Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects the execution of application bundles that mimic legitimate macOS system applications (Finder or Software Update) but originate from non-standard system paths. This behavior is indicative of masquerading techniques used by malware, such as the PamStealer, to execute hidden or unauthorized processes while appearing legitimate.
Detects pythonw.exe or python.exe process execution running under the WDAGUtilityAccount user context, which Starland RAT checks against its hardcoded sandbox-account blacklist before continuing execution. Observing this account name paired with the Python runtime used by the RAT's loader chain is a strong indicator of the malware executing (or attempting to execute) inside a sandboxed analysis environment.
Detects instances where Chrome or Microsoft Edge are launched in headless mode with remote debugging enabled. This configuration exposes the browser's debugging interface, typically on port 9222, which can be leveraged by attackers for browser exploitation, data exfiltration, or persistence within the browser context.
Detects Python processes (python.exe or pythonw.exe) executed with a custom '--elevated' argument, which is indicative of Starland RAT attempting to perform UAC bypass or elevation.
Detects PowerShell execution initiating WMI queries to gather information about antivirus products, network adapter configurations, or User Account Control (UAC) policy settings. This behavior is indicative of system and defensive environment reconnaissance.
Detects suspicious PowerShell execution patterns involving dynamic command reconstruction using [char[]] character arrays and the iex (Invoke-Expression) cmdlet, or the use of specific base64 EncodedCommand prefixes associated with known obfuscation tools like Banana RAT.
Detects the execution of csc.exe (the C# command-line compiler) with specific command-line arguments (/noconfig, /fullpaths) and a response file (.cmdline) located within a temporary directory. This pattern is commonly associated with fileless malware, such as Banana RAT, which compiles its components at runtime to bypass static file-based detection.
Detects the creation of a Windows scheduled task named 'WindowsHelper' that is configured to execute a 'run.vbs' script via wscript.exe every five minutes. This behavior is associated with the persistence mechanism used by the Armored Likho BusySnake Stealer malware.
Detects the use of PowerShell to modify Microsoft Defender preferences by adding a folder exclusion path. Adversaries often use this technique to prevent security software from scanning specific directories where malicious tools or payloads are stored.
This rule detects potentially malicious database manipulation by monitoring process execution command lines for commands that drop critical databases or toggle foreign key checks. It flags instances where multiple drop database commands occur or foreign key constraint toggling is detected, which is often indicative of automated data destruction or ransomware activity within database environments.
This rule monitors process command lines and file operations for specific strings associated with ransomware, including known ransom note naming conventions ('readme_ransom'), a specific Bitcoin wallet address, a contact email, and SQL commands commonly used to drop database tables for ransom purposes.
Detects execution of gsocket-related tools (gs-netcat, gsocket, gs-sftp) or command-line patterns typically used for remote shell access or socket redirection, such as using -e with a shell, -l/-p for listening, or redirecting I/O from common temporary directories.
Detects module loads of suspected malicious DLLs (associated with HijackLoader/CastleLoader or ClickFix campaigns) by signed host processes from non-standard user-writable directories like ProgramData. It also monitors for the execution of known sideloading host binaries (e.g., ssh-add.exe) from suspicious staging directories.
This rule detects the execution of known NirSoft credential recovery utilities, such as WebBrowserPassView, ChromePass, and others, when they are located within a specific 'music/mimik/' directory structure, which is indicative of credential harvesting activities staged by an adversary.
Detects the execution of NetScan.exe, a common network scanning tool often used by adversaries to perform internal network reconnaissance and identify active hosts and services within a compromised environment.
Detects the execution of PowerShell commands using the 'Set-MpPreference' cmdlet with the '-DisableRealtimeMonitoring' parameter set to '$true', which disables real-time protection in Windows Defender.
Detects anomalous process execution chains where Fortinet FortiClient scheduler processes (scheduler.exe or FortiTray.exe) spawn cmd.exe to execute command scripts, or subsequently spawn PowerShell with obfuscated command line arguments (-enc, -EncodedCommand) and hidden window flags (-w 1), as identified in the FortiBleed campaign.
Detects the presence of the 'IsDebuggerPresent' string within command lines. This is a common Windows API call used by malware and potentially malicious scripts to detect if they are running under a debugger, allowing them to alter their behavior to avoid analysis.
Detects the sequence of API calls and process state changes indicative of process hollowing targeting a suspended svchost.exe process. The rule monitors for the creation of a suspended svchost.exe process followed by memory operations such as unmapping, allocating, and writing to the target process memory, culminating in thread context modification and resumption, a behavior consistent with malicious process injection techniques.
Detects the execution of macOS command interpreters (osascript, sh, bash, zsh) where the command line arguments reference specific timezones (e.g., Moscow, Minsk) or locale settings (e.g., RU, BY, KZ, AM, AZ). This pattern is often associated with adversary attempts to detect or evade sandbox environments based on regional settings or to align with specific target geographic profiles.
Detects execution of rundll32.exe via shell32.dll,ShellExec_RunDLL that spawns cmd.exe or powershell.exe with command lines containing excessive whitespace (spaces/line breaks). This behavior is characteristic of the exploitation of the CVE-2025-116624 vulnerability in LNK files used to hide the actual malicious command arguments from security monitoring.
Page 339 of 977