Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of binaries (exe, dll, msi) or scripts via rundll32/msiexec from the user's Local AppData Temp directory. This behavior is commonly associated with staging and executing secondary payloads by malware such as the Starland RAT, which frequently drops and runs its payloads from these locations to evade detection.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects a WordPress-context web server process spawning a non-shell interpreter or downloader (curl|bash, python -c, wget/curl via sh -c) to retrieve second-stage tooling post-exploitation.
Detects discovery and SUID/SGID enumeration commands (whoami, hostname, id, uname, cat /etc/passwd, find -perm) executed by a shell spawned from a WordPress plugins directory by a web server process.
Detects the creation or modification of a Windows service named 'ThumbcacheService', which has been associated with the GoSerpent campaign for file collection. The rule monitors both registry modifications indicative of service installation and process execution patterns using sc.exe, reg.exe, powershell.exe, or cmd.exe that reference this specific service name.
Detects the use of built-in Windows utilities, specifically 'wmic.exe' and 'vssadmin.exe', to delete volume shadow copies. This is a common technique used by ransomware and other malware to prevent system recovery and impede incident response efforts.
Detects use of 'az acr show' or 'az acr repository list' commands to enumerate Azure Container Registry security settings such as adminUserEnabled, anonymousPullEnabled, or networkRuleBypassOptions, indicating reconnaissance for misconfigurations.
Detects the LuaJIT interpreter (luajit.exe) or the AutoIt3 interpreter (AutoIt3.exe) being used to execute a file with a .ttf, .au3, or .a3x extension from %PUBLIC%\Libraries as a script argument. This technique is used in the TTF Trap campaign where a malicious Lua loader is disguised as a TrueType Font file and passed as a parameter to the dropped LuaJIT 2.1.0-beta3 interpreter, or alternatively executed via AutoIt3 as an equivalent execution vehicle, to evade detection.
Detects the execution of MokManager UEFI binaries or administrative activity via the mokutil utility targeting the MokListX denylist. This activity is indicative of Secure Boot configuration changes, such as enrolling unauthorized certificates or bypassing MOK (Machine Owner Key) denylist enforcement, which can facilitate the persistence or execution of malicious boot-level code.
Detects the execution of the SharpShares tool, which is commonly used by adversaries to enumerate network shares across a domain or local network for reconnaissance purposes.
Detects execution of TuxBot v3 multi-architecture ELF binaries, characterized by architecture-specific suffixes (e.g., tuxbot.x86_64) or the presence of the 'Infected By Akiru' banner in command-line arguments. These indicators serve as proxies for identifying this specific LLM-generated bot agent on disk or during runtime execution.
Detects the execution of 'sudo' or 'systemd-run' with specific flags often associated with automated credential processing or service creation for privilege escalation. The rule monitors for sudo commands using '-S' (read from stdin) and '-p' (custom prompt) flags, which are common in non-interactive scripts attempting to bypass or manipulate password prompts, and systemd-run commands using '--system' and '--no-ask-password', which can be used to run commands as root without interactive authentication.
Detects the use of PowerShell cmdlets 'Get-CimInstance' and 'Stop-Process' to identify and terminate chrome.exe processes. This behavior may be used by adversaries to stop browsers or security software components that could interfere with malicious activities.
Detects Python processes attempting to execute shellcode in-memory by invoking Windows Fiber APIs (CreateFiber, ConvertThreadToFiber, SwitchToFiber) in conjunction with memory allocation via VirtualAlloc. This pattern is commonly used in fileless execution techniques where shellcode is manually managed within the process address space, bypassing standard process creation mechanisms.
Detects the use of mshta.exe to execute code directly from a remote URL that includes a numeric path segment. This behavior is often associated with the retrieval of HTA, VBScript, or JScript payloads from attacker-controlled servers, where the numeric path may indicate a versioned payload or a specific exploit delivery mechanism.
Detects the use of PowerShell to modify file timestamps by using the timestamps of the legitimate notepad.exe as a reference point. This technique is often used to make malicious files blend in with system files by adopting their creation, access, or write times.
Detects the execution of rundll32.exe attempting to load a DLL from a remote WebDAV share by monitoring for the '@ssl' notation in the command line. This technique is often used to execute malicious code or load DLLs from attacker-controlled remote infrastructure, bypassing local security controls.
Detects the use of the 'pushd' command in combination with a WebDAV share path utilizing the '@SSL' notation. This technique can be used by attackers to force the connection to a remote WebDAV share, potentially triggering NTLM credential relay or accessing malicious remote resources. The inclusion of 'rundll32' in the condition suggests monitoring for process proxying or exploitation chains often associated with such connections.
This rule monitors for suspicious Git command-line activity that may indicate an attempt to rewrite commit history or force push changes while bypassing verification checks. It detects specific patterns including the execution of 'temp_auto_push.bat', force amending of commits with '--no-verify', and forced pushing with '--no-verify'. These actions are commonly associated with code tampering or the rapid deployment of unauthorized changes to a repository.
Detects Blind Eagle JC-46 AsyncRAT process-injection/hollowing pivot: wscript.exe,
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
cscript.exe, or powershell.exe spawning rarely abused signed Microsoft binaries
(RegSvcs.exe, MSBuild.exe, jsc.exe, AppLaunch.exe) as injection targets, RegSvcs.exe
hollowing preceded by PowerShell compiling inline C# via Add-Type, and parent-process-ID
spoofing where these binaries appear to be spawned directly by explorer.exe.
Detects the use of shell interpreters (sh, bash, zsh) to download content from GitHub using curl (specifically using the -s silent flag) and subsequent base64 decoding of potentially obfuscated payloads using the base64 command with the -D flag.
Page 328 of 977