Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects instances where Google Chrome or Microsoft Edge are launched with command-line arguments typical of headless operation or remote debugging (e.g., --headless=new, --remote-debugging-port, --user-data-dir). It specifically flags these executions when they are not initiated by known browser-related processes or the system shell (explorer.exe), which may indicate an attacker using the browser as a proxy or for automated data exfiltration.
Detects process creation for common RMM tools (AnyDesk, Bomgar/BeyondTrust, TeamViewer).
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
The idea here would be to alert on non approved RMM tools, and anything outside of the one or few approved tools would be suspicious.
Detects credential dumping of the TermService svchost process that can retain plaintext
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
RDP logon credentials in memory, bypassing LSASS-focused defensive tooling. Attackers
locate the hosting process with tasklist /M:rdpcorets.dll, Get-NetTCPConnection on port
3389, or netstat against TermService, then dump memory via comsvcs.dll MiniDump or
Sysinternals procdump. Correlate recon selections with a subsequent dump in the same
session when possible.
Detects the use of mshta.exe to fetch and execute remote content that subsequently spawns PowerShell, often utilizing techniques to obfuscate commands or load scripts in-memory. This behavior is indicative of fileless malware execution or stage-two payload delivery.
Detects PowerShell command line activity involving the use of Net.WebClient for network downloads in conjunction with IO.Compression.ZipArchive for file extraction, specifically targeting paths associated with the LogiOptionsPlus software. This pattern suggests potential staging of malicious payloads, such as an embedded Python loader or binary disguised within a legitimate directory.
Detects instances where the Windows Installer process (msiexec.exe) performs registry modifications (Value Set or Key Creation) within the 'Software\Microsoft\Windows\CurrentVersion\Installer\TempPackages' hive by a non-system user. This activity is indicative of potential malicious installer manipulation or persistence mechanisms involving MSI installers.
Detects the Windows Installer (msiexec.exe) launching a command script named poc.cmd, executing with SYSTEM privileges. This pattern is commonly used to proxy execution of malicious scripts or payloads.
Detects the use of common Windows Living-off-the-Land Binaries (LOLBins) or PowerShell cmdlets typically utilized to download and execute remote payloads. The rule specifically monitors for BITSAdmin transfers, CertUtil URL cache retrievals, MSHTA remote execution, and PowerShell combined with WebClient/DownloadString and hidden windows.
This rule detects the use of XOR encoding patterns in PowerShell command-line arguments. Adversaries frequently use XOR encoding or other obfuscation techniques within scripts to hide malicious commands or payloads from static analysis and security tools.
Detects the Miasma loader, associated with supply chain attacks on NPM packages (e.g., ShinyHunters campaign), spawning a hidden, detached Node.js child process during module import. The detection monitors for a Node.js process spawning a child node.exe with the '-e' flag and a specific obfuscated variable prefix used by the malware to execute malicious code while bypassing --ignore-scripts.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects web server processes (Apache, Nginx, PHP-FPM) spawning a system shell to execute compound commands containing discovery utilities (like id, whoami, hostname, uname, or find) within a 'wp-content/plugins' directory. This behavior is indicative of post-exploitation activity following a remote code execution vulnerability, such as those associated with the wp2shell attack pattern.
Detects the execution of sequences of built-in administrative command-line tools often used by adversaries for system discovery and reconnaissance. The rule triggers on specific patterns of commands (e.g., WMI queries, system information gathering, or comprehensive user enumeration) that are frequently combined by attackers to understand the target environment.
Detects the wp2shell post-exploitation cleanup pattern where a shell spawned by a web server process determines its current working directory, matches it against a wp-content/plugins path using the specific `case "$d" in */wp-content/plugins/*) cd / && rm -rf "$d";; esac` one-liner shape, and recursively deletes that directory to remove the deployed web shell plugin. This is tightened to require the exact case-statement/one-liner construction executed by a shell that is a child of a web server process, rather than any generic recursive delete under wp-content/plugins, which would also fire on legitimate WordPress plugin uninstall hooks that remove their own plugin directory. Absence of the plugin directory afterward should not be treated as evidence the host is clean.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects instances where the Windows Explorer process (explorer.exe) spawns common script interpreters or command-line tools such as PowerShell, cmd.exe, mshta.exe, wscript.exe, or cscript.exe. This behavior is atypical for normal user activity and is frequently associated with malicious activity, including post-exploitation, code execution, or defense evasion.
Detects cloning and building xmrig-proxy from source (git clone + cmake/make), used by JadeProx operators to relay cryptomining traffic from compromised hosts behind a single mining pool connection. Build commands must specifically reference the xmrig-proxy repository or directory to reduce false positives from generic development builds.
Detects Python process creation where the command line references base64, zlib, and ctypes libraries concurrently. This combination is frequently used by attackers to deobfuscate, decompress, and execute payloads dynamically in memory, often bypassing traditional file-based detection mechanisms.
Detects a single process invocation querying WMI hardware/OS classes together with AntiVirusProduct/SecurityCenter2 enumeration, consistent with a reconnaissance module performing hardware/OS fingerprinting and AV product enumeration.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
Detects suspicious activities associated with browser profile hijacking. It flags the use of Robocopy to mirror browser user data directories (potentially to steal session cookies) and the subsequent launch of a web browser (Chrome/Edge) with security-disabling flags such as --no-sandbox and --disable-features=RendererCodeIntegrity, which are commonly used to bypass security features and access protected browser data.
Page 316 of 977