Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
This rule detects the installation of a specific potentially malicious NPM package ('mouse5212-super-formatter') via the npm command-line interface, followed by the execution of a node process initiated by the npm command within a 5-minute window. This behavior is indicative of a software supply chain attack where a developer or automated process is tricked into installing a backdoored dependency that subsequently executes malicious code.
Detects command-line execution (cmd, powershell, bash, curl, etc.) spawned by SmarterMail, Langflow, or Laravel (Livewire) application processes. This pattern is indicative of remote code execution exploitation, such as CVE-2025-52691 (SmarterMail), CVE-2025-34291 (Langflow), or CVE-2025-54068 (Laravel Livewire), often used to download secondary payloads or perform post-exploitation activity.
This rule detects the execution of LabubaRAT JavaScript files using the Windows Script Host (wscript.exe). It monitors for the specific combination of process execution flags that enforce JScript interpretation and filters for filenames containing 'wupd_' with a .js extension, which are indicators associated with this malware's deployment behavior.
This rule detects process execution attempts where specific arguments (such as '--b' or '-b') are used alongside strings associated with malicious C2 configuration, such as command-line flags for server, key, group, organization identifiers, or external domain references. This behavior is indicative of command-line obfuscation and the smuggling of C2 configuration data within process launch arguments, a technique often used to evade signature-based security controls.
Detects the execution of Java processes with a -jar argument where the JAR file is located in a non-standard, user-writable directory (e.g., Temp, Downloads) and the process is initiated by an unexpected parent application (e.g., shell, explorer). This pattern is indicative of the execution of QuimaRAT or similar Java-based malware.
Detects the execution of a file named 'intro.js' by the Node.js runtime located within a 'node_modules' directory. This pattern is often associated with the execution of suspicious scripts, persistent backdoors, or malicious packages that attempt to masquerade as standard dependencies.
This rule monitors for direct execution of Node.js binaries (node.exe or node) where the target script or binary is located within a 'node_modules' directory. By excluding standard file extensions (.js, .mjs, .cjs, .json) and common npm installation command lines, the rule aims to identify potentially malicious or non-standard binaries being executed in a context often used by adversaries for persistence or lateral movement within software dependency environments.
This rule detects PowerShell commands that exhibit characteristic patterns of downloading and executing remote scripts in memory. It specifically looks for the combination of 'Invoke-Expression' (IEX) with web-fetching cmdlets like 'Invoke-RestMethod' or 'irm', combined with specific argument indicators like 'checkservice.php', 'idx=5', or 'logaction' which are often associated with stage-delivery or dropper scripts.
Detects the execution of the roadtx command-line utility, which is a component of the ROADtools framework used for OAuth device code flow interaction and token acquisition within Entra ID (formerly Azure AD) environments.
Detects attempts to disable critical Windows security and maintenance services including Windows Defender Real-Time Protection, Windows Firewall, Windows Update, and Windows Error Reporting. This is achieved by monitoring command-line executions involving PowerShell Set-MpPreference, registry modifications to security keys, and service control commands for hardening or disabling these components.
Detects process, named pipe, or mutex events that contain the specific string 'BEAST HERE?', which is often associated with the presence of malicious tools or backdoors using this hardcoded string for identification or synchronization.
Detects the use of system utilities (net.exe, net1.exe, taskkill.exe, sc.exe) to stop five or more services identified as security, backup, or database software. This behavior is indicative of an adversary attempting to disable security monitoring and backup recovery tools, a common precursor to ransomware encryption.
Detects unauthorized attempts to modify or interact with the macOS Transparency, Consent, and Control (TCC) database. This includes direct file system modifications by non-system processes, sqlite-based manipulation of the TCC database, or the usage of 'tccutil' to reset permissions. These behaviors are often indicative of malware attempting to silently elevate privileges or grant itself Full Disk Access to sensitive user data.
Detects the creation or starting of an AnyDesk service using command-line arguments to specify custom configuration directories or service names. This pattern is often used by adversaries to establish persistence or ensure remote access tools are configured with specific, potentially silent or pre-defined, settings.
Detects the execution of PowerShell via stdin piping, which is a common technique used by attackers to execute scripts without specifying common command-line arguments like -Command or -File, potentially bypassing simple command-line monitoring or logging.
Detects the creation of a scheduled task using 'schtasks.exe' where the command line includes a specific security descriptor string '(A;;GA;;;WD)' indicating full access (GA) is granted to everyone (WD). This is a known technique used to ensure the created task has broad permissions for persistence or privilege escalation, often associated with bypassing security controls.
This rule identifies processes that initiate network connections with a significant time delay (greater than 300 seconds) after the process was initially created. This pattern of delayed connection can be indicative of C2 beaconing behavior, where malware sleeps for a period of time before attempting to check in with a command-and-control server.
Detects the execution of an executable named 'nvidia-sysruntime.exe', which is used by the LabubaRAT malware family to masquerade as a legitimate NVIDIA component to maintain persistence and evade detection.
Detects execution of nvidia-sysruntime.exe, which is known to be a malicious file masquerading as a legitimate NVIDIA component, often associated with the LabubaRAT malware.
Detects the LabubaRAT implant (masquerading as nvidia-sysruntime.exe) performing file system checks against Chrome, Firefox, Microsoft Edge, and Brave installation paths as part of its enumerate_browsers() host profiling routine.
Detects the execution of Microsoft Edge WebView2 (msedgewebview2.exe) as a child process of the NVIDIA system runtime (nvidia-sysruntime.exe). This pattern is associated with LabubaRAT, where the legitimate NVIDIA process is abused to launch WebView2 for command-and-control (C2) communication and data exfiltration.
Page 336 of 977