV share by monitoring for the '@ssl' notation in the command line. This technique is often used to execute malicious code or load DLLs from attacker-controlled remote infrastructure, bypassing local security controls.
Page 315 of 977