Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects process execution where the process path or the initiating process path resides within the '/private/tmp/.CrashReporter' directory. This directory is often used by adversaries to hide malicious binaries or scripts in a location that might appear legitimate but is generally inappropriate for persistence or staging.
Detects the use of the security command-line tool with the 'unlock-keychain' argument and the '-p' flag, which indicates an attempt to programmatically unlock a keychain, potentially using a supplied password.
Detects the execution of the legitimate AnyDesk remote access tool when it is launched from a non-standard file path containing '\music\', which may indicate an attempt to hide the executable in a less suspicious directory.
This rule detects the silent installation of AnyDesk with persistence enabled via the '--start-with-win' flag. This behavior is indicative of unauthorized remote access tool deployment, often used for establishing persistent command and control.
Detects the execution of msiexec.exe with silent (/Q) and system component (ARPSYSTEMCOMPONENT=1) flags, initiated by explorer.exe. These flags are often used to install MSI packages invisibly, potentially by malicious actors to perform background installations without user interaction.
Detection logic covering multiple stages of the Gentlemen ransomware attack lifecycle, including reconnaissance, defense impairment (disabling Defender/EDR), persistence, lateral movement using GPO and PsExec, and anti-forensic activities such as shadow copy deletion and log clearing.
This rule detects the use of database-related processes (mysql) or scripts (python) interacting with MySQL User-Defined Function (UDF) mechanisms. Attackers often abuse UDFs to execute arbitrary commands, load external libraries, or facilitate lateral movement/privilege escalation within a database environment.
Detects a Node.js process spawning a detached child process that executes a script named 'caller.js'. This behavior is consistent with the 'nodemon-sudo' or 'tslint-conf' supply chain attacks, which leverage detached child processes to execute malicious second-stage payloads while suppressing console output, effectively creating a persistent, hidden backdoor.
Detects the execution of PowerShell with a combination of flags commonly used to bypass security policies, obscure command execution, and run hidden tasks: -NoProfile, -ExecutionPolicy Bypass, and -EncodedCommand.
Detects the execution of PowerShell with a combination of flags commonly used by attackers to hide activity, bypass execution policies, and execute encoded or scripted commands. This pattern often indicates attempts to run malicious scripts stealthily on a Windows host.
Detects the creation of a Windows service associated with the AnyDesk remote access application using the sc.exe utility. This behavior often indicates the unauthorized installation or persistence setup of a remote access tool.
Detects the execution of processes associated with voice manipulation, voice changing, or 'deepfake' software. These tools may be used by adversaries to facilitate social engineering, impersonation, or to bypass voice-based authentication mechanisms.
This rule detects potential Active Directory Certificate Services (ADCS) ESC17 abuse by monitoring for certificate requests that contain a Subject Alternative Name (SAN) or Common Name (CN) matching trusted external domains such as 'login.microsoftonline.com'. It also monitors for Certipy command-line activity targeting insecure web server templates or attempting ESC17-specific maneuvers, which indicates an attempt to forge certificates for domain impersonation or unauthorized authentication.
Detects instances of Node.js processes executing command-line instructions related to publishing packages (npm, twine, or cargo). This behavior is characteristic of Miasma malware's 'trySpread' routine, which attempts to propagate the malware by leveraging compromised package repository tokens.
Detects the execution of Node.js processes launched by VS Code (via task runner) that reference known Miasma malware persistence paths (e.g., sync.js in hidden NodeJS directories across Windows, Linux, or macOS).
Detects the execution of psexesvc.exe, the service component of the PsExec tool, spawned from services.exe. This activity is indicative of lateral movement through the use of PsExec, which installs and executes the service to run commands remotely.
Detects the execution of PowerShell via stdin piping, which is a common technique used by attackers to execute scripts without specifying common command-line arguments like -Command or -File, potentially bypassing simple command-line monitoring or logging.
Detects a specific anti-debugging technique used by LIUSHEN ransomware, where the malware executes a 1,000,000-iteration loop and measures the duration. If the loop takes longer than 0.5 seconds, it infers the presence of a debugger or analysis environment due to the induced latency.
This rule detects processes being executed that contain 'nacos' and 'token.secret.key' within their command-line arguments. This pattern is indicative of potential attempts to leverage or identify the default JWT secret key for an Apache Nacos deployment, which could allow an attacker to forge authentication tokens and gain unauthorized access.
Detects reconnaissance activities targeting Azure Container Registry, specifically the listing of available repositories using the Azure CLI and pulling container images, which may indicate an adversary attempting to discover or exfiltrate software components.
Detects execution of common shell interpreters initiated by or containing references to ff-agent.
Page 335 of 977