Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of a process named 'Werkbit' or containing 'Werkbit' in its command line that is associated with 'com.apple.crashreporter' but is located outside the standard '/Applications/' directory on macOS. This behavior may indicate an attempt to masquerade or execute unauthorized code disguised as a crash reporting process.
Detects the use of the macOS 'codesign' utility with command-line flags that suggest an attempt to sign a binary with an empty or improperly formatted identity string. This pattern is often used to quickly sign binaries with an ad-hoc signature to bypass security restrictions or for malicious purposes.
Detects the creation of a local user account using net.exe or net1.exe followed immediately (within 10 minutes) by that same account being added to a local administrators group on the same device.
Detects the creation or execution of the SysAid.exe binary, which is a legitimate Remote Monitoring and Management (RMM) tool. Adversaries may abuse such tools to establish persistence, gain unauthorized remote access, or facilitate further malicious activities within an environment.
Detects the execution of specific suspicious filenames ('YEPlayer.exe', 'Pis2rayVPN.msi', 'YEMPlayer.msi') or command-line references to these files, combined with correlated network activity to specific suspicious domains associated with masqueraded 'microsoft.comi-site.website' URLs.
This rule detects network connections to a suspicious domain associated with the 'Maccy' application, as well as file and process activity involving files named 'Maccy' that interact with the same suspicious domain. This is indicative of potential unauthorized application execution or malicious activity masquerading as the Maccy utility.
Detects the execution of PowerShell with suspicious command-line arguments (encoded commands, hidden window styles, and suspicious cmdlets like IEX or WebClient) when launched from explorer.exe. This pattern is commonly associated with fileless malware execution or malicious script downloads.
Detects obfuscated PowerShell execution (utilizing common bypass and hiding flags) that subsequently spawns the C# compiler (csc.exe) from suspicious locations (AppData, Temp, or tmp directories). This pattern is consistent with fileless payload delivery and runtime compilation, such as that observed in recent NeptuneRAT campaigns leveraging Chrome Native Messaging.
Detects the installation or execution of compromised npm packages related to
the Axios supply chain attack, with execution or reference to the dropped
macOS RAT payload.
the Axios supply chain attack, with execution or reference to the dropped
macOS RAT payload.
Detects Microsoft Defender service (MsMpEng.exe) spawning common interactive or scripting processes (such as cmd.exe, powershell.exe, etc.) while running as SYSTEM. This behavior is highly irregular for an antivirus engine and is characteristic of exploit-based process hollowing or quarantine pipeline abuse, as observed in CVE-2026-50656.
Detects the 'ClickFix' social-engineering pattern where an adversary tricks a user into opening the Windows Run dialog (Win+R) and pasting a malicious command. This is identified by monitoring for powershell.exe spawned directly by explorer.exe that correlates in time with a new RunMRU registry entry.
This rule detects potential container escape attempts by monitoring for path traversal attacks via 'docker cp', the execution of shells within privileged or volume-mounted containers, and unexpected file operations occurring outside the container root filesystem.
This rule detects the creation of a Windows service named 'SecurityHealthIron' using the sc.exe utility or direct service creation calls. This specific naming convention is often associated with suspicious or potentially malicious activity attempting to masquerade as a legitimate Windows Security Health service.
Detects the execution of PowerShell with specific flags to bypass execution policy and hide the window, commonly used to execute encoded payloads. This rule monitors for PowerShell processes spawned by suspicious parent processes such as 'cmd.exe' or 'ElevatorShellCode.exe' that include parameters like '-ep bypass', '-w hidden', and base64-encoded strings.
Detects the use of PowerShell's .NET WebClient class to download and execute potentially malicious files. The rule monitors for common indicators of in-memory or on-disk file downloading, such as Headers.Add being used to set a User-Agent, and the DownloadData method being invoked. It specifically flags common filenames associated with stage, update, or privilege escalation payloads.
Detects the use of the schtasks utility to modify and disable scheduled tasks related to Microsoft Windows Defender, specifically the scheduled scan, cache maintenance, and verification tasks. This behavior is indicative of an attempt to impair security defenses on a Windows host.
Detects the dropping of a suspicious DLL file ('abe_decrypt.dll') in a temporary directory, followed by the termination and relaunch of a browser process (Chrome, Edge, or Brave), and the subsequent loading of the same DLL into the browser process, which is highly indicative of browser process injection and DLL hijacking activity.
Detects the use of administrative utilities (takeown, icacls, del) to modify permissions on and subsequently delete critical Windows boot files (winload.exe, winload.efi, ntoskrnl.exe, bootmgr). This activity is associated with GigaWiper and is intended to render the target operating system unbootable.
Detects the use of legitimate Windows tools, bcdedit.exe and reagentc.exe, to disable system recovery mechanisms (boot status policies and the Windows Recovery Environment). This activity is often observed during destructive wiper attacks to prevent system restoration after data destruction.
Detects a Node.js process termination followed by a quick respawn of a new Node.js process by the same parent process. This pattern suggests a watchdog persistence mechanism where the parent process monitors the child, automatically restarting it if it is terminated, consistent with behaviors observed in malware such as Void Dokkaebi.
Detects the use of 'osascript' to execute AppleScript-based dialog boxes designed to trick users into providing credentials or mimicking system administration prompts. These scripts use labels often associated with fake security or permission requests to harvest passwords.
Page 338 of 977