Detections
Explore public detection logic contributed by the community across SIEM and rule languages.
20,501 detections
Filters
Last updated
All Time
Detection languages
8,116
7,174
1,351
1,169
1,063
Contributors
4,878
2,724
2,695
2,646
2,356
Categories
20,501
11,881
5,887
5,179
4,868
Platforms
18,096
3,056
1,506
124
104
Products / Services
5,727
4,303
3,717
1,175
958
MITRE Techniques
9,493
7,577
3,461
2,848
2,703
CVEs
36
28
25
21
20
IDS Classtypes
1
Detects execution of 'npm install' or 'npm ci' commands that explicitly include '@marketfront' or '@tqm-mfe' scopes. This detection is designed to identify potential dependency confusion attacks where malicious actors publish public packages with the same names as internal private packages to trick build systems into downloading malicious code instead of legitimate internal modules.
Detects a process tree where Code.exe (VS Code) spawns node.exe as an intermediary process, which in turn spawns calc.exe. This matches the child_process.exec execution pattern observed when a malicious VS Code extension dependency decodes and runs an arbitrary command, demonstrating that any payload (not just calc.exe) can be executed via this chain.
Detects the execution of PowerShell with typical reverse shell command-line flags (-nop, -w hidden, -c) launched as a child process of cmd.exe. This pattern is commonly associated with remote code execution (RCE) scenarios, such as the exploitation of vulnerable applications that inject keystrokes or system commands via unauthenticated interfaces.
Detects persistence attempts by monitoring modifications to Windows 'Run' registry keys, the creation of executable files (.exe, .lnk) within the user's startup directory, or the use of common command-line utilities (reg.exe, powershell.exe) to modify these autostart persistence locations.
Detects iptables INPUT/PREROUTING NAT rule insertions that ACCEPT inbound TCP traffic on a specific port, matching DOGLEASH's deployment script behavior of opening a firewall hole for its backdoor listening port.
Detects execution of processes using 'LOAD_FILE' (often associated with MySQL or specific command-line utilities) to attempt to read sensitive container-related paths such as '/var/run/docker.sock' or '/proc/1/cgroup'. This behavior is indicative of an attacker attempting to gather information for container escape or environment reconnaissance.
Detects the use of Git commands (filter-branch, rebase -i, or force-push) that rewrite local or remote commit history. These operations are often used by adversaries to hide malicious code injections, remove evidence of unauthorized changes, or manipulate developer repository integrity.
Detects the execution of PowerShell commands that attempt to open or process a specific suspicious PDF file named 'Rate_Confirmation_LD-2026-0847.pdf' located in user download directories. This pattern is often indicative of social engineering attempts where a user is tricked into opening a malicious file.
This rule monitors for the execution of Azure CLI commands used to enumerate role assignments and Azure Container Registry (ACR) details. Adversaries often perform this reconnaissance to identify high-privilege accounts, discover container registries, or map out permissions to facilitate lateral movement or persistence within an Azure environment.
Detects attempts to retrieve Azure Container Registry (ACR) credentials, either by executing specific Azure CLI commands on a host or by initiating the Microsoft.ContainerRegistry/registries/listCredentials/action via Azure Activity Logs. Such activities may indicate an adversary attempting to gain unauthorized access to container registries.
Detects the execution of command-line arguments associated with the 'FortiEndpoint_Patch.exe' binary, which is used by the EKZ Stealer malware to perform credential harvesting operations such as listing, searching, viewing, exporting, or labeling sensitive data.
Detects instances where the FortiClient scheduler executable (scheduler.exe) spawns FortiTray.exe as a child process. While typically a legitimate operational behavior for the FortiClient application, this pattern is monitored to identify potential abuse where a trusted binary is leveraged as a proxy to execute secondary processes.
Detects the use of living-off-the-land binaries (mshta.exe, regsvr32.exe, certutil.exe, or wmic.exe) when executing with network-related or decoding command-line arguments. The rule specifically flags these invocations when they originate from parent processes not typically associated with legitimate system administration or software deployment workflows, targeting potential command-chain abuse or payload staging.
Detects the use of the Python psutil library to query network interface MAC addresses in order to identify potential virtual machine environments, a technique often used by the LIUSHEN malware to evade sandbox analysis.
Detects OS fingerprinting commands executed as child processes of a process that is actively listening on a network port, consistent with DOGLEASH.
Detects execution of Node.js applications that utilize specific Jscrambler obfuscation versions or the presence of these versions in package.json files, which may indicate the use of compromised or unauthorized supply chain dependencies.
Detects the execution of SharpDPAPI with command-line arguments designed to perform machine-scoped DPAPI masterkey and certificate recovery. This behavior is often associated with credential theft, particularly the extraction of sensitive secrets like ADFS token-signing keys or machine credentials stored in the DPAPI system.
Detects the execution of SniffPass, a known network password recovery tool often used by adversaries to capture passwords from various network protocols (e.g., POP3, IMAP, SMTP, FTP, and HTTP). The rule monitors process execution events for known SniffPass binary names and SHA256 hashes.
Detects the execution of reconnaissance commands (ipconfig.exe or tasklist.exe) launched directly by the PsExec service (psexesvc.exe). This pattern is often indicative of post-exploitation discovery activities following lateral movement using PsExec.
Detects the use of BITSAdmin to create or manage BITS jobs using specific command-line flags that include suspicious external file paths or URLs, which are commonly associated with malicious downloader activity.
Detects instances where known Windows auto-elevate binaries (fodhelper.exe, computerdefaults.exe, eventvwr.exe) are executed without a corresponding UAC consent.exe process. This behavior is indicative of a UAC bypass, often facilitated by registry key modifications (COM hijacking) to manipulate how these binaries are launched.
Page 340 of 977