Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of the Stoplight Spectral CLI tool from within the temporary npm/npx cache directory structure on Windows endpoints. This behavior is associated with supply-chain attacks, where malicious packages exploit npx cache paths to execute unauthorized code. The rule accounts for both fixed cache identifiers observed in specific campaigns and generalized paths used by npx, while excluding benign Playwright test executions.
Detects the mrmustard supply-chain implant establishing persistence by writing a crontab entry that invokes the compiled stealer 'hw_probe.pyc' every 15 minutes, or direct crontab command invocation referencing the file.
Detects SLURM job-queue enumeration (squeue/sinfo/scontrol) spawned specifically from a Python parent process, narrowing generic HPC admin commands to the mrmustard stealer's recon pattern.
Detects scheduled task creation used for persistence by the TTF Trap phishing campaign. The obfuscated JScript dropper checks for the absence of next-stage files and a marker variable (e.g. 'YESSSSSSSS') before copying itself to %PUBLIC%\Libraries and spawning cmd.exe to run schtasks with a recurring minute-based interval referencing the dropped loader files in that folder. Broadened beyond the exact 'schtasks /create /sc minute /mo 15' pattern to also catch scheduled task creation referencing %PUBLIC%\Libraries with other minute intervals, and direct wscript.exe/cscript.exe execution of files staged under %PUBLIC%\Libraries as part of the marker-gated persistence check.
This rule detects command-line execution patterns associated with msaRAT, specifically targeting cmd.exe launches that utilize the combination of /e:ON, /v:OFF, /d, and /c flags. These flags are used by the RAT to execute commands while suppressing specific command shell configurations and command history, often as part of a covert C2 mechanism.
Detects Windows Installer executing an MSI package from ProgramData, matching the msaRAT delivery chain in which update_ms.msi is downloaded to that directory and then executed.
Detects creation of a new local user account and its addition to the local Administrators group, consistent with the plugin32.dll RDP backdoor module which hardcodes a username/password and adds the new account to the administrators group for persistent RDP access.
Detects the execution of mshta.exe launched by powershell.exe where the command line includes a remote URL. This pattern mimics the 'ClickFix' execution chain where explorer.exe initiates PowerShell, which in turn invokes mshta.exe to fetch and execute a remote payload, a common technique for initial access and execution.
Detects the execution of PowerShell via mshta.exe or wscript.exe, specifically when the command line includes encoded commands. This is a common pattern for attackers using living-off-the-land binaries to execute obfuscated malicious payloads, bypassing basic security controls.
Detects process creation events where a process reported as TiWorker.exe (a trusted Windows servicing process) carries a command line containing Invoke-Mimikatz or Mimikatz command modules, indicating the process identity has been spoofed via a Silo-Binding bind-link mapping TiWorker.exe to PowerShell to evade AV/EDR script-blocking controls.
Detects cmd.exe invoked with '/c move' relocating a downloaded payload into a timestamp-named appdata folder, consistent with a Lampion scheduled-task move stage.
This rule detects the execution of Google Chrome or Microsoft Edge browsers in headless mode with remote debugging enabled. This configuration is often abused by attackers to interact with web sessions, bypass authentication mechanisms, or facilitate automated malicious activities by controlling the browser via the DevTools protocol.
Detects the execution of anydesk.exe from user-writable directories such as AppData, Temp, Downloads, or Music. This behavior is indicative of potential unauthorized use of remote access software, which may be deployed by an adversary for persistence or establishing a command and control channel outside of standard administrative tools.
Detects the creation of scheduled tasks using specific, suspicious task names associated with the CURP threat campaign. This rule monitors for 'schtasks.exe' command line executions involving the creation of tasks with names 'brokerhost' or 'net_queue_32', which are identified as indicators of persistent threat activity.
Detects process creation consistent with CVE-2025-33053 exploitation, where a crafted Internet Shortcut (.url) file sets its target to iediagcmd.exe with a WorkingDirectory pointing to a WebDAV DavWWWRoot UNC path, causing iediagcmd.exe to resolve and launch LOLBins (route.exe, ipconfig.exe, netsh.exe, ping.exe) from the attacker-controlled WebDAV share instead of the legitimate System32 directory.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects the creation of inbound firewall rules using the New-NetFirewallRule PowerShell cmdlet where the DisplayName parameter is set to 'Microsoft.Windows.CloudExperienceHost'. This behavior is indicative of the GigaWiper malware attempting to masquerade as a legitimate Windows component to facilitate network persistence or remote access capabilities.
Detects potential persistence mechanisms that mimic or leverage the Microsoft OneDrive update process. This includes the creation or modification of scheduled tasks containing 'OneDrive Update' in the command line using tools like schtasks or PowerShell, as well as modifications to the HKCU OneDrive environment registry key, a behavior associated with the GigaWiper malware.
Detects instances where the command shell 'cmd.exe' is launched as a child process of 'nvidia-sysruntime.exe'. This behavior is anomalous as 'nvidia-sysruntime.exe' typically does not spawn command interpreters, suggesting potential masquerading or process hollowing where an attacker is using a disguised malicious binary to execute shell commands.
Hunting rule for Atomic Red Team T1112 test "Disable Windows Registry Tool" (Modify Registry). Correlate with additional signals before alerting.
Detects modification of targeted registry keys commonly used for persistence
and defense evasion via startup execution.
and defense evasion via startup execution.
Page 319 of 977